NCI Procesos: Tecnología de la Información

Capacitación Virtual

24 Nov 202310:54

Summary

TLDRThis session delves into internal control standards for information technology, focusing on processes. It highlights laws like data protection and electronic signature, and standards such as ISO 27001. The script discusses Colombian General Controller's Office's internal control norms, which guide public entities in organizing, managing IT projects, infrastructure, and security. It emphasizes the importance of these norms in ensuring information security, confidentiality, integrity, availability, and privacy, as well as the effectiveness and efficiency of security controls in both public and private organizations managing public resources.

Takeaways

📜 The session covers internal control standards with a focus on information technology processes, highlighting the importance of laws and regulations such as the Personal Data Protection Law and the Electronic Signature Law.
🔒 ISO 27001 is mentioned as a standard that sets requirements for an information security management system, providing a framework for managing and governing information and technology systems.
🏛 The General Comptroller's Office has issued internal control standards, specifically norms 410, which guide the organization, management, and operation of technological systems within public entities.
🛠️ The norms 4101 to 4105 define how public entities should organize, manage committees, segregate functions, and have a strategic plan, policies, and procedures applicable to information technology and communications.
🌐 Norms 4106 to 41014 refer to information architecture, technological projects, software development, maintenance, acquisition, and technological infrastructure, including their controls.
🔒 Norms 41011 to 410144 focus on information technology security, contingency plans, administration, support, monitoring, and evaluation of processes and services.
🌐 Norms 41015 to 41017 relate to interaction and communication, including web portals, telematic services, intranets, training, and electronic signature management.
🛡️ Internal control standards are a set of principles, policies, and procedures established to ensure the security, confidentiality, integrity, availability, and privacy of information, as well as the effectiveness and efficiency of security controls.
🏢 The organization of the Information and Communication Technology (ICT) unit is emphasized, requiring public sector entities to integrate a work framework for technology processes and involve senior management in decision-making.
📝 The implementation of internal control standards requires the acquisition of security software, intrusion detection systems, backup and recovery systems, and the incorporation of specialized professionals in cybersecurity to improve organizational efficiency and protect critical information assets.
📚 It's essential to have essential and key controls for the proper implementation of internal control standards for ICT, ensuring pre-authorization security through actions and verification methods aligned with institutional plans and budgets.

Q & A

What is the main focus of the session 4 of module 2?
-The main focus of the session is on internal control standards, specifically those related to information technology processes.
Which laws and regulations are mentioned in the script as applicable to information management?
-The script mentions the Personal Data Protection Law, the Electronic Signature Law, and standards such as ISO 27001.
What does ISO 27001 establish in terms of information security management?
-ISO 27001 establishes the requirements for an information security management system.
What is the purpose of the internal control standards issued by the General Comptroller's Office?
-The purpose of these standards is to guide the implementation, operation, and updating of technological systems within organizations.
How many internal control standards are there in the script's reference?
-There are 17 internal control standards, ranging from 4101 to 4105.
What do the standards from 4101 to 4105 define regarding public entities' organization and management?
-They define how public entities should organize, manage committees, segregate functions, have a strategic plan, and establish policies and procedures applicable to information technology and communications.
What is the significance of the internal control standards in ensuring the security and confidentiality of information?
-The internal control standards are a set of principles, policies, and procedures established to ensure the security, confidentiality, integrity, availability, and privacy of information, as well as the effectiveness and efficiency of security controls.
What are the key areas that the internal control standards cover in terms of information technology?
-The key areas include the organization of the information technology unit, risk management, security of information technology, contingency planning, support administration, monitoring, and evaluation of processes and services.
What is the importance of training and awareness in the implementation of internal control standards?
-Training and awareness are crucial to ensure that all employees and third parties with access to systems and information are trained in security controls and comply with established policies and procedures.
What are some of the technical and administrative controls that should be implemented to ensure compliance with policies and procedures?
-Some controls include firewalls, antivirus systems, intrusion detection systems, backup and recovery systems, and password policies.
How often should security controls be monitored and evaluated to identify potential weaknesses and improve them?
-Security controls should be regularly monitored and periodically evaluated to identify potential weaknesses and continuously improve the security controls.
What is the role of the Information Security Officer in the context of internal control standards?
-The Information Security Officer is responsible for ensuring the implementation and maintenance of information security controls to guarantee the security of the organization's critical information assets and reduce the risk of system interruptions.

Outlines

00:00

📜 Introduction to Internal Control Standards for IT

This paragraph introduces the session on internal control standards with a focus on information technology processes. Yael Ávila and Jorge Cortés highlight the importance of laws and regulations such as data protection and electronic signature laws, as well as standards like ISO 27001 and COBIT that provide a framework for information security management. The paragraph outlines the internal control standards issued by the General Comptroller of the State, specifically norms 410 which include 17 standards from 4101 to 4105. These standards guide public entities on how to organize, manage committees, segregate functions, and establish strategic plans and policies for information technology. The paragraph emphasizes the role of these standards in ensuring the security, confidentiality, integrity, availability, and privacy of information, as well as the effectiveness and efficiency of security controls in organizations managing public resources.

05:00

🛡️ Implementing and Evaluating IT Security Controls

The second paragraph delves into the implementation and evaluation of IT security controls as dictated by the internal control standards. It discusses the need for policies and procedures to identify and mitigate risks, including access controls, authentication, and ensuring the confidentiality, integrity, and availability of information. Technical and administrative controls such as firewalls, antivirus systems, intrusion detection systems, and backup and recovery policies are mentioned. The paragraph stresses the importance of training and awareness programs for personnel on the significance of security controls and the need for regular monitoring and periodic evaluations to improve security measures. It also touches on the necessity of acquiring security software, hiring IT security professionals, and understanding essential controls and key verification methods to ensure the proper authorization of processes and compliance with institutional plans and budgets related to information technology.

10:02

🔏 Concluding Remarks on IT Internal Control Standards

The final paragraph concludes the discussion on IT internal control standards, inviting participants to review the material on the platform and complete the session evaluation. It mentions the upcoming module three, which will focus on the weaknesses of internal controls and their effects. The paragraph also reminds participants of the obligation to protect personal access keys and the potential need to revoke electronic signature certificates if compromised, emphasizing the importance of confidentiality and security in IT management.

Mindmap

Keywords

💡Information Management

Information Management refers to the processes and strategies involved in acquiring, distributing, storing, and effectively utilizing information within an organization. In the video, it is discussed in the context of laws and regulations that govern the management of information, such as data protection laws and electronic signature laws, which are crucial for ensuring the security and integrity of information.

💡ISO 27001

ISO 27001 is an international standard that specifies the requirements for an information security management system (ISMS). It is mentioned in the script as one of the norms establishing requirements for the information security management system, indicating its importance in ensuring that organizations have a systematic approach to managing their information security risks.

💡Internal Control Norms

Internal Control Norms are a set of principles, policies, and procedures established to ensure the security, confidentiality, integrity, availability, and privacy of information. The script discusses these norms, particularly norms 410, which are issued by the General Comptroller's Office and include 17 standards from 4101 to 4105, guiding the organization, management, and governance of information technology systems.

💡Information Technology Governance

Information Technology Governance is the framework of rules and practices that ensure the effective and efficient use of information technology in enabling an organization's strategies and objectives. The script refers to the 'Norma Covid' as providing a reference framework for the governance and management of information systems and technology, emphasizing the need for a structured approach to IT governance.

💡Data Protection Law

A Data Protection Law is a legal framework designed to protect the privacy and security of individuals with respect to the processing of personal data. In the script, it is highlighted as one of the applicable laws in information management, indicating the importance of safeguarding personal data within the context of information security.

💡Electronic Signature Law

The Electronic Signature Law refers to legislation that gives legal recognition to electronic signatures, allowing them to be used in the same way as traditional handwritten signatures. The script mentions this law as part of the legal framework governing the management of information, underlining the significance of legally valid electronic transactions.

💡Information Security

Information Security is the practice of protecting information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction. The script discusses various aspects of information security, including the establishment of a security plan, contingency plans, and the implementation of technical and administrative controls to ensure the security of information technology.

💡Risk Management

Risk Management is the process of identifying, assessing, and controlling risks to minimize their impact on an organization's objectives. The script emphasizes the importance of risk management in the context of information technology, where organizations must evaluate risks associated with their information systems and define policies and procedures to mitigate them.

💡Contingency Plan

A Contingency Plan is a documented procedure to follow in the event of an emergency or disaster, aiming to ensure the continuity of operations. The script refers to the development of a contingency plan for information technology, which is crucial for organizations to respond effectively to potential disruptions in their IT systems.

💡Training and Awareness

Training and Awareness are critical components of an organization's security strategy, ensuring that employees understand the importance of security controls and how to use them effectively. The script highlights the need for organizations to generate training and awareness processes for their staff regarding information security, which is essential for preventing risks associated with the use of IT.

💡Compliance

Compliance refers to an organization's adherence to established policies, procedures, laws, regulations, and standards. In the script, compliance is discussed in the context of ensuring that security controls are implemented and followed, including the use of passwords, access controls, and other technical and administrative measures to ensure the protection of information.

Highlights

Introduction to session 4 of module 2 focusing on internal control standards for information technology processes.

Mention of applicable laws and regulations such as the Data Protection Law and the Electronic Signature Law.

Discussion of standards like ISO 27001 for information security management systems.

Explanation of the internal control standards issued by the General Comptroller's Office, specifically norms 410.

Norms 4101 to 4105 outline the organization and management of public entities in information technology.

Norms 41006 to 41010 relate to information architecture, technological projects, and software and infrastructure acquisition.

Norms 41011 to 410144 focus on information technology security, contingency plans, and process monitoring and evaluation.

Norms 41015 to 41017 pertain to interaction and communication, including web portals, telematic services, and electronic signatures.

Internal control standards ensure the security, confidentiality, integrity, availability, and privacy of information.

The importance of managing risks and threats associated with information technology use.

Emphasis on the organization of the information technology and communication unit within public entities.

The necessity of involving senior management in decision-making and establishing an IT organizational structure.

Highlighting the role of an information security officer in ensuring the implementation and maintenance of information security controls.

Requirement for organizations to apply IT and communication controls throughout the information lifecycle.

The importance of training and awareness for personnel on the use of security controls to prevent risks.

The need for regular monitoring and periodic evaluation of implemented security controls to identify weaknesses and improve them.

Implementation of these standards requires the acquisition of security software and systems, as well as specialized IT security professionals.

Essential controls and key actions for the correct implementation of internal control standards for IT.

The application of prior internal controls and their criteria for legality, truthfulness, convenience, opportunity, relevance, and conformity.

The verification of trainings through electronic files or signed electronic messages to ensure compliance with regulations.

The obligation not to divulge or share personal access keys to prevent the revocation of electronic signature certificates.

Conclusion of the review of internal control standards with an invitation to review material and complete the session evaluation.