EVALUATION OF INFORMATION SECURITY PROCESSES INTEGRATING THE CONTROLLERSHIP AND IT AREAS

• Autor(a) principal: Schneider, Luiz Carlos
• Data de Publicação: 2014
• Outros Autores: Vanti, Adolfo Alberto, Cobo, Angel, Thomaz, João Luis Peruchena
• Tipo de documento: Artigo
• Idioma: por
• Título da fonte: Revista Universo Contábil
• Texto Completo: https://ojsrevista.furb.br/ojs/index.php/universocontabil/article/view/4139
• topic: Controllership. Information Technology. Information Security.; Controladoría. Tecnología de la Información. Seguridad de información.; Controladoria; Tecnologia da Informação; Segurança da Informação; Gestão da Informação.

The Controllership is responsible for the support decision-making process in organizations and because of that, it needs to participate in the information security processes. Therefore, this study evaluated the way of applied information security processes by integrating the areas of Controllership and IT. Methodologically the work was characterized as a descriptive research in a quali-quanti process, considering the perception of respondents in 30 questions related to the proposed problem. A supplementary questionnaire was applied based on ISO / IEC 27002 standard implying causal explanation of areas of integration and definition of different categories of professionals when they deal information security. We developed a case study applied to data collection instruments related to questionnaires and interviews, content analysis in identifying the critical business processes and risks associated with information environment. Thus, it was possible to improve the operational processes of these two areas, reducing operational risks through different actions related with participation of users, creating teams, greater standardization, communication alignment, greater control in changing systems, improvements to policies and safety standards information, use of business intelligence tools, training, information integration and focus in core process. Finally, it responded to objective of evaluating information security processes by integrating the areas of Controllership and IT.