Rol del auditor en la evaluación del cumplimiento de las políticas de seguridad de la información

Abstract

The evaluation of security policies is a rigorous and methodical process, where the auditor's mission is to verify the mechanisms that have been implemented in organizations to comply with them. Policies are defined as the standards that must be met by the actors who participate in organizations and who make use of the information. Non-compliance with policies can cause loss of data assets and reputational damage, which can sometimes compromise organizational objectives. The role of the auditor in evaluating compliance with security policies should be focused on finding security weaknesses and evaluating the risk management carried out by the organization, supported by auditing techniques and tools that allow him to obtain the necessary evidence to issue a concept on compliance with policies, updating them and the management carried out to the risks of the organization.