Estudio exploratorio de las prácticas y desafíos en la gestión de riesgos de seguridad de la información en Proima, Honduras
Loading...
Date
2026-01-01
Journal Title
Journal ISSN
Volume Title
Publisher
Universidad Tecnológica Centroamericana UNITEC
Abstract
El incremento sostenido de incidentes de ciberseguridad en América Latina y el bajo nivel de madurez de Honduras en el Índice Global de Ciberseguridad han evidenciado la vulnerabilidad de empresas de distribución como PROIMA, cuya operación depende de información y cadenas logísticas en tiempo real. Ante la ausencia de diagnósticos formales sobre riesgos de seguridad de la información, se vuelve necesario analizar de manera sistemática las prácticas actuales y sus brechas frente a los estándares internacionales. El objetivo de este estudio fue describir el grado de alineación de las prácticas y controles de gestión de riesgos de seguridad de la información de PROIMA con las normas ISO/IEC 27001:2022 e ISO/IEC 27005:2018, a fin de priorizar oportunidades de mejora que fortalezcan la seguridad organizacional y la continuidad del negocio. Se empleó un enfoque mixto con dominio cualitativo y componente cuantitativo embebido (QUAL→quan), alcance exploratorio-descriptivo y diseño no experimental, transversal y de estudio de caso único. La información se obtuvo mediante encuesta tipo Likert a colaboradores usuarios de activos tecnológicos, entrevistas semiestructuradas a informantes clave, revisión documental estructurada y observación de procesos, integrando el análisis con técnicas descriptivas e inferenciales y un modelo Random Forest. Los resultados muestran un nivel de madurez moderado: se observan avances en controles como autenticación multifactor, política de seguridad y gestión de riesgos de terceros, pero persisten brechas relevantes en mínimo privilegio, actualización de equipos, cumplimiento legal y controles físicos y operativos. Se concluye que la alineación con ISO es parcial y que la cultura organizacional aún otorga un peso limitado al enfoque preventivo y a la corresponsabilidad, por lo que se recomiendan acciones priorizadas de capacitación, estandarización y monitoreo para reducir riesgos residuales e incrementar la resiliencia de PROIMA.
The sustained increase in cybersecurity incidents in Latin America, together with Honduras’s low level of maturity in the Global Cybersecurity Index, has exposed the vulnerability of distribution companies such as PROIMA, whose operations depend on information and real time logistics chains. In the absence of formal diagnostics on information security risks, it becomes necessary to systematically analyze current practices and their gaps against international standards. The objective of this study was to describe the degree of alignment of PROIMA’s information security risk management practices and controls with ISO/IEC 27001:2022 and ISO/IEC 27005:2018, to prioritize improvement opportunities that strengthen organizational security and business continuity. A mixed methods approach was used, with qualitative dominance and an embedded quantitative component (QUAL→quan), exploratory descriptive scope, and a non- experimental, cross sectional, single case study design. Data was collected through a Likert type survey applied to staff who use technological assets, semi structured interviews with key informants, structured document review, and process observation. The analysis combined descriptive and inferential statistics with a Random Forest model. The results show a moderate level of maturity: there is progress in controls such as multifactor authentication, security policy, and third-party risk management, but significant gaps persist in least privilege, equipment updating, legal compliance, and physical and operational controls. The study concludes that alignment with ISO standards is partial and that the organizational culture still assigns limited weight to a preventive and shared responsibility approach, so prioritized actions in training,
The sustained increase in cybersecurity incidents in Latin America, together with Honduras’s low level of maturity in the Global Cybersecurity Index, has exposed the vulnerability of distribution companies such as PROIMA, whose operations depend on information and real time logistics chains. In the absence of formal diagnostics on information security risks, it becomes necessary to systematically analyze current practices and their gaps against international standards. The objective of this study was to describe the degree of alignment of PROIMA’s information security risk management practices and controls with ISO/IEC 27001:2022 and ISO/IEC 27005:2018, to prioritize improvement opportunities that strengthen organizational security and business continuity. A mixed methods approach was used, with qualitative dominance and an embedded quantitative component (QUAL→quan), exploratory descriptive scope, and a non- experimental, cross sectional, single case study design. Data was collected through a Likert type survey applied to staff who use technological assets, semi structured interviews with key informants, structured document review, and process observation. The analysis combined descriptive and inferential statistics with a Random Forest model. The results show a moderate level of maturity: there is progress in controls such as multifactor authentication, security policy, and third-party risk management, but significant gaps persist in least privilege, equipment updating, legal compliance, and physical and operational controls. The study concludes that alignment with ISO standards is partial and that the organizational culture still assigns limited weight to a preventive and shared responsibility approach, so prioritized actions in training,
Keywords
Gestión de riesgos de seguridad de la información, ISO/IEC 27001, ISO/IEC 27005, Cultura de seguridad, Continuidad del negocio