EN 
ES Information Technology Consulting
What would be the consequences if key information was to be lost from your business? How would the organization be affected if non-authorized third parties had access to confidential information of your business? Have you estimated the cost for your business if there is a failure in the information systems for a period of time? Would you be able to continue with your operations?
Our service focuses on the development of an IT risk analysis with the purpose of obtaining an initial overview of IT risks that the company faces. This evaluation serves as a framework to prioritize management risk activities in a more detailed way.
The evaluation allows:
- Identifying the areas of potential high risk through the business.
- Have a general overview of the main aspects of risk in which the business is exposed. Identifying these aspects is highly important in order to manage them.
- Provide guidelines for main risk scenarios, which constitute an essential input for a detailed analysis of the risks.
The end product is a report that contains an inventory of the risks found.
Contact Person
Security and privacy services managing risks
Information constitutes an essential asset for any Company nowadays and, therefore, requires protection. Our service focuses on the development of an action plan that enables to establish inside the organization a continuous process of security, with the aim to achieve and maintain an adequate level of security.
ECOVIS Guatemala aims to assess the degree of reliability of the information generated through the application systems, which allows Financial Audit to define, confirm or modify its audit strategy, according to whether it is trusted.
Perform the identification and documentation of the internal control framework supported by the company in technological and information aspects, that includes:
- General IT Controls.
- Business Cycle Internal Control.
- Design and execution of data tests.
The areas of review, in order to assess whether the internal controls of systems have been designed effectively, properly implemented and whether these are operating effectively.
The areas of review performed by the ECOVIS Guatemala team will be: System Security, Business Cycle Controls and Detailed Tests.
Evaluation areas by ECOVIS Guatemala:
- Data center and network operations.
- Backup.
- Network diagram.
- Network and communications procedures.
- System network monitoring procedures.
- Information Technology Service Levels.
- Physical and logical Security Information.
- Procedures for the creation, modification and cancellations in the systems.
- Physical security policies.
- Systems security policies and passwords.
- Matrix of user profiles in the systems.
- Program and databases modification
- Program modification process.
- Databases modification process.
- Information Technology Services agreement
- Evaluation of Information Technology agreement
- Evaluation of services provided by suppliers.
A growing number of risks related to information security, privacy and data integrity have a higher impact on business profitability, additionally generating reputational damage.
Security must be integrated into the information technology processes, in order to facilitate the proper protection of IT assets.
Organizations need to implement and maintain a comprehensive security and privacy risk management system, aligning human resources, processes and the various elements of technology, in order to continue in such a competitive market and to achieve adequate levels of security.
Maintaining a comprehensive security management program covers the following areas:
- Government and Information Technology Strategy (COBIT).
- International and industry specific standards (ISO 27001. Information Security, ISO 31000 RISK MANAGER).
- Risk management (COSO – ERM).
- Compliance with laws and regulations (JM-102-2011, SOX Sarbanes-Oxley Law).
- Training and Awareness.
- Effective assurance.
- Metrics and Indicators.
ECOVIS Guatemala can help you understand the key factors that allow your business to reduce those exposed to risks related to privacy and protection of personal data, including the following areas:
- A general security policy appropriate for the organization
- An inventory of the company’s systems (infrastructure, IT Systems, Networks, Applications, Organization, Staff)
- The requirements for system protection
- The threats to which the systems are exposed
- The controls suggested to minimize the threats
- The actual state of the implementation of the suggested control.
In accordance with what is defined in ISO 27001, the information security assessment is good for a good Information Technology Government.
