Análise do processo de implementação de um sistema de gestão da segurança da informação com base na ISO/IEC 27001

Abstract

The theme of this research is the implementation of an Information Security Management System (ISMS) based on the ISO/IEC 27001 standard in an information technology organization. The main objective was to analyze the ISMS implementation process, addressing the stages of the PDCA cycle (Plan, Do, Check, Act) and the challenges faced by the organization. The methodology adopted was qualitative and exploratory, using case study, participant observation and document analysis to identify assets, assess risks and implement security controls. The main results showed signi cant improvements in information security governance, with increased resilience against cyber threats, strengthening customer condence and optimizing internal processes. The risk matrix and the risk treatment plan stood out as effective tools in prioritizing corrective actions and allocating resources. It is concluded that, although formal ISO/IEC 27001 certi cation has not yet been obtained, the implementation of the ISMS has resulted in notable advances in the protection of information assets, contributing to regulatory compliance and a security-oriented organizational culture. The study offers practical insights for organizations seeking to improve their information security management strategies.