Evaluation of the information technology security of the GAD municipal de Esmeraldas based on internal control standards.

Abstract

This research focuses on an audit of information technology security, compliance with current legal regulations, Internal Control Standard (ICS) 410, and the need to constantly evaluate the control environment of a municipality. The type of research was mixed: bibliographic-descriptive, bibliographic for the elaboration of the frame of reference with the collection of existing information in similar research, articles, and regulations; descriptive to collect, analyze and present the information obtained, both through the techniques used (survey, interview, and observation) in the field work and with the application of analytical, deductive and inductive methods, which provided a more complete view of the problem. During the presentation and discussion of the results, an analytical and refined exposition of the main findings was made, evidencing the level of IT risk and the low level of compliance with internal control standards, both those promulgated by the Comptroller General of the State and those established by ISO27001:2022. In the final report, due to the low incidence of the mechanisms implemented on the security of IT assets and existing technological infrastructure, in addition to the conclusions, recommendations and corrective actions that the institution should incorporate to formalize and strengthen its information security management system, through an improvement plan that involves the implementation of institutional security policies, were also included.