COMPLIANCE WITH ABNT ISO/IEC 27001-2006

A CASE STUDY ON THE IMPLEMENTATION OF AN INFORMATION SECURITY MANAGEMENT SYSTEM

Abstract

Since the 1990s, the management models of organizations have undergone strong processes of technological innovation, driven by the acceleration of globalization. Executives and managers need quick solutions in the face of an increasingly globalized world. In this context, Information Security Management, which plays an extremely important role in the organizational environment, is geared towards protecting information from the constant digital threats of the external environment. This research aims to verify the compliance of a supermarket with the requirements of standard 27001 of the Brazilian Association of Technical Standards of 2006, especially with regard to the existence and implementation of an Information Security Management System and Information Security Policy. The research is characterized as descriptive with a case study and qualitative approach. The data collection instruments were a questionnaire applied to the Information Technology Manager and a checklist applied to the Human Resources Coordinator of the supermarket under study. The results show that, although the supermarket adopts some preventative actions, it was not found to have an Information Security Policy, nor was it found to have an Information Security Management System, as established by the aforementioned standard in items A.5 and A.8. To this end, it is suggested that the supermarket's management include an Information Security Policy in its strategic planning, and make the supermarket less vulnerable to digital attacks from the external environment.