Maturity analysis of information access control in an organization

Even an organization that does not know IT as its core business invest in actions that seek to increase the information security to achieve their strategic objectives. The information access control appears as one of the pillars to ensure the information security. Internationally adopted standards such as ISO/IEC 27002, and libraries of best practices such COBIT emerge as a source of knowledge but are not methodologies that indicate action to be taken. This study sought to correlate these standards to evaluate the maturity of processes and controls of information access control in an organization. A survey applied to organization analysts was added to this methodology and showed a low degree of maturity of these controls and mapped the need to develop basic standards as an Information Security Policy and operational standards, as a way to reduce the uncontrolled and inappropriate use of IT resources of the organization. These vulnerabilities pose a threat to organization strategic information security.