Magerit
154
"#$#%&’(#) *’ +*"#$#%&(+,#)$’% -./0#,+% MAGERIT – versión 2 "1234353678 41 +9:5;<;< = >1<2;?9 41 (;1<63< 41 53< %;<21@8< 41 #9A3B@8C;?9 I - Método D "#$#%&’(#) *’ +*"#$#%&(+,#)$’% -./0#,+% "84B;4E FG 41 HI9;3 41 FGGJ $#-) KFJLGMLGNOLP Catálogo general de publicaciones oficiales Q22RSTTRIU5;C8C;391<V84@;9;<2B8C;39V1<
-
Upload
carlos-ayala -
Category
Documents
-
view
1.097 -
download
4
Transcript of Magerit
!! "#$#%&'(#)!*'!
+*"#$#%&(+,#)$'%!-./0#,+%!
!!!!!!!!!!!!!!!!!!!!!!
MAGERIT – versión 2
"1234353678!41!+9:5;<;<!=!>1<2;?9!41!(;1<63<!41!53<!%;<21@8<!41!#9A3B@8C;?9!
!
I - Método !
D!"#$#%&'(#)!*'!+*"#$#%&(+,#)$'%!-./0#,+%!"84B;4E!FG!41!HI9;3!41!FGGJ!$#-)!KFJLGMLGNOLP!Catálogo general de publicaciones oficiales Q22RSTTRIU5;C8C;391<V84@;9;<2B8C;39V1<!!
!
!
EQUIPO RESPONSABLE DEL PROYECTO MAGERIT versión 2
!Director: Francisco López Crespo "#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%!!Miguel Angel Amutio Gómez "#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%!!Javier Candau 3'$&()!3(#4&)256#.)!7-.#)$-2!!Consultor externo: José Antonio Mañas 3-&'*(8&#.)!9$#:'(%#*-*!/)2#&;.$#.-!*'!"-*(#*!
"-6'(#&!:'(%#5$!<!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!>!?*'!@ABC!
Índice!1. Introducción a Magerit ..................................................................................................6 @D@D!E1F'&#:)%!*'!"-6'(#& DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDG @D<D!H$&()*I..#5$!-2!-$82#%#%!J!6'%$!*'!(#'%6)% DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDK @D>D!L2!-$82#%#%!J!6'%$!*'!(#'%6)%!'$!%I!.)$&'M&)DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDN @D>D@D!3)$.#'$.#-.#5$!J!O)(,-.#5$DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDP @D>D<D!H$.#*'$.#-%!J!('.I4'(-.#5$ DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDP
@DBD!E(6-$#Q-.#5$!*'!2-%!6IR-%DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDP @DBD@D!")*)!*'!',42') DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD@S @DBD<D!L2!.-&82)6)!*'!'2','$&)% DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD@@ @DBD>D!T-!6IR-!*'!&;.$#.-%DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD@@
@DAD!/-(-!2)%!UI'!V-$!&(-1-F-*)!.)$!"-6'(#&!:@DSDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD@< @DGD!L:-2I-.#5$W!.'(&#O#.-.#5$W!-I*#&)(R-!J!-.('*#&-.#5$DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD@< @DKD!X3I8$*)!4().'*'!-$-2#Q-(!J!6'%&#)$-(!2)%!(#'%6)%Y DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD@B
2. Realización del análisis y de la gestión .....................................................................16 <D@D!+$82#%#%!*'!Z#'%6)% DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD@G <D@D@D!/-%)!@[!+.&#:)% DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD@K <D@D<D!/-%)!<[!+,'$-Q-%DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD<< <D@D>D!/-%)!B[!\'&'(,#$-.#5$!*'2!#,4-.&) DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD<> <D@DBD!/-%)!A[!\'&'(,#$-.#5$!*'2!(#'%6)DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD<B <D@DAD!/-%)!>[!]-2:-6I-(*-%DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD<B <D@DGD!Z':#%#5$!*'2!4-%)!B[!#,4-.&)!('%#*I-2 DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD<G <D@DKD!Z':#%#5$!*'2!4-%)!A[!(#'%6)!('%#*I-2 DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD<G
<D<D!^'%$!*'!Z#'%6)% DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD<G <D<D@D!T-!#$&'(4('&-.#5$!*'!2)%!:-2)('%!*'!#,4-.&)!J!(#'%6)!('%#*I-2'% DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD<G <D<D<D!]'2'..#5$!*'!%-2:-6I-(*-%DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD<K <D<D>D!/;(*#*-%!J!6-$-$.#-% DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD<N <D<DBD!T-!-.&#&I*!*'!2-!\#('..#5$ DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD>S <D<DAD!Z':#%#5$!*'2!4-%)!@[!-.&#:)% DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD>@
3. Estructuración del proyecto .......................................................................................32 >D@D!/-(&#.#4-$&'%DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD>> >D<D!\'%-(()22)!*'2!4()J'.&) DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD>B >D<D@D!_#%#5$!62)1-2 DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD>K
>D>D!/().'%)!/@[!/2-$#O#.-.#5$DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD>N >D>D@D!+.&#:#*-*!+@D@[!L%&I*#)!*'!)4)(&I$#*-*DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDBS >D>D<D!+.&#:#*-*!+@D<[!\'&'(,#$-.#5$!*'2!-2.-$.'!*'2!4()J'.&)DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDB< >D>D>D!+.&#:#*-*!+@D>[!/2-$#O#.-.#5$!*'2!4()J'.&) DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDBK >D>DBD!+.&#:#*-*!+@DB[!T-$Q-,#'$&)!*'2!4()J'.&)DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDAS >D>DAD!]R$&'%#%!*'2!4().'%)!/@ DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDAB >D>DGD!T#%&-!*'!.)$&()2!*'2!4().'%)!/@ DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDAB
>DBD!/().'%)!/<[!+$82#%#%!*'!(#'%6)%DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDAG >DBD@D!+.&#:#*-*!+<D@[!3-(-.&'(#Q-.#5$!*'!2)%!-.&#:)% DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDAN >DBD<D!+.&#:#*-*!+<D<[!3-(-.&'(#Q-.#5$!*'!2-%!-,'$-Q-%DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDG> >DBD>D!+.&#:#*-*!+<D>[!3-(-.&'(#Q-.#5$!*'!2-%!%-2:-6I-(*-%DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDGA >DBDBD!+.&#:#*-*!+<DB[!L%&#,-.#5$!*'2!'%&-*)!*'!(#'%6)DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDGK >DBDAD!]R$&'%#%!*'2!4().'%)!/< DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDKS >DBDGD!T#%&-!*'!.)$&()2!*'2!4().'%)!/< DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDK@
>DAD!/().'%)!/>[!^'%$!*'!(#'%6)%DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDK< >DAD@D!+.&#:#*-*!+>D@[!`),-!*'!*'.#%#)$'%DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDK> >DAD<D!+.&#:#*-*!+>D<[!L2-1)(-.#5$!*'2!42-$!%'6I(#*-*!*'!2-!#$O)(,-.#5$ DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDKA >DAD>D!+.&#:#*-*!+>D>[!LF'.I.#5$!*'2!42-$DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDKN >DADBD!]R$&'%#%!*'2!4().'%)!/> DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDKP >DADAD!T#%&-!*'!.)$&()2!*'2!4().'%)!/> DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDKP
4. Desarrollo de sistemas de información .....................................................................80 BD@D!H$#.#-2#Q-.#5$!*'!2)%!4().'%)%DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDNS
"-6'(#&!:'(%#5$!<!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!B!?*'!@ABC!
BD<D!3#.2)!*'!:#*-!*'!2-%!-42#.-.#)$'% DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDN@ BD<D@D!/2-$!*'!%#%&',-% DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDN@
BD>D!+$82#%#%!*'!(#'%6)% DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDN< BDBD!^'%$!*'!(#'%6)% DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDN< BDAD!"a`ZH3+!:'(%#5$!>DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDNB BDAD@D!]/\!b!]'6I(#*-*!*'2!4().'%)!*'!*'%-(()22)DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDNG BDAD<D!]]H!b!]'6I(#*-*!*'2!%#%&',-!*'!#$O)(,-.#5$DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDNN
BDGD!Z'O'('$.#-% DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDP<
5. Consejos prácticos......................................................................................................94 AD@D!/-(-!#*'$&#O#.-(!-.&#:)% DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDPB AD<D!/-(-!*'%.I1(#(!J!,)*'2-(!2-%!*'4'$*'$.#-%!'$&('!-.&#:)%DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDPA AD>D!/-(-!:-2)(-(!-.&#:)%DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDPK ADBD!/-(-!#*'$&#O#.-(!-,'$-Q-%DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDPN ADAD!/-(-!:-2)(-(!-,'$-Q-% DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDPN ADGD!/-(-!%'2'..#)$-(!%-2:-6I-(*-% DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDPP ADKD!+4()M#,-.#)$'%!%I.'%#:-% DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDPP ADKD@D!/()&'..#5$!18%#.- DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD@SS
ADND!Z'O'('$.#-% DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD@S@
Apéndice 1. Glosario .....................................................................................................102 @D@D!`;(,#$)%!'$!'%4-c)2DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD@S< @D<D!`;(,#$)%!-$62)%-F)$'% DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD@SP @D>D!H]EdHL3!^I#*'!K>[<SS<DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD@@S @DBD!Z'O'('$.#-% DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD@@@
Apéndice 2. Referencias ...............................................................................................113
Apéndice 3. Marco legal ................................................................................................114 >D@D!/().'*#,#'$&)!-*,#$#%&(-&#:) DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD@@B >D<D!/()&'..#5$!*'!*-&)%!*'!.-(8.&'(!4'(%)$-2DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD@@B >D>D!e#(,-!'2'.&(5$#.-DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD@@B >DBD!H$O)(,-.#5$!.2-%#O#.-*-DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD@@A >DAD!]'6I(#*-*!*'!2-%!('*'%!J!*'!2-!#$O)(,-.#5$ DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD@@A
Apéndice 4. Marco de evaluación y certificación .......................................................116 BD@D!]#%&',-%!*'!6'%$!*'!2-!%'6I(#*-*!*'!2-!#$O)(,-.#5$!?]^]HC DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD@@G BD@D@D!T-!.'(&#O#.-.#5$DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD@@K BD@D<D!T-!-.('*#&-.#5$!*'!2-!'$&#*-*!.'(&#O#.-*)(- DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD@@P BD@D>D!`'(,#$)2)6R-DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD@<S BD@DBD!Z'O'('$.#-%DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD@<@
BD<D!3(#&'(#)%!.),I$'%!*'!':-2I-.#5$!?33CDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD@<@ BD<D@D!f'$'O#.#-(#)% DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD@<< BD<D<D!Z'UI#%#&)%!*'!%'6I(#*-* DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD@<> BD<D>D!3('-.#5$!*'!4'(O#2'%!*'!4()&'..#5$ DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD@<B BD<DBD!9%)!*'!4()*I.&)%!.'(&#O#.-*)% DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD@<A BD<DAD!`'(,#$)2)6R-DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD@<A BD<DGD!Z'O'('$.#-%DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD@<G
Apéndice 5. Herramientas.............................................................................................128 AD@D!/HT+ZDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD@<P AD<D!Z'O'('$.#-% DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD@>S
Apéndice 6. Evolución de Magerit versión 1.0 ............................................................131 GD@D!T#1()!HD!^IR-!*'!-4()M#,-.#5$!-!2-!%'6I(#*-*!*'!2)%!%#%&',-%!*'!#$O)(,-.#5$ DDDDDDDDDDDDDDDDDD@>@ GD<D!T#1()!HHD!^IR-!*'!4().'*#,#'$&)% DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD@>@ GD>D!T#1()!HHHD!^IR-!*'!&;.$#.-% DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD@>< GDBD!T#1()!H_D!^IR-!4-(-!*'%-(()22-*)('%!*'!-42#.-.#)$'% DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD@>< GDAD!T#1()!_D!^IR-!4-(-!('%4)$%-12'%!*'2!*),#$#)!4()&'6#12' DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD@>> GDGD!T#1()!_HD!+(UI#&'.&I(-!*'!2-!#$O)(,-.#5$!J!'%4'.#O#.-.#)$'%!*'!2-!#$&'(O-Q!4-(-!'2!#$&'(.-,1#)!*'!*-&)%DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD@>> GDKD!T#1()!_HHD!Z'O'('$.#-!*'!$)(,-%!2'6-2'%!J!&;.$#.-% DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD@>>
"-6'(#&!:'(%#5$!<!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!A!?*'!@ABC!
Apéndice 7. Caso práctico ............................................................................................134 KD@D!T-!V#%&)(#-DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD@>B KD<D!/().'%)!/<[!+$82#%#%!*'!(#'%6)%DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD@>A KD<D@D!`-('-!`<D@D@D!H*'$&#O#.-.#5$!*'!-.&#:)% DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD@>K KD<D<D!`-('-!`<D@D<[!\'4'$*'$.#-% DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD@>N KD<D>D!`-('-!`<D@D>[!_-2)(-.#5$ DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD@>P KD<DBD!+.&#:#*-*!+<D<[!3-(-.&'(#Q-.#5$!*'!2-%!-,'$-Q-%DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD@B@ KD<DAD!+.&#:#*-*!+<DB[!L%&#,-.#5$!*'!#,4-.&)!J!(#'%6) DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD@B< KD<DGD!+.&#:#*-*!+<D>[!3-(-.&'(#Q-.#5$!*'!2-%!%-2:-6I-(*-%DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD@BA KD<DKD!+.&#:#*-*!+<DB[!L%&#,-.#5$!*'2!'%&-*)!*'!(#'%6)DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD@BN
KD>D!/().'%)!/>[!^'%$!*'!(#'%6)%DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD@AS KD>D@D!+.&#:#*-*!+>D@[!`),-!*'!*'.#%#)$'%DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD@AS KD>D<D!+.&#:#*-*!+>D<[!/2-$!*'!%'6I(#*-*DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD@A@ KD>D>D!L:)2I.#5$!*'!2)%!#$*#.-*)('%!*'!#,4-.&)!J!(#'%6) DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD@A< KD>DBD!3-2#O#.-.#5$!%'60$!2)%!3(#&'(#)%!*'!]'6I(#*-*!*'2!3]+LDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD@AB KD>DAD!3-2#O#.-.#5$!%'60$!2-!$)(,-!H]EdHL3!@KKPP[<SSA DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD@AB
!
"-6'(#&!:'(%#5$!<! ! H$&()*I..#5$!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!G!?*'!@ABC!
1. Introducción a Magerit L2!3]+L@!V-!'2-1)(-*)!J!4(),I':'!"-6'(#&<!.),)!('%4I'%&-!-!2-!4'(.'4.#5$!*'!UI'!2-!+*,#$#%g&(-.#5$!?J!'$!6'$'(-2!&)*-!2-!%).#'*-*C!*'4'$*'!*'!O)(,-!.('.#'$&'!*'!2-%!&'.$)2)6R-%!*'!2-!#$O)(g,-.#5$!4-(-!2-!.)$%'.I.#5$!*'!%I%!)1F'&#:)%!*'!%'(:#.#)D!T-!(-Q5$!*'!%'(!*'!"-6'(#&!'%&8!*#('.&-g,'$&'!('2-.#)$-*-!.)$!2-!6'$'(-2#Q-.#5$!*'2!I%)!*'!2)%!,'*#)%!'2'.&(5$#.)%W!#$O)(,8&#.)%!J!&'2',8g&#.)%W!UI'!%I4)$'!I$)%!1'$'O#.#)%!':#*'$&'%!4-(-!2)%!.#I*-*-$)%h!4'()!&-,1#;$!*-!2I6-(!-!.#'(&)%!(#'%6)%!UI'!*'1'$!,#$#,#Q-(%'!.)$!,'*#*-%!*'!%'6I(#*-*!UI'!6'$'('$!.)$O#-$Q-!'$!'2!I%)!*'!&-2'%!,'*#)%D!
L$!'2!4'(#)*)!&(-$%.I((#*)!*'%*'! 2-!4I12#.-.#5$!*'! 2-!4(#,'(-!:'(%#5$!*'!"-6'(#&! ?@PPKC!V-%&-! 2-!O'.V-W!'2!-$82#%#%!*'!(#'%6)%!%'!V-!:'$#*)!.)$%)2#*-$*)!.),)!4-%)!$'.'%-(#)!4-(-!2-!6'%$!*'!2-!%'6I(#*-*D!+%R!%'!('.)6'!.2-(-,'$&'!'$!2-%!^IR-%!*'!2-!E3\L>!UI'W!'$!%I!4(#$.#4#)!G!*#.'$[!
6) Evaluación del riesgo. Los participantes deben llevar a cabo evaluaciones de riesgo.
L%&-!,'&)*)2)6R-!#$&'('%-!-!&)*)%!-UI'22)%!UI'!&(-1-F-$!.)$!#$O)(,-.#5$!,'.-$#Q-*-!J!2)%!%#%&'g,-%!#$O)(,8&#.)%!UI'!2-!&(-&-$D!]#!*#.V-!#$O)(,-.#5$!)!2)%!%'(:#.#)%!UI'!%'!4('%&-$!6(-.#-%!-!'22-!%)$!:-2#)%)%W!'%&-!,'&)*)2)6R-!2'%!4'(,#&#(8!%-1'(!.I8$&)!*'!'%&'!:-2)(!'%&8!'$!FI'6)!J!2'%!-JI*-g(8!-!4()&'6'(2)D!
3)$).'(!'2!(#'%6)!-2!UI'!'%&8$!%),'&#*)%!2)%!'2','$&)%!*'!&(-1-F)!'%W!%#,42','$&'W!#,4('%.#$*#g12'!4-(-!4)*'(!6'%&#)$-(2)%!J!4)(!'22)!V-$!-4-('.#*)!,I2&#&I*!*'!6IR-%!#$O)(,-2'%W!-4()M#,-.#)$'%!,'&5*#.-%!J!V'((-,#'$&-%!*'!%)4)(&'!&)*-%!2-%!.I-2'%!1I%.-$!)1F'&#:-(!'2!-$82#%#%!4-(-!%-1'(!.I8$!%'6I()%!?)!#$%'6I()%C!'%&8$!J!$)!22-,-(%'!-!'$6-c)D!L2!6(-$!('&)!*'!&)*-%!'%&-%!-4()M#,-.#)$'%!'%!2-!.),42'F#*-*!*'2!4()12',-!-2!UI'!%'!'$O('$&-$h!.),42'F#*-*!'$!'2!%'$&#*)!*'!UI'!V-J!,I.V)%!'2','$&)%!UI'!.)$%#*'(-(!J!UI'W!%#!$)!%'!'%!(#6I()%)W!2-%!.)$.2I%#)$'%!%'(8$!*'!4).)!O#-(D!L%!4)(!'22)!UI'!%'!4'(%#6I'!I$-!-4()M#,-.#5$!,'&5*#.-!UI'!$)!*'F'!2I6-(!-!2-!#,4():#%-.#5$W!$#!*'4'$*-!*'!2-!-(1#&(-(#'*-*!*'2!-$-2#%&-D!
/'%'!-!UI'!%'!V-!4I'%&)!'$!,-$)%!*'!2)%!%#%&',-%!*'!#$O)(,-.#5$!6(-:'%!('%4)$%-1#2#*-*'%!4-(-!.I,42#(!2)%!)1F'&#:)%!*'!2-%!)(6-$#Q-.#)$'%W!$)!*'F-!*'!%'(!I$!&',-!('.I(('$&'!2-!#$UI#'&I*!4)(!%I!%'6I(#*-*D! T)%!-O'.&-*)%W! UI'! O('.I'$&','$&'!$)! %)$! &;.$#.)%W! %'!4('6I$&-$! %#! '%&)%! %#%&',-%!,'('.'$!%I!.)$O#-$Q-W!.)$O#-$Q-!UI'!%'!:'!,'(,-*-!4)(!.-*-!O-22)!JW!%)1('!&)*)W!.I-$*)!2-! #$g:'(%#5$!'$!*'O'$%-!*'! 2)%!,'*#)%!*'!&(-1-F)!$)!%'!&(-*I.'!'$! 2-!-I%'$.#-!*'!O-22)%D!T)! #*'-2!'%!UI'!2)%!%#%&',-%!$)!O-22'$D!/'()!2)!.#'(&)!UI'!%'!-.'4&-!.)$:#:#(!.)$!%#%&',-%!UI'!O-22-$D!L2!-%I$&)!$)!'%!&-$&)!2-!-I%'$.#-!*'!#$.#*'$&'%!.),)!2-!.)$O#-$Q-!'$!UI'!'%&8$!1-F)!.)$&()2[!%'!%-1'!UI;!4I'*'!4-%-(!J!%'!%-1'!UI;!V-.'(!.I-$*)!4-%-D!L2!&',)(!-!2)!*'%.)$).#*)!'%!'2!4(#$.#4-2!)(#6'$!*'!2-!*'%.)$O#-$Q-!JW!'$!.)$%'.I'$.#-W!-UIR!%'!1I%.-!.)$).'(!4-(-!.)$O#-([!.)$).'(!2)%!(#'%6)%!4-(-!4)*'(!-O()$&-(2)%!J!.)$&()2-(2)%D!
1.1. Objetivos de Magerit "-6'(#&!4'(%#6I'!2)%!%#6I#'$&'%!)1F'&#:)%[!
\#('.&)%[!
@D! .)$.#'$.#-(!-!2)%!('%4)$%-12'%!*'!2)%!%#%&',-%!*'!#$O)(,-.#5$!*'!2-!'M#%&'$.#-!*'!(#'%6)%!J!*'!2-!$'.'%#*-*!*'!-&-F-(2)%!-!&#',4)!
<D! )O('.'(!I$!,;&)*)!%#%&',8&#.)!4-(-!-$-2#Q-(!&-2'%!(#'%6)%!
>D! -JI*-(!-!*'%.I1(#(!J!42-$#O#.-(!2-%!,'*#*-%!)4)(&I$-%!4-(-!,-$&'$'(!2)%!(#'%6)%!1-F)!.)$&()2!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
@! 3]+L[!3)$%'F)!]I4'(#)(!*'!+*,#$#%&(-.#5$!L2'.&(5$#.-D!<! "+^LZH`[!"'&)*)2)6R-!*'!+$82#%#%!J!^'%$!*'!Z#'%6)%!*'!2)%!]#%&',-%!*'!H$O)(,-.#5$!>! ^IR-%!*'!2-!E3\L!4-(-!2-!%'6I(#*-*!*'!2)%!%#%&',-%!*'!#$O)(,-.#5$!J!('*'%D!i-.#-!I$-!.I2&I(-!*'!%'6Ig(#*-*D!<SS<D!
"-6'(#&!:'(%#5$!<! ! H$&()*I..#5$!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!K!?*'!@ABC!
H$*#('.&)%[!
BD! 4('4-(-(!-! 2-!E(6-$#Q-.#5$!4-(-!4().'%)%!*'!':-2I-.#5$W!-I*#&)(R-W!.'(&#O#.-.#5$!)!-.('*#&-g.#5$W!%'60$!.)(('%4)$*-!'$!.-*-!.-%)!
`-,1#;$!%'!V-!1I%.-*)!2-!I$#O)(,#*-*!*'!2)%!#$O)(,'%!UI'!('.)6'$!2)%!V-22-Q6)%!J!2-%!.)$.2I%#)g$'%!*'!I$!4()J'.&)!*'!-$82#%#%!J!6'%$!*'!(#'%6)%[!
Modelo de valor
3-(-.&'(#Q-.#5$!*'2!:-2)(!UI'!('4('%'$&-$!2)%!-.&#:)%!4-(-!2-!E(6-$#Q-.#5$!-%R!.),)!*'!2-%!*'4'$*'$.#-%!'$&('!2)%!*#O'('$&'%!-.&#:)%D!
Mapa de riesgos
Z'2-.#5$!*'!2-%!-,'$-Q-%!-!UI'!'%&8$!'M4I'%&)%!2)%!-.&#:)%D!
Evaluación de salvaguardas
L:-2I-.#5$!*'!2-!'O#.-.#-!*'!2-%!%-2:-6I-(*-%!'M#%&'$&'%!'$!('2-.#5$!-2!(#'%6)!UI'!-O()$&-$D!
Estado de riesgo
3-(-.&'(#Q-.#5$!*'! 2)%!-.&#:)%!4)(!%I! (#'%6)! ('%#*I-2h!'%!*'.#(W!4)(! 2)!UI'!4I'*'!4-%-(! &)g,-$*)!'$!.)$%#*'(-.#5$!2-%!%-2:-6I-(*-%!*'%42'6-*-%D!
Informe de insuficiencias
+I%'$.#-! )! *'1#2#*-*! *'! 2-%! %-2:-6I-(*-%! UI'! -4-('.'$! .),)!)4)(&I$-%! 4-(-! ('*I.#(! 2)%!(#'%6)%!%)1('!'2!%#%&',-D!
Plan de seguridad
3)$FI$&)!*'!4()6(-,-%!*'!%'6I(#*-*!UI'!4'(,#&'$!,-&'(#-2#Q-(!2-%!*'.#%#)$'%!*'!6'%$!*'!(#'%6)%!
1.2. Introducción al análisis y gestión de riesgos ]'6I(#*-*!'%!2-!.-4-.#*-*!*'!2-%!('*'%!)!*'!2)%!%#%&',-%!*'!#$O)(,-.#5$!4-(-!('%#%&#(W!.)$!I$!*'g&'(,#$-*)!$#:'2!*'!.)$O#-$Q-W! 2)%!-..#*'$&'%!)!-..#)$'%! #2R.#&-%!)!,-2#$&'$.#)$-*-%!UI'!.),4()g,'&-$! 2-! *#%4)$#1#2#*-*W! -I&'$&#.#*-*W! #$&'6(#*-*! J! .)$O#*'$.#-2#*-*! *'! 2)%! *-&)%! -2,-.'$-*)%! )!&(-$%,#&#*)%!J!*'!2)%!%'(:#.#)%!UI'!*#.V-%!('*'%!J!%#%&',-%!)O('.'$!)!V-.'$!-..'%#12'%D!
L2!)1F'&#:)!-!4()&'6'(!'%!2-!,#%#5$!*'!2-!E(6-$#Q-.#5$W!&'$#'$*)!'$!.I'$&-!2-%!*#O'('$&'%!*#,'$%#)g$'%!*'!2-!%'6I(#*-*[!
Disponibilidad:
)!*#%4)%#.#5$!*'!2)%!%'(:#.#)%!-!%'(!I%-*)%!.I-$*)!%'-!$'.'%-(#)D!T-!.-('$.#-!*'!*#%4)$#1#g2#*-*!%I4)$'!I$-!#$&'((I4.#5$!*'2!%'(:#.#)D!T-!*#%4)$#1#2#*-*!-O'.&-!*#('.&-,'$&'!-!2-!4()*I.g&#:#*-*!*'!2-%!)(6-$#Q-.#)$'%D!
Integridad:
)!,-$&'$#,#'$&)!*'!2-%!.-(-.&'(R%&#.-%!*'!.),42'&#&I*!J!.)(('..#5$!*'!2)%!*-&)%D!3)$&(-!2-!#$g&'6(#*-*W! 2-! #$O)(,-.#5$! 4I'*'! -4-('.'(!,-$#4I2-*-W! .)((I4&-! )! #$.),42'&-D! T-! #$&'6(#*-*!-O'.&-!*#('.&-,'$&'!-2!.)(('.&)!*'%',4'c)!*'!2-%!OI$.#)$'%!*'!I$-!E(6-$#Q-.#5$D!
Confidencialidad:
)!UI'!2-!#$O)(,-.#5$!22'6I'!%)2-,'$&'!-!2-%!4'(%)$-%!-I&)(#Q-*-%D!3)$&(-!2-!.)$O#*'$.#-2#*-*!)!%'.('&)!4I'*'$!*-(%'!OI6-%!J!O#2&(-.#)$'%!*'!#$O)(,-.#5$W!-%R!.),)!-..'%)%!$)!-I&)(#Q-g*)%D! T-! .)$O#*'$.#-2#*-*!'%! I$-!4()4#'*-*!*'!*#OR.#2! ('.I4'(-.#5$W! 4I*#'$*)!,#$-(! 2-! .)$gO#-$Q-!*'!2)%!*',8%!'$!2-!)(6-$#Q-.#5$!UI'!$)!'%!*#2#6'$&'!'$!'2!,-$&'$#,#'$&)!*'2!%'.('&)W!J!4I*#'$*)!%I4)$'(!'2! #$.I,42#,#'$&)!*'! 2'J'%!J!.),4(),#%)%!.)$&(-.&I-2'%! ('2-&#:)%!-! 2-!.I%&)*#-!*'!2)%!*-&)%D!
Autenticidad (de quién hace uso de los datos o servicios):
)!UI'!$)!V-J-!*I*-!*'!UI#;$!%'!V-.'!('%4)$%-12'!*'!I$-!#$O)(,-.#5$!)!4('%&-.#5$!*'!I$!%'(:#.#)W! &-$&)!-! O#$!*'!.)$O#-(!'$!;2!.),)!*'!4)*'(!4'(%'6I#(!4)%&'(#)(,'$&'! 2)%! #$.I,42#g,#'$&)%!)!'(()('%D!3)$&(-!2-!-I&'$&#.#*-*!%'!*-$!%I42-$&-.#)$'%!J!'$6-c)%!UI'!1I%.-$!('-g
"-6'(#&!:'(%#5$!<! ! H$&()*I..#5$!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!N!?*'!@ABC!
2#Q-(!I$!O(-I*'D!T-!-I&'$&#.#*-*!'%! 2-!1-%'!4-(-!4)*'(! 2I.V-(!.)$&(-!'2!('4I*#)!JW!.),)!&-2W!OI$*-,'$&-!'2!.),'(.#)!'2'.&(5$#.)!)! 2-!-*,#$#%&(-.#5$!'2'.&(5$#.-W!4'(,#&#'$*)!.)$O#-(!%#$!4-4'2'%!$#!4('%'$.#-!OR%#.-D!
`)*-%!'%&-%!.-(-.&'(R%&#.-%!4I'*'$!%'(! ('UI'(#*-%!)!$)!*'4'$*#'$*)!*'!.-*-!.-%)D!3I-$*)!%'!('UI#'('$W!$)!'%!':#*'$&'!UI'!%'!*#%O(I&'$!%#$!,8%D!T)!V-1#&I-2!UI'!V-J-!UI'!4)$'(!,'*#)%!J!'%gOI'(Q)!4-(-!.)$%'6I#(2-%D!+!(-.#)$-2#Q-(!'%&'!'%OI'(Q)!%'!*'*#.-$!2-%!,'&)*)2)6R-%!*'!-$82#%#%!J!6'%$!*'!(#'%6)%!UI'!.),#'$Q-$!.)$!I$-!*'O#$#.#5$[!
Riesgo:
'%&#,-.#5$!*'2!6(-*)!*'!'M4)%#.#5$!-!UI'!I$-!-,'$-Q-!%'!,-&'(#-2#.'!%)1('!I$)!)!,8%!-.g&#:)%!.-I%-$*)!*-c)%!)!4'(FI#.#)%!-!2-!E(6-$#Q-.#5$D!
L2!(#'%6)!#$*#.-!2)!UI'!2'!4)*(R-!4-%-(!-!2)%!-.&#:)%!%#!$)!%'!4()&'6#'(-$!-*'.I-*-,'$&'D!L%!#,g4)(&-$&'!%-1'(!UI;!.-(-.&'(R%&#.-%!%)$!*'!#$&'(;%!'$!.-*-!-.&#:)W!-%R!.),)!%-1'(!'$!UI;!,'*#*-!'%&-%!.-(-.&'(R%&#.-%!'%&8$!'$!4'2#6()W!'%!*'.#(W!-$-2#Q-(!'2!%#%&',-[!
Análisis de riesgos:
4().'%)!%#%&',8&#.)!4-(-!'%&#,-(!2-!,-6$#&I*!*'!2)%!(#'%6)%!-!UI'!'%&8!'M4I'%&-!I$-!E(6-g$#Q-.#5$D!
]-1#'$*)!2)!UI'!4)*(R-!4-%-(W!V-J!UI'!&),-(!*'.#%#)$'%[!
Gestión de riesgos:
%'2'..#5$!'!#,42-$&-.#5$!*'!%-2:-6I-(*-%!4-(-!.)$).'(W!4(':'$#(W!#,4'*#(W!('*I.#(!)!.)$&()g2-(!2)%!(#'%6)%!#*'$&#O#.-*)%D!
75&'%'!UI'!I$-!)4.#5$! 2'6R&#,-!'%!-.'4&-(!'2!(#'%6)D!L%!O('.I'$&'!)R(!UI'!2-!%'6I(#*-*!-1%)2I&-!$)!'M#%&'h!'$!'O'.&)W!%#',4('!V-J!UI'!-.'4&-(!I$!(#'%6)!UI'W!'%)!%RW!*'1'!%'(!.)$).#*)!J!%),'&#*)!-2!I,1(-2!*'!.-2#*-*!UI'!%'!('UI#'('!*'2!%'(:#.#)D!
3),)!&)*)!'%&)!'%!,IJ!*'2#.-*)W!$)!'%!,'(-,'$&'!&;.$#.)W!'! #$.2IJ'! 2-!*'.#%#5$!*'!-.'4&-(!I$!.#'(&)! $#:'2! *'! (#'%6)W! *':#'$'! #,4('%.#$*#12'! %-1'(! '$! UI;! .)$*#.#)$'%! %'! &(-1-F-! J! -%R! 4)*'(!-FI%&-(! 2-!.)$O#-$Q-!UI'!,'('.'!'2!%#%&',-D!/-(-!'22)!UI;!,'F)(!UI'!I$-!-4()M#,-.#5$!,'&5*#.-!UI'!4'(,#&-!&),-(!*'.#%#)$'%!.)$!OI$*-,'$&)!J!'M42#.-(!(-.#)$-2,'$&'!2-%!*'.#%#)$'%!&),-*-%D!
1.3. El análisis y gestión de riesgos en su contexto T-%!&-('-%!*'!-$82#%#%!J!6'%$!*'!(#'%6)%!$)!%)$!I$!O#$!'$!%R!,#%,-%!%#$)!UI'!%'!'$.-F-$!'$!2-!-.&#:#*-*!.)$&#$I-!*'!6'%$!*'!2-!%'6I(#*-*D!
L2!-$82#%#%!*'!(#'%6)%!4'(,#&'!*'&'(,#$-(!.5,)!'%W!.I8$&)!:-2'!J!.5,)!*'!4()&'6#*)%!%'!'$.I'$g&(-$!2)%!-.&#:)%D!L$!.))(*#$-.#5$!.)$!2)%!)1F'&#:)%W!'%&(-&'6#-!J!4)2R&#.-!*'!2-!E(6-$#Q-.#5$W!2-%!-.g&#:#*-*'%!*'!6'%$!*'!(#'%6)%!4'(,#&'$!'2-1)(-(!I$!42-$!*'!%'6I(#*-*!UI'W!#,42-$&-*)!J!)4'(-g*)W! %-&#%O-6-! 2)%! )1F'&#:)%! 4()4I'%&)%!.)$!'2!$#:'2!*'!(#'%6)!UI'!%'!-.'4&-!2-!\#('..#5$D!
T-! #,42-$&-.#5$! *'! 2)%! .)$&()2'%! *'!%'6I(#*-*! ('UI#'('! I$-! )(6-$#Q-.#5$!6'%&#)$-*-! J! 2-! 4-(&#.#4-.#5$! #$O)(,-g*-!*'!&)*)!'2!4'(%)$-2!UI'!&(-1-F-!.)$!'2! %#%&',-! *'! #$O)(,-.#5$D! L%! '%&'!4'(%)$-2! '2! ('%4)$%-12'! *'! 2-! )4'(-g.#5$! *#-(#-W! *'! 2-! ('-..#5$! -$&'! #$.#g*'$.#-%! J!*'! 2-!,)$#&)(#Q-.#5$!'$!6'g$'(-2! *'2! %#%&',-! 4-(-! *'&'(,#$-(! %#!%-&#%O-.'! .)$! 'O#.-.#-! J! 'O#.#'$.#-! 2)%!)1F'&#:)%!4()4I'%&)%D!
L%&'!'%UI',-!*'!&(-1-F)!*'1'!%'(!('g4'&#&#:)!4I'%! 2)%!%#%&',-%!*'! #$O)(,-g.#5$! (-(-! :'Q! %)$! #$,I&-12'%h! ,8%!
análisis y gestiónde riesgos
análisis y gestiónde riesgos objetivos, estrategia
y política
objetivos, estrategiay política
planificaciónplanificaciónorganizaciónorganización
implantación desalvaguardas
implantación desalvaguardas concienciación
y formación
concienciacióny formación
gestión de config.y cambios
gestión de config.y cambios incidencias y
recuperación
incidencias yrecuperación
"-6'(#&!:'(%#5$!<! ! H$&()*I..#5$!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!P!?*'!@ABC!
1#'$!%'!'$.I'$&(-$!%),'&#*)%!-!':)2I.#5$!.)$&#$I-!&-$&)!4()4#-!?$I':)%!-.&#:)%C!.),)!*'2!'$&)(g$)!?$I':-%!-,'$-Q-%CW!2)!UI'!'M#6'!I$-!(':#%#5$!4'(#5*#.-!'$!2-!UI'!%'!-4('$*'!*'!2-!'M4'(#'$.#-!J!%'!-*-4&-!-2!$I':)!.)$&'M&)D!
L2!-$82#%#%!*'!(#'%6)%!4()4)(.#)$-!I$!,)*'2)!*'2!%#%&',-!'$!&;(,#$)%!*'!-.&#:)%W!-,'$-Q-%!J!%-2g:-6I-(*-%W!J!'%!2-!4#'*(-!-$6I2-(!4-(-!.)$&()2-(!&)*-%!2-%!-.&#:#*-*'%!.)$!OI$*-,'$&)D!T-!6'%$!*'!(#'%6)%!'%!2-!'%&(I.&I(-.#5$!*'!2-%!-..#)$'%!*'!%'6I(#*-*!4-(-!%-&#%O-.'(!2-%!$'.'%#*-*'%!*'g&'.&-*-%!4)(!'2!-$82#%#%D!
1.3.1. Concienciación y formación
L2!,'F)(!42-$!*'!%'6I(#*-*!%'!:'(R-!%'(#-,'$&'!V#4)&'.-*)!%#$!I$-!.)2-1)(-.#5$!-.&#:-!*'!2-%!4'(g%)$-%!#$:)2I.(-*-%!'$!'2!%#%&',-!*'!#$O)(,-.#5$W!'%4'.#-2,'$&'!%#!2-!-.&#&I*!'%!$'6-&#:-W!.)$&(-(#-!)!*'!j2I.V-(!.)$&(-!2-%!,'*#*-%!*'!%'6I(#*-*kD!L%!4)(!'22)!UI'!%'!('UI#'('!2-!.('-.#5$!*'!I$-!j.I2g&I(-!*'!%'6I(#*-*k!UI'W!',-$-$*)!*'!2-!-2&-!*#('..#5$W!.)$.#'$.#'!-!&)*)%!2)%!#$:)2I.(-*)%!*'!%I!$'.'%#*-*!J!4'(&#$'$.#-D!
])$!*)%!2)%!4#2-('%!OI$*-,'$&-2'%!4-(-!2-!.('-.#5$!*'!'%&-!.I2&I(-[!
!" I$-!4)2R&#.-!*'!%'6I(#*-*!.)(4)(-&#:-!UI'!%'!'$&#'$*-!?'%.(#&-!4-(-!2)%!UI'!$)!%)$!'M4'(&)%!'$!2-!,-&'(#-CW!UI'!%'!*#OI$*-!J!UI'!%'!,-$&'$6-!-2!*R-!
!" I$-!O)(,-.#5$!.)$&#$I-!-!&)*)%!2)%!$#:'2'%W!('.)(*-$*)!2-%!.-I&'2-%!(I&#$-(#-%!J!2-%!-.&#:#*-g*'%!'%4'.#-2#Q-*-%W!%'60$!2-!('%4)$%-1#2#*-*!-*%.(#&-!-!.-*-!4I'%&)!*'!&(-1-F)!
+!O#$!*'!UI'!'%&-%!-.&#:#*-*'%!.I-F'$!'$!2-!)(6-$#Q-.#5$W!'%!#,4('%.#$*#12'!UI'!2-!%'6I(#*-*!%'-!
!" ,R$#,-,'$&'! #$&(I%#:-[!UI'!$)!*#O#.I2&'! #$$'.'%-(#-,'$&'! 2-!-.&#:#*-*!*#-(#-!$#!V#4)&'UI'!-2.-$Q-(!2)%!)1F'&#:)%!*'!4()*I.&#:#*-*!4()4I'%&)%W!
!" %'-!j$-&I(-2k[!UI'!$)!*'!4#'!-!'(()('%!6(-&I#&)%W!UI'!O-.#2#&'!'2!.I,42#,#'$&)!*'!2-%!1I'$-%!4(8.&#.-%!4()4I'%&-%!J!
!" 4(-.&#.-*-!4)(!2-!\#('..#5$[!UI'!*;!'F',42)!'$!2-!-.&#:#*-*!*#-(#-!J!('-..#)$'!.)$!4('%&'Q-!-!2)%!.-,1#)%!'!#$.#*'$.#-%D!
1.3.2. Incidencias y recuperación
]#,;&(#.-,'$&'W!2-%!4'(%)$-%!#$:)2I.(-*-%!*'1'$!%'(!.)$%.#'$&'%!*'!%I!4-4'2!J!('2':-$.#-!.)$&#g$I-!4-(-!4(':'$#(!4()12',-%!J!('-..#)$-(!.I-$*)!%'!4()*IQ.-$D!L%!#,4)(&-$&'!.('-(!I$-!.I2&I(-!*'!('%4)$%-1#2#*-*!*)$*'!2)%!4)&'$.#-2'%!4()12',-%W!*'&'.&-*)%!4)(!2)%!UI'!'%&8$!.'(.-$)%!-!2)%!-.&#:)%!-O'.&-*)%W!4I'*-$!%'(!.-$-2#Q-*)%!V-.#-!2)%!4I$&)%!*'!*'.#%#5$D!\'!'%&-!O)(,-!'2!%#%&',-!*'!%-2:-6I-(*-%!('%4)$*'(8!-!2-!('-2#*-*D!
3I-$*)!%'!4()*I.'!I$-!#$.#*'$.#-W!'2!&#',4)!',4#'Q-!-!.)(('(!'$!.)$&(-!*'2!%#%&',-[!%I!%I4'(:#g:'$.#-!*'4'$*'!*'! 2-!4('%&'Q-!J!.)(('..#5$!*'! 2-%!-.&#:#*-*'%!*'! ('4)(&'!J! ('-..#5$D!3I-2UI#'(!'(()(W!#,4('.#%#5$!)!-,1#6l'*-*!'$!'%&)%!,),'$&)%!.(R&#.)%W!%'!:'!-,42#O#.-*)!.)$:#(&#'$*)!2)!UI'!4)*R-!%'(!I$!,'()!#$.#*'$&'!'$!I$!*'%-%&('D!
`-$&)!*'!2)%!;M#&)%!.),)!*'!2)%!O(-.-%)%!.)$:#'$'!-4('$*'(!.)$&#$I-,'$&'!'!#$.)(4)(-(2)%!-2!4()g.'%)!*'!-$82#%#%!J!6'%$!*'!(#'%6)%D!T-!,-*I('Q!*'!I$-!)(6-$#Q-.#5$!%'!('O2'F-!'$!2-!4I2.(#&I*!J!('-2#%,)!*'!%I!,)*'2)!*'!:-2)(!JW!.)$%'.I'$&','$&'W!'$!2-!#*)$'#*-*!*'!2-%!%-2:-6I-(*-%!*'!&)g*)!)W!*'%*'!,'*#*-%!&;.$#.-%!V-%&-!I$-!54&#,-!)(6-$#Q-.#5$D!
1.4. Organización de las guías L%&-!:'(%#5$!<!*'!"-6'(#&! %'!V-!'%&(I.&I(-*)!'$! &('%! 2#1()%[!;%&'W!UI'!*'%.(#1'! jL2!";&)*)kW!I$!m3-&82)6)!*'!L2','$&)%m!J!I$-!m^IR-!*'!`;.$#.-%mD!
L%&-!6IR-!*'%.(#1'!2-!,'&)*)2)6R-!*'%*'!&('%!8$6I2)%[!
!" L2!.-4R&I2)!<!*'%.(#1'!2)%!4-%)%!4-(-!('-2#Q-(!I$!-$82#%#%!*'2!'%&-*)!*'!(#'%6)!J!4-(-!6'%&#)g$-(!%I!,#-.#5$D!L%!I$-!4('%'$&-.#5$!$'&-,'$&'!.)$.'4&I-2D!
"-6'(#&!:'(%#5$!<! ! H$&()*I..#5$!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!@S!?*'!@ABC!
!" L2!.-4R&I2)!>!*'%.(#1'! 2-%!&-('-%!18%#.-%!4-(-!('-2#Q-(!I$!4()J'.&)!*'!-$82#%#%!J!6'%$!*'!(#'%6)%W!'$&'$*#'$*)!UI'!$)!1-%&-!.)$!&'$'(!2)%!.)$.'4&)%!.2-()%W!%#$)!UI'!'%!.)$:'$#'$&'!4-I&-(!()2'%W!-.&#:#*-*'%W!V#&)%!J!*).I,'$&-.#5$!4-(-!UI'!2-!('-2#Q-.#5$!*'2!4()J'.&)!*'!-$8g2#%#%!J!6'%$!*'!(#'%6)%!'%&;!1-F)!.)$&()2!'$!&)*)!,),'$&)D!
!" L2!.-4R&I2)!B!-42#.-!2-!,'&)*)2)6R-!-2!.-%)!*'2!*'%-(()22)!*'!%#%&',-%!*'!#$O)(,-.#5$W!'$!'2!'$&'$*#,#'$&)!UI'!2)%!4()J'.&)%!*'!*'%-(()22)!*'!%#%&',-%!*'1'$!&'$'(!'$!.I'$&-!2)%!(#'%g6)%!*'%*'!'2!4(#,'(!,),'$&)W! &-$&)! 2)%! (#'%6)%!-!UI'!'%&8$!'M4I'%&)%W!.),)! 2)%! (#'%6)%!UI'!2-%!4()4#-%!-42#.-.#)$'%!#$&()*I.'$!'$!'2!%#%&',-D!
3),)!.),42','$&)W!'2!.-4R&I2)!A!*'%6(-$-!I$-!%'(#'!*'!-%4'.&)%!4(8.&#.)%W!*'(#:-*)%!*'!2-!'M4'g(#'$.#-!-.I,I2-*-!'$!'2!&#',4)!4-(-!2-!('-2#Q-.#5$!*'!I$!-$82#%#%!J!I$-!6'%$!('-2,'$&'!'O'.&#g:)%D!
T)%!-4;$*#.'%!('.)6'$!,-&'(#-2!*'!.)$%I2&-[!!
@D! I$!62)%-(#)W!!
<D! ('O'('$.#-%!1#12#)6(8O#.-%!.)$%#*'(-*-%!4-(-!'2!*'%-(()22)!*'!'%&-!,'&)*)2)6R-W!
>D! ('O'('$.#-%!-2!,-(.)!2'6-2!UI'!'$.I-*(-!2-%!&-('-%!*'!-$82#%#%!J!6'%$W!
BD! '2!,-(.)!$)(,-&#:)!*'!':-2I-.#5$!J!.'(&#O#.-.#5$!
AD! 2-%!.-(-.&'(R%&#.-%!UI'!%'!('UI#'('$!*'!2-%!V'((-,#'$&-%W!4('%'$&'%!)!OI&I(-%W!4-(-!%)4)(&-(!'2!4().'%)!*'!-$82#%#%!J!6'%$!*'!(#'%6)%W!
GD! I$-!6IR-!.),4-(-&#:-!*'!.5,)!"-6'(#&!:'(%#5$!@!V-!':)2I.#)$-*)!'$!'%&-!:'(%#5$!<D!
/)(!I2&#,)W!%'!*'%-(()22-!I$!.-%)!4(8.&#.)!.),)!'F',42)D!
1.4.1. Modo de empleo
T)%!2'.&)('%!$I':)%!'$!2-!,-&'(#-W!*'1'$!',4'Q-(!4)(!'2!.-4R&I2)!<D!
]#!J-!V-J!I$!.)$).#,#'$&)!*'!2)%!.)$.'4&)%W!'2!'F',42)!-JI*-!-!.'$&(-(!#*'-%!J!&'(,#$)2)6R-D!
]#!%'!:-!-!2-$Q-(!I$!4()J'.&)!*'!-$82#%#%!J!6'%$!*'!(#'%6)%W!'2!.-4R&I2)!>!-JI*-!-!'%&(I.&I(-(2)!J!42-$#O#.-(2)D!]#!'2!%#%&',-!*'!#$O)(,-.#5$!'%!%#,42'!J!('*I.#*)!)!1#'$!%#!%52)!%'!('UI#'('!I$-!4(#,'g(-!-4()M#,-.#5$W!4I'*'!1-%&-(!I$!42-$&'-,#'$&)!#$O)(,-2h!4'()!.I-$*)!'2!4()J'.&)!&),-!'$:'(6-g*I(-!.)$:#'$'!%'(!,'&5*#.)D!
]#!%'!'%&8!('-2#Q-$*)!I$!4()J'.&)!*'!-$82#%#%!J!6'%$!*'!(#'%6)%W!'2!.-4R&I2)!A!-JI*-!-!.'$&(-(!2-!-.&#:#*-*!%#$!*#%&(-..#)$'%D!
]#!%'!:-!-!.)2-1)(-(!'$!I$!4()J'.&)!*'!*'%-(()22)!*'!I$!$I':)!%#%&',-!*'! #$O)(,-.#5$W!)!'$!I$!.#.2)!*'!,-$&'$#,#'$&)W!.)$:#'$'!('.I((#(!-2!.-4R&I2)!BD!
]#!%'!:-!-!&(-1-F-(!.)$!%#%&',-%!V),)2)6-*)%W!1#'$!4)(UI'!#$&'('%-!.),)!,'.-$#%,)!4-(-!'%4'g.#O#.-(!2)!UI'!%'!$'.'%#&-W!1#'$!4)(UI'!#$&'('%-!.),)!,'.-$#%,)!4-(-!'%4'.#O#.-(!2)!UI'!%'!&#'$'W!.)$:#'$'!('.I((#(!-2!-4;$*#.'!BD!
L$!'2!42-$&'-,#'$&)!*'!'%&-%!6IR-%!%'!V-!%'6I#*)!I$!.(#&'(#)!j*'!,8M#,)%kW!('O2'F-$*)!&)*)!)!*'!-.&#:)%W!&)*)!)!*'!-%4'.&)%!*'!%'6I(#*-*W!&)*)!)!*'!%#&I-.#)$'%W!'$!*'O#$#&#:-D!L$!2-!4(8.&#.-W!'2!I%I-(#)!4I'*'!'$.)$&(-(%'!-$&'!%#&I-.#)$'%!*)$*'!'2!-$82#%#%!'%!,8%!('%&(#$6#*)D!]#6I'$!-26Ig$)%!.-%)%!4(8.&#.)%!O('.I'$&'%[!
!" %52)!%'!('UI#'('!I$!'%&I*#)!*'!2)%!O#.V'()%!-O'.&)%!-!2-!2'6#%2-.#5$!*'!*-&)%!*'!.-(8.&'(!4'(g%)$-2!
!" %52)!%'!('UI#'('!I$!'%&I*#)!*'!2-%!6-(-$&R-%!*'!.)$O#*'$.#-2#*-*!*'!2-!#$O)(,-.#5$!
!" %52)!%'!('UI#'('!I$!'%&I*#)!*'!2-!*#%4)$#1#2#*-*!*'!2)%!%'(:#.#)%!?&R4#.-,'$&'!4)(UI'!%'!1I%g.-!'2!*'%-(()22)!*'!I$!42-$!*'!.)$&#$6'$.#-C!
!" '&.D!
"-6'(#&!:'(%#5$!<! ! H$&()*I..#5$!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!@@!?*'!@ABC!
L%&-%!%#&I-.#)$'%W!O('.I'$&'%W!%'!('.)6'$!O)(,-2,'$&'!'$!2-%!&-('-%!*'!2-!-.&#:#*-*!+@D<!'!#$O)(g,-2,'$&'!.),'$&-$*)!UI'!'%!.)$%&(I.&#:)!.'$&(-(%'!'$!I$!*),#$#)!('*I.#*)!'!#(!-,42#-$*)!'$!2-!,'*#*-!*'!2-%!$'.'%#*-*'%W!-$&'%!UI'!-O()$&-(!2-!&)&-2#*-*D!!
1.4.2. El catálogo de elementos
L$!2#1()!-4-(&'W!%'!4()4)$'!I$!.-&82)6)W!-1#'(&)!-!-,42#-.#)$'%W!UI'!,-(.-!I$-%!4-I&-%!'$!.I-$&)!-[!
!" )%!*'!-.&#:)%!
!" *#,'$%#)$'%!*'!:-2)(-.#5$!*'!2)%!-.&#:)%!
!" .(#&'(#)%!*'!:-2)(-.#5$!*'!2)%!-.&#:)%!
!" -,'$-Q-%!&R4#.-%!%)1('!2)%!%#%&',-%!*'!#$O)(,-.#5$!
!" %-2:-6I-(*-%!-!.)$%#*'(-(!4-(-!4()&'6'(!%#%&',-%!*'!#$O)(,-.#5$!
]'!4'(%#6I'$!*)%!)1F'&#:)%[!
@D! /)(!I$-!4-(&'W!O-.#2#&-(!2-!2-1)(!*'!2-%!4'(%)$-%!UI'!-.),'&'$!'2!4()J'.&)W!'$!'2!%'$&#*)!*'!)O('.'(2'%!'2','$&)%!'%&8$*-(!-!2)%!UI'!4I'*-$!-*%.(#1#(%'!(84#*-,'$&'W!.'$&(8$*)%'!'$!2)!'%4'.RO#.)!*'2!%#%&',-!)1F'&)!*'2!-$82#%#%D!
<D! /)(!)&(-W!V),)6'$'#Q-(!2)%!('%I2&-*)%!*'!2)%!-$82#%#%W!4(),):#'$*)!I$-!&'(,#$)2)6R-!J!I$)%!.(#&'(#)%!I$#O)(,'%!UI'!4'(,#&-$!.),4-(-(!'!#$.2I%)!#$&'6(-(!-$82#%#%!('-2#Q-*)%!4)(!*#O'('$g&'%!'UI#4)%D!
3-*-!%'..#5$!#$.2IJ'!I$-!$)&-.#5$!n"T!UI'!%'!',42'-(8!4-(-!4I12#.-(!('6I2-(,'$&'!2)%!'2','$g&)%!'$!I$!O)(,-&)!'%&8$*-(!.-4-Q!*'!%'(!4().'%-*)!-I&),8&#.-,'$&'!4)(!V'((-,#'$&-%!*'!-$82#%#%!J!6'%$D!
]#!'2! 2'.&)(!I%-!I$-!V'((-,#'$&-!*'!-$82#%#%!J!6'%$!*'!(#'%6)%W!'%&'!.-&82)6)!%'(8!4-(&'!*'! 2-!,#%,-h!%#!'2!-$82#%#%!%'!('-2#Q-!,-$I-2,'$&'W!'%&'!.-&82)6)!4()4)(.#)$-!I$-!-,42#-!1-%'!*'!4-(&#g*-!4-(-!-:-$Q-(!(84#*-,'$&'!%#$!*#%&(-..#)$'%!$#!)2:#*)%D!
1.4.3. La guía de técnicas
L$!2#1()!-4-(&'W!-4)(&-!2IQ!-*#.#)$-2!J!6IR-%!%)1('!-26I$-%!&;.$#.-%!UI'!%'!',42'-$!V-1#&I-2,'$&'!4-(-!22':-(!-!.-1)!4()J'.&)%!*'!-$82#%#%!J!6'%$!*'!(#'%6)%[!
!" &;.$#.-%!'%4'.RO#.-%!4-(-!'2!-$82#%#%!*'!(#'%6)%!
!" -$82#%#%!,'*#-$&'!&-12-%!
!" -$82#%#%!-26)(R&,#.)!
!" 8(1)2'%!*'!-&-UI'!
!" &;.$#.-%!6'$'(-2'%!
!" -$82#%#%!.)%&'g1'$'O#.#)!
!" *#-6(-,-%!*'!O2IF)!*'!*-&)%!
!" *#-6(-,-%!*'!4().'%)%!
!" &;.$#.-%!6(8O#.-%!
!" 42-$#O#.-.#5$!*'!4()J'.&)%!
!" %'%#)$'%!*'!&(-1-F)[!'$&(':#%&-%W!('I$#)$'%!J!4('%'$&-.#)$'%!
!" :-2)(-.#5$!\'24V#!
]'! &(-&-!*'!I$-!6IR-!*'!.)$%I2&-D!]'60$!'2! 2'.&)(!-:-$.'!4)(! 2-! &-('-%!*'2!4()J'.&)W!%'! 2'!('.)g,'$*-(8!'2!I%)!*'!.#'(&-%!&;.$#.-%!'%4'.RO#.-%W!*'!2-%!UI'!'%&-!6IR-!1I%.-!%'(!I$-!#$&()*I..#5$W!-%R!.),)!4()4)(.#)$-(!('O'('$.#-%!4-(-!UI'!'2!2'.&)(!4()OI$*#.'!'$!2-%!&;.$#.-%!4('%'$&-*-%D!
"-6'(#&!:'(%#5$!<! ! H$&()*I..#5$!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!@<!?*'!@ABC!
1.5. Para los que han trabajado con Magerit v1.0 ]#!I%&'*!V-!&(-1-F-*)!.)$!"-6'(#&!:@DSW!&)*)%!2)%!.)$.'4&)%!2'!('%I2&-(8$!O-,#2#-('%W!-I$UI'!V-J!.#'(&-!':)2I.#5$D!L$!4-(&#.I2-(! ('.)$).'(8! 2)!UI'!%'!*'$),#$-1-!%I1,)*'2)!*'!'2','$&)%[!-.&#g:)%W!-,'$-Q-%W!:I2$'(-1#2#*-*'%W!#,4-.&)%W!(#'%6)%!J!%-2:-6I-(*-%D!L%&-!4-(&'!.)$.'4&I-2!V-!%#*)!('O('$*-*-!4)(!'2!4-%)!*'2!&#',4)!J!%#6I'!%#'$*)!'2!'F'!-2('*'*)(!*'2!.I-2!%'!:'(&'1(-$!2-%!!O-%'%!OI$*-,'$&-2'%!*'!-$82#%#%!J!6'%$D!]'!V-!.)(('6#*)!J!-,42#-*)!2)!UI'!%'!*'$),#$-1-!j%I1'%&-g*)%!*'!%'6I(#*-*k!*8$*)2'!'2!$I':)!$),1('!*'!j*#,'$%#)$'%kB!'! #$&()*I.#'$*)!$I':-%!:-(-%!*'!,'*#(! 2)!UI'!#$&'('%-!*'!2)%!-.&#:)%D!L2!%I1,)*'2)!*'!4().'%)%!-4-('.'!1-F)!'2!'4R6(-O'!*'!j'%g&(I.&I(-.#5$!*'2!4()J'.&)!*'!-$82#%#%!J!6'%$!*'!(#'%6)%kD!
]#!1#'$!"-6'(#&!:@DS!V-!('%#%&#*)!1#'$!'2!4-%)!*'2! &#',4)!'$! 2)!.)$.'4&I-2W!$)!%'!4I'*'!*'.#(! 2)!,#%,)!*'!2)%!*'&-22'%!&;.$#.)%!*'!2)%!%#%&',-%!*'!#$O)(,-.#5$!.)$!2)%!UI'!%'!&(-1-F-D!]'!#$&'$&-!I$-!4I'%&-!-2!*R-h!4'()!-$&'! &)*)!%'! #$&'$&-!*#O'('$.#-(! 2)!UI'!'%!'%'$.#-2! ?J!4'(,-$'$&'C!*'! 2)!UI'!'%!.)JI$&I(-2!J!.-,1#-(8!.)$!'2!&#',4)D!L%&)!%'!&(-*I.'!'$!4-(-,'&(#Q-(!'2!,;&)*)!*'!&(-1-F)W!('O'('$.#8$*)2)! -! .-&82)6)%! 'M&'($)%! *'! -,'$-Q-%! J! %-2:-6I-(*-%! UI'! %'! 4)*(8$! -.&I-2#Q-(W!-*-4&8$*)%'!-2!4-%)!*'2!&#',4)W!&-$&)!4)(!4()6('%)!&'.$)256#.)!.),)!4)(!4()6('%)!*'!2)%!%IF'&)%W!4I'%!&-$!.#'(&)!'%!UI'!2)%!%#%&',-%!.-,1#-$!.),)!UI'!2)!V-.'$!2)%!%IF'&)%!-!%I!-2('*'*)(W!1I'g$)%!J!,-2)%D!oW!.I-$&)!,8%!;M#&)!&'$6-$!2)%!%#%&',-%W!,8%!I%I-(#)%!&'$*(8$!J!%#,I2&8$'-,'$&'W!,8%!%IF'&)%!V-1(8!#$&'('%-*)%!'$!-1I%-(!*'!'22)%!)W!%#,42','$&'W!*'%&(I#(2)%D!+%R!4I'%W!UI'*'!'2!,;&)*)W!-1#'(&)!*'!O)(,-!UI'!'%&-$*)!.2-()!UI;!%'!V-.'!J!.5,)W!%'!4I'*-$!-*-4&-(!2)%!*'&-22'%!-!.-*-!,),'$&)D!
+! 'O'.&)%! 4(8.&#.)%W! '2! 48((-O)! -$&'(#)(! %'! &(-*I.'! '$! UI'! %'! V-! %'6('6-*)! '$! I$! 2#1()! -$'F)W!j3-&82)6)! *'! L2','$&)%kW! 2)%! )%! *'! -.&#:)%W! 2-%! *#,'$%#)$'%! J! .(#&'(#)%! *'! :-2)(-.#5$W! '2!.-&82)6)!*'!-,'$-Q-%!J!'2!.-&82)6)!*'!%-2:-6I-(*-%W!*'!&-2!O)(,-!UI'!4I'*-$!':)2I.#)$-(D!
L2!-4;$*#.'!G!'%!,8%!4('.#%)!'%&-12'.#'$*)!2-%!.)(('%4)$*'$.#-%!'$&('!2-!:'(%#5$!@DS!J!'%&-D!
1.6. Evaluación, certificación, auditoría y acreditación L2!-$82#%#%!*'!(#'%6)%!'%!I$-!4#'*(-!-$6I2-(!*'!2)%!4().'%)%!*'!':-2I-.#5$W!.'(&#O#.-.#5$W!-I*#&)(R-!J!-.('*#&-.#5$!UI'!O)(,-2#Q-$! 2-!.)$O#-$Q-!UI'!,'('.'!I$!%#%&',-!*'! #$O)(,-.#5$D!\-*)!UI'!$)!V-J!*)%!%#%&',-%!*'!#$O)(,-.#5$!#6I-2'%W!2-!':-2I-.#5$!*'!.-*-!%#%&',-!.)$.('&)!('UI#'('!-,)2g*-(%'!-!2)%!.),4)$'$&'%!UI'!2)!.)$%&#&IJ'$D!L$!-$82#%#%!*'!(#'%6)%!4()4)(.#)$-!I$-!:#%#5$!%#$6Ig2-(!*'!.5,)!'%!.-*-!%#%&',-W!UI;!:-2)(!4)%''W!-!UI;!-,'$-Q-%!'%&8!'M4I'%&)!J!*'!UI;!%-2:-g6I-(*-%!%'!V-!*)&-*)D!L%!4I'%!'2!-$82#%#%!*'!(#'%6)%!4-%)!)12#6-*)!4-(-!4)*'(!22':-(!-!.-1)!&)*-%!2-%!&-('-%!,'$.#)$-*-%W!UI'!%'!('2-.#)$-$!%'60$!'2!%#6I#'$&'!'%UI',-[!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
B! \#,'$%#5$W!'$!I$-!*'!2-%!-.'4.#)$'%!*'2!\#..#)$-(#)!*'!2-!T'$6I-!L%4-c)2-W!*R.'%'!UI'!'%!j3-*-!I$-!*'!2-%!,-6$#&I*'%!*'!I$!.)$FI$&)!UI'!%#(:'$!4-(-!*'O#$#(!I$!O'$5,'$)D!/)(!'F',42)W!'2!'%4-.#)!*'!.I-&()!*#,'$%#)$'%!*'!2-!&')(R-!*'!2-!('2-&#:#*-*Dk!
"-6'(#&!:'(%#5$!<! ! H$&()*I..#5$!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!@>!?*'!@ABC!
L$!'%&-!%'..#5$!%'!V-.'!I$-!4('%'$&-.#5$!.)$.'4&I-2!*'!2-%!-.&#:#*-*'%!.#&-*-%D!L2!2'.&)(!'$.)$g&(-(8!'$!'2!-4;$*#.'!B!I$!&(-&-,#'$&)!'%4'.RO#.)!*'!2)%!,-(.)%!$)(,-&#:)%!('2-&#:)%!-!%#%&',-%!*'!6'%$!J!4()*I.&)%!*'!%'6I(#*-*D!
Evaluación
L%!.-*-!:'Q!,8%! O('.I'$&'! 2-!':-2I-.#5$!*'! 2-!%'6I(#*-*!*'! 2)%!%#%&',-%!*'! #$O)(,-.#5$W! &-$&)!#$&'($-,'$&'!.),)!4-(&'!*'! 2)%!4().'%)%!*'!6'%$W!.),)!4)(!,'*#)!*'!':-2I-*)('%! #$*'4'$g*#'$&'%!'M&'($)%D!T-%!':-2I-.#)$'%!4'(,#&'$!,'*#(!'2!6(-*)!*'!.)$O#-$Q-!UI'!,'('.'!)!#$%4#(-!I$!%#%&',-!*'!#$O)(,-.#5$D!!
Certificación
T-!':-2I-.#5$!4I'*'!22':-(!-!I$-!.'(&#O#.-.#5$!)!('6#%&()!*'!2-!%'6I(#*-*!*'2!%#%&',-D!L$!2-!4(8.&#.-!%'!.'(&#O#.-$!4()*I.&)%!J!%'!.'(&#O#.-$!%#%&',-%!*'!6'%$!*'!2-!%'6I(#*-*D!T-!.'(&#O#.-.#5$!*'!4()g*I.&)%!'%W!*'!-26I$-!O)(,-W!#,4'(%)$-2[!j'%&)!&#'$'!'%&-%!.-(-.&'(R%&#.-%!&;.$#.-%kD!]#$!',1-(6)W!2-!.'(&#O#.-.#5$!*'!%#%&',-%!*'!6'%$!&#'$'!UI'!:'(!.)$!'2!j.),4)$'$&'!VI,-$)k!*'!2-%!)(6-$#Q-g.#)$'%!1I%.-$*)!'2!-$82#%#%!*'!.5,)!%'!'M42)&-$!2)%!%#%&',-%AD!!
3'(&#O#.-(! '%! -%'6I(-(! ('%4)$%-12','$&'! J! 4)(! '%.(#&)! I$! .),4)(&-,#'$&)D! T)! UI'! %'! .'(&#O#.-W!4()*I.&)!)!%#%&',-W!%'!%),'&'!-!I$-!%'(#'!*'!':-2I-.#)$'%!)(#'$&-*-%!4)(!I$!)1F'&#:)!X4-(-!UI;!2)!UI#'('YGD!9$!.'(&#O#.-*)!*#.'!UI'!I$!%#%&',-!'%!.-4-Q!*'!4()&'6'(!I$)%!*-&)%!*'!I$-%!-,'$-gQ-%!.)$!I$-!.#'(&-!.-2#*-*! ?.-4-.#*-*!*'!4()&'..#5$CD!o! 2)!*#.'!'$!1-%'!-!UI'!V-!)1%'(:-*)! 2-!'M#%&'$.#-!J!'2!OI$.#)$-,#'$&)!*'!I$-!%'(#'!*'!%-2:-6I-(*-%D!L%!*'.#(!UI'!*'&(8%!*'!I$!.'(&#O#.-*)!$)!V-J!%#$)!2)%!.)$.'4&)%!*'!I$!-$82#%#%!*'!(#'%6)%D!
+$&'%!*'!4().'*'(!-!2-!.'(&#O#.-.#5$W!*'1'!V-1'(%'!('-2#Q-*)!I$!-$82#%#%!*'!(#'%6)%!-!O#$!*'!.)$)g.'(!2)%!(#'%6)%!J!*'!.)$&()2-(2)%!,'*#-$&'!2-!-*)4.#5$!*'!2)%!.)$&()2'%!-*'.I-*)%W!-*',8%W!%'(8!I$!4I$&)!*'!.)$&()2!*'!2-!6'%$!*'2!4()*I.&)!)!%#%&',-D!
Acreditación
+26I$-%!.'(&#O#.-.#)$'%!&#'$'$!.),)!)1F'&#:)! 2-!-.('*#&-.#5$!*'2!4()*I.&)!)!%#%&',-D!T-!-.('*#&-g.#5$!'%!I$!4().'%)!'%4'.RO#.)!.IJ)!)1F'&#:)!'%!2'6#&#,-(!-2!%#%&',-!4-(-!O)(,-(!4-(&'!*'!%#%&',-%!,8%!-,42#)%D!]'!4I'*'!:'(!.),)!I$-!.'(&#O#.-.#5$!4-(-!I$!4()45%#&)!'%4'.RO#.)D!
Auditorías
+I$UI'!$)!%'-!2)!,#%,)W!$)!'%&8$!,IJ!2'F)%!*'!'%&'!,I$*)!2-%!-I*#&)(R-%W!#$&'($-%!)!'M&'($-%W!-!2-%!UI'!%'!%),'&'$!2)%!%#%&',-%!*'!#$O)(,-.#5$!
!" I$-%!:'.'%!('UI'(#*-%!4)(!2'J!4-(-!4)*'(!)4'(-(!'$!I$!.#'(&)!%'.&)(W!!
!" )&(-%!:'.'%!('UI'(#*-%!4)(!2-!4()4#-!\#('..#5$!*'!2-!E(6-$#Q-.#5$W!!
!" )&(-%!:'.'%!('UI'(#*-%!4)(!'$&#*-*'%!.)2-1)(-*)(-%!UI'!:'$!%I!4()4#)!$#:'2!*'!(#'%6)!2#6-g*)!-2!$I'%&()D!!
9$-!-I*#&)(R-!4I'*'!%'(:#(%'!*'!I$!-$82#%#%!*'!(#'%6)%!UI'!2'!4'(,#&-!?@C!%-1'(!UI;!V-J!'$!FI'6)W!?<C!%-1'(!-!UI;!'%&8!'M4I'%&)!'2!%#%&',-!J!?>C!:-2)(-(!2-!'O#.-.#-!J!'O#.#'$.#-!*'!2-%!%-2:-6I-(*-%D!
e('.I'$&','$&'W! 2)%!-I*#&)('%!4-(&'$!*'!I$!-$82#%#%!*'!(#'%6)%W! #,42R.#&)!)!'M42R.#&)W!UI'W!)!1#'$!!('-2#Q-$!'22)%!,#%,)%W!)!1#'$!2)!-I*#&-$D!]#',4('!'$!2-!4(#,'(-!O-%'!*'!2-!-I*#&)(R-W!4I'%!'%!*#OR.#2!)4#$-(!*'!2)!UI'!$)!%'!.)$).'D!+!4-(&#(!*'2!-$82#%#%!*'!(#'%6)%!%'!4I'*'!-$-2#Q-(!'2!%#%&',-!'!#$gO)(,-(!-!2-!6'('$.#-!*'!%#!'2!%#%&',-!'%&8!1-F)!.)$&()2h!'%!*'.#(W!%#!2-%!,'*#*-%!*'!%'6I(#*-*!-*)4g
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
A! i-J!:'VR.I2)%!.)$!-2&-%!.-2#O#.-.#)$'%! &;.$#.-%!J!)&()%!,8%!VI,#2*'%D!T)!,#%,)!UI'!V-J!.)$*I.&)('%!UI'!%)$!:'(*-*'()%!4()O'%#)$-2'%!J!)&()%!*'!2)%!UI'!$I$.-!$)%!'M42#.-(',)%!.5,)!'%!UI'!'%&8$!.'(&#O#g.-*)%!.),)!j-4&)%!4-(-!'2!,-$'F)!*'!:'VR.I2)%kD!!T)!#*'-2!'%!4)$'(!I$!6(-$!.).V'!'$!,-$)%!*'!I$!6(-$!.)$*I.&)(D!\'!-VR! 4-(-! -1-F)W! &'$',)%!I$-!6(-$! :-(#'*-*!*'! %#&I-.#)$'%!*'!,'$)(! .)$O#-$Q-[!,-J)(!(#'%6)!*'!UI'!-26)!:-J-!,-2D!
G! o!-%R!&'$',)%!%#%&',-%!-4&)%!4-(-!j.)$%I,)!VI,-$)k!)!jI#Q-.#5$!'$!.)$*#.#)$'%!&;(,#.-%!'M&(',-%kD!
"-6'(#&!:'(%#5$!<! ! H$&()*I..#5$!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!@B!?*'!@ABC!
&-*-%!'%&8$!FI%&#O#.-*-%W!#,42-$&-*-%!J!,)$#&)(#Q-*-%W!*'!O)(,-!UI'!%'!4I'*'!.)$O#-(!'$!'2!%#%&'g,-!*'!#$*#.-*)('%!*'!UI'!*#%4)$'!2-!6'('$.#-!4-(-!6'%&#)$-(!2-!%'6I(#*-*!*'!2)%!%#%&',-%D!
T-!.)$.2I%#5$!*'!2-!-I*#&)(R-!'%!I$!#$O)(,'!*'!#$%IO#.#'$.#-%!*'&'.&-*-%W!UI'!$)!%)$!%#$)!#$.)V'g('$.#-%!'$&('!2-%!$'.'%#*-*'%!#*'$&#O#.-*-%!'$!'2!-$82#%#%!*'!(#'%6)%!J!2-!('-2#*-*!*'&'.&-*-!*I(-$g&'!2-!#$%4'..#5$!*'2!%#%&',-!'$!)4'(-.#5$D!!
L2!#$O)(,'!*'!-I*#&)(R-!*'1'(8!*#.&-,#$-(!%)1('!2-!-*'.I-.#5$!*'!2-%!,'*#*-%!J!.)$&()2'%!-2!4('%'$&'! Z'62-,'$&)W! #*'$&#O#.-(! %I%! *'O#.#'$.#-%! J! 4()4)$'(! 2-%! ,'*#*-%! .)(('.&)(-%! )!.),42','$&-(#-%!$'.'%-(#-%D!\'1'(8W!#6I-2,'$&'W!#$.2I#(!2)%!*-&)%W!V'.V)%!J!)1%'(:-.#)$'%!'$!UI'!%'!1-%'$!2)%!*#.&8,'$'%!-2.-$Q-*)%!J!('.),'$*-.#)$'%!4()4I'%&-%D!pZ\!PPBd@PPPW!-(&R.I2)!@KD<q!
L$!'2!.-%)!*'!2-!+*,#$#%&(-.#5$!4012#.-W!'M#%&'$!-26I$)%!('O'('$&'%!OI$*-,'$&-2'%!('%4'.&)!*'!2)%!.I-2'%!%'!4I'*'!J!%'!*'1'!('-2#Q-(!-I*#&)(R-%[!
!" Z'-2!\'.('&)!PPBd@PPPW!*'!@@!*'!FI$#)W!4)(!'2!UI'!%'!-4(I'1-!'2!Z'62-,'$&)!*'!,'*#*-%!*'!%'6I(#*-*!*'!2)%!O#.V'()%!-I&),-&#Q-*)%!UI'!.)$&'$6-$!*-&)%!*'!.-(8.&'(!4'(%)$-2D!
!" j3(#&'(#)%!*'!%'6I(#*-*W!$)(,-2#Q-.#5$!J!.)$%'(:-.#5$!*'!2-%!-42#.-.#)$'%!I#Q-*-%!4-(-!'2!'F'(.#.#)!*'!4)&'%&-*'%kW!"+/W!<SSB!
T-%!-I*#&)(R-%!*'1'$!('4'&#(%'!('6I2-(,'$&'!&-$&)!4-(-!%'6I#(!2-!':)2I.#5$!*'2!-$82#%#%!*'!(#'%6)%!?UI'!%'!*'1'!-.&I-2#Q-(! ('6I2-(,'$&'C!.),)!4-(-!%'6I#(!'2!*'%-(()22)!*'2!42-$!*'!%'6I(#*-*!*'g&'(,#$-*)!4)(!2-%!-.&#:#*-*'%!*'!6'%$!*'!(#'%6)%D!
1.7. ¿Cuándo procede analizar y gestionar los riesgos? Z'-2#Q-(!I$!-$82#%#%!*'!(#'%6)%!'%!2-1)(#)%)!J!.)%&)%)D!T':-$&-(!I$!,-4-!*'!-.&#:)%!J!:-2)(-(2)%!('UI#'('! 2-!.)2-1)(-.#5$!*'!,I.V)%!4'(O#2'%!*'$&()!*'! 2-!E(6-$#Q-.#5$W!*'%*'!2)%!$#:'2'%!*'!6'g('$.#-!V-%&-!2)%!&;.$#.)%D!o!$)!%)2)!'%!UI'!V-J-!UI'!#$:)2I.(-(!-!,I.V-%!4'(%)$-%W!%#$)!UI'!V-J!UI'! 2)6(-(!I$-!I$#O)(,#*-*!*'!.(#&'(#)!'$&('! &)*)%!4I'%W!%#! #,4)(&-$&'!'%!.I-$&#O#.-(! 2)%! (#'%6)%W!,8%!#,4)(&-$&'!-0$!'%!('2-&#:#Q-(2)%D!o!'%&)!'%!-%R!4)(UI'!&R4#.-,'$&'!'$!I$!-$82#%#%!*'!(#'%6)%!-4-('.'$!,I2&#&I*!*'!*-&)%D!T-!0$#.-!O)(,-!*'!-O()$&-(!2-!.),42'F#*-*!'%!.'$&(-(%'!'$!2)!,8%!#,g4)(&-$&'!?,8M#,)!#,4-.&)W!,8M#,)!(#'%6)C!J!)1:#-(! 2)!UI'!'%!%'.I$*-(#)!)!#$.2I%)!*'%4('.#-12'D!/'()!%#!2)%!*-&)%!$)!'%&8$!1#'$!)(*'$-*)%!'$!&;(,#$)%!('2-&#:)%W!%I!#$&'(4('&-.#5$!'%!#,4)%#12'D!
L$!('%I,'$W!UI'!I$!-$82#%#%!*'!(#'%6)%!$)!'%!I$-!&-('-!,'$)(!UI'!('-2#Q-!.I-2UI#'(-!'$!%I%!(-&)%!2#1('%D!L%!I$-!&-('-!,-J)(!UI'!('UI#'('!'%OI'(Q)!J!.))(*#$-.#5$D!/)(!&-$&)!*'1'!%'(!42-$#O#.-*-!J!FI%&#O#.-*-D!
9$!-$82#%#%!*'!(#'%6)%!'%!('.),'$*-12'!'$!.I-2UI#'(!E(6-$#Q-.#5$!UI'!*'4'$*-!*'!2)%!%#%&',-%!*'! #$O)(,-.#5$!J! .),I$#.-.#)$'%!4-(-!'2! .I,42#,#'$&)!*'!%I!,#%#5$D!L$!4-(&#.I2-(!'$!.I-2UI#'(!'$&)($)!*)$*'!%'!4(-.&#UI'!2-!&(-,#&-.#5$!'2'.&(5$#.-!*'!1#'$'%!J!%'(:#.#)%W!%'-!'$!.)$&'M&)!4012#g.)!)!4(#:-*)D!L2!-$82#%#%!*'!(#'%6)%!4'(,#&'!&),-(!*'.#%#)$'%!*'!#$:'(%#5$!'$!&'.$)2)6R-W!*'%*'!2-!-*UI#%#.#5$!*'!'UI#4)%!*'!4()*I..#5$!V-%&-!'2!*'%42#'6I'!*'!I$!.'$&()!-2&'($-&#:)!4-(-!-%'6I(-(!2-!.)$&#$I#*-*!*'!2-!-.&#:#*-*W!4-%-$*)!4)(!2-%!*'.#%#)$'%!*'!-*UI#%#.#5$!*'!%-2:-6I-(*-%!&;.$#.-%!J!*'!%'2'..#5$!J!.-4-.#&-.#5$!*'2!4'(%)$-2D!
L2!-$82#%#%!*'!(#'%6)%!'%!I$-!V'((-,#'$&-!*'!6'%$!UI'!4'(,#&'!&),-(!*'.#%#)$'%D!T-%!*'.#%#)$'%!4I'*'$!&),-(%'!-$&'%!*'!*'%42'6-(!I$!%'(:#.#)!)!.)$!;%&'!OI$.#)$-$*)D!L%!,IJ!*'%'-12'!V-.'(2)!-$&'%W!*'!O)(,-!UI'!2-%!,'*#*-%!UI'!V-J-!UI'!&),-(!%'!#$.)(4)('$!'$!'2!*#%'c)!*'2!%'(:#.#)W!'$!2-!'2'..#5$!*'!.),4)$'$&'%W!'$!'2!*'%-(()22)!*'!2-%!-42#.-.#)$'%!J!'$!2)%!,-$I-2'%!*'!I%I-(#)D!`)*)!2)!UI'!%'-!.)(('6#(! (#'%6)%! #,4(':#%&)%!'%!.)%&)%)!'$! &#',4)!4()4#)!J!-F'$)W! 2)!UI'!4I'*'! #(!'$!*'&(#,'$&)!*'!2-!#,-6'$!4('%&-*-!4)(!2-!E(6-$#Q-.#5$!J!4I'*'!%I4)$'(W!'$!02&#,)!'M&(',)W!2-!4;(g*#*-!*'!.)$O#-$Q-!'$!%I!.-4-.#*-*D!]#',4('!%'!V-!*#.V)!UI'!'%!,'F)(!4(':'$#(!UI'!.I(-(!J!-UIR!%'!-42#.-[!$)!'%4'('!-!UI'!I$!%'(:#.#)!V-6-!-6I-h!V-J!UI'!4(':'(!J!'%&-(!4(':'$#*)D!
Por precepto legal
L2!-$82#%#%!*'!(#'%6)%!4I'*'!:'$#(! ('UI'(#*)!4)(!4('.'4&)! 2'6-2D!`-2!'%!'2!.-%)!*'2!Z'-2!\'.('&)!<G>d@PPGW!*'!@G!*'!e'1('()W!4)(!'2!UI'!%'!('6I2-!2-!I#Q-.#5$!*'!&;.$#.-%!'2'.&(5$#.-%W!#$O)(,8&#g.-%!J!&'2',8&#.-%!4)(!2-!+*,#$#%&(-.#5$!^'$'(-2!*'2!L%&-*)D!L$!%I!-(&R.I2)!B!?^-(-$&R-%!6'$'(-2'%!
"-6'(#&!:'(%#5$!<! ! H$&()*I..#5$!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!@A!?*'!@ABC!
*'!2-!I#Q-.#5$!*'!%)4)(&'%W!,'*#)%!J!-42#.-.#)$'%!'2'.&(5$#.-%W!#$O)(,8&#.-%!J!&'2',8&#.-%C!*#.'!-%R[!
<D!3I-$*)!%'!I#.'$!2)%!%)4)(&'%W!,'*#)%!J!-42#.-.#)$'%!('O'(#*)%!'$!'2!-4-(&-*)!-$&'(#)(W!%'!-*)4&-(8$!2-%!,'*#*-%!&;.$#.-%!J!*'!)(6-$#Q-.#5$!$'.'%-(#-%!UI'!-%'6I('$!2-!-I&'$&#.#*-*W!.)$O#*'$.#-2#*-*W! #$&'6(#*-*W! *#%4)$#1#2#*-*! J! .)$%'(:-.#5$!*'! 2-! #$O)(,-.#5$D!\#.V-%!,'*#g*-%!*'!%'6I(#*-*!*'1'(8$!&'$'(!'$!.I'$&-!'2!'%&-*)!*'!2-!&'.$)2)6R-!J!%'(!4()4)(.#)$-*-%!-!2-!$-&I(-2'Q-!*'!2)%!*-&)%!J!*'!2)%!&(-&-,#'$&)%!J!-!los riesgos a los que estén expuestosKD!
\'!O)(,-!%#,#2-(W!'$!2-!T'J!E(68$#.-!@Ad@PPPW!*'!@>!*'!*#.#',1('W!*'!4()&'..#5$!*'!*-&)%!*'!.-g(8.&'(!4'(%)$-2W!'$!%I!-(&R.I2)!P!?]'6I(#*-*!*'!2)%!*-&)%C!*#.'!-%R[!
@D!L2!('%4)$%-12'!*'2!O#.V'()W!JW!'$!%I!.-%)W!'2!'$.-(6-*)!*'2!&(-&-,#'$&)W!*'1'(8$!-*)4&-(!2-%!,'*#*-%!*'!R$*)2'!&;.$#.-!J!)(6-$#Q-&#:-%!$'.'%-(#-%!UI'!6-(-$&#.'$!2-!%'6I(#*-*!*'!2)%!*-g&)%!*'!.-(8.&'(!4'(%)$-2!J!':#&'$!%I!-2&'(-.#5$W!4;(*#*-W!&(-&-,#'$&)!)!-..'%)!$)!-I&)(#Q-*)W!V-1#*-! .I'$&-! *'2! '%&-*)! *'! 2-! &'.$)2)6R-W! 2-! $-&I(-2'Q-! *'! 2)%! *-&)%! -2,-.'$-*)%! J! los riesgos a que están expuestos,!J-!4():'$6-$!*'!2-!-..#5$!VI,-$-!)!*'2!,'*#)!OR%#.)!)!$-&Ig(-2D!
`'M&)!UI'!%'!('.)6'!*'!$I':)!'$!'2!4('8,1I2)!-2!ZL+T!\L3ZL`E!PPBd@PPPW!*'!@@!*'!FI$#)W!4)(!'2! UI'! %'! -4(I'1-! '2!Z'62-,'$&)! *'!,'*#*-%! *'! %'6I(#*-*! *'! 2)%! O#.V'()%! -I&),-&#Q-*)%! UI'!.)$&'$6-$!*-&)%!*'!.-(8.&'(!4'(%)$-2D!L$!'%&'!*'.('&)!%'!('.)6'!2-!)12#6-.#5$!*'!'2-1)(-(!I$!*)g.I,'$&)!*'!%'6I(#*-*!
@D!L2!('%4)$%-12'!*'2!O#.V'()!'2-1)(-(8!'!#,42-$&-(8!2-!$)(,-&#:-!*'!%'6I(#*-*!,'*#-$&'!I$!*)g.I,'$&)!*'!)12#6-*)!.I,42#,#'$&)!4-(-!'2!4'(%)$-2!.)$!-..'%)!-!2)%!*-&)%!-I&),-&#Q-*)%!*'!.-(8.&'(!4'(%)$-2!J!-!2)%!%#%&',-%!*'!#$O)(,-.#5$D!!
\#OR.#2,'$&'!%'!4I'*'!*'%-(()22-(!*#.V)!*).I,'$&)!%#$!I$!-$82#%#%!4(':#)!*'!2)%!(#'%6)%!%)1('!2)%!*-&)%W!-$82#%#%!UI'!$)%!22':'!-!*'&'(,#$-(!2-%!,'*#*-%!*'!%'6I(#*-*!4'(&#$'$&'%D!
Certificación y acreditación
]#!'2!%#%&',-!-%4#(-!-!I$-!.'(&#O#.-.#5$W!'2!-$82#%#%!*'!(#'%6)%!'%!I$!('UI#%#&)!4(':#)!UI'!'M#6#(8!'2!':-2I-*)(D!L%!2-!OI'$&'!*'!#$O)(,-.#5$!4-(-!*'&'(,#$-(!2-!('2-.#5$!*'!.)$&()2'%!4'(&#$'$&'%!4-(-!'2!%#%&',-!J!UI'!4)(!&-$&)!*'1'$!%'(! #$%4'..#)$-*)%D!_;-%'!'2!-4;$*#.'!BD@!%)1('!.'(&#O#.-.#5$!*'!%#%&',-%!*'!6'%$!*'!2-!%'6I(#*-*!*'!2-!#$O)(,-.#5$!?]^]HCD!
L2!-$82#%#%!*'!(#'%6)%!'%!-%R!,#%,)!I$!('UI#%#&)!'M#6#*)!'$!2)%!4().'%)%!*'!-.('*#&-.#5$N!*'!%#%&'g,-%D!L%&)%!4().'%)%!%)$!$'.'%-(#)%!.I-$*)!%'!:-!-!,-$'F-(!'$!'2!%#%&',-!#$O)(,-.#5$!.2-%#O#.-*-!$-.#)$-2W!9LW!E`+7!)!*'!)&()%!-.I'(*)%!#$&'($-.#)$-2'%D!L2!4(#,'(!4-%)!*'2!4().'%)!'%!2-!('-2#Q-g.#5$!*'2!-$82#%#%!*'!(#'%6)%!UI'!#*'$&#O#UI'!-,'$-Q-%!J!%-2:-6I-(*-%!J!6'%&#)$'!%-&#%O-.&)(#-,'$g&'!2)%!(#'%6)%!*'2!%#%&',-D!!
/)(!02&#,)W!.-1'!,'$.#)$-(!'2!',42')!*'!4'(O#2'%!*'!4()&'..#5$!.),)!,'.-$#%,)!*'!.)$&(-&-.#5$D!T)%!4'(O#2'%!*'!4()&'..#5$!?H]EdHL3g@ABSNC!$-.'$!.)$!2-!*)12'!,#%#5$!*'!4)*'(!'%4'.#O#.-(!-!4(#)(#!!2)%!('UI#%#&)%!*'!%'6I(#*-*!*'!I$!%#%&',-!?4-(-!%I!-*UI#%#.#5$!)!*'%-(()22)C!J!4)*'(!%'(:#(!*'!('O'g('$.#-!#$&'($-.#)$-2!*'2!%#6$#O#.-*)!*'!I$-!.'(&#O#.-.#5$D!L$!I$)!I!)&()!.-%)W!'%&-12'.'!2-!j:-(-!*'!,'*#(k!('%4'.&)!*'!2-!UI'!%'!.-2#O#.-(8!2-!#*)$'#*-*!*'!2-!%'6I(#*-*!*'2!%#%&',-D!_;-%'!'2!-4;$*#.'!BD<!%)1('!.(#&'(#)%!.),I$'%!*'!':-2I-.#5$!?33CD!
En conclusión
/().'*'!-$-2#Q-(!J!6'%&#)$-(!2)%!(#'%6)%!.I-$*)!*#('.&-!)!#$*#('.&-,'$&'!2)!'%&-12'Q.-!I$!4('.'4g&)!2'6-2!J!%#',4('!UI'!2)!('UI#'(-!2-!4()&'..#5$!('%4)$%-12'!*'!2)%!-.&#:)%!*'!I$-!)(6-$#Q-.#5$D!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
K! L2!-$82#%#%!*'!(#'%6)%!4'(,#&'!*'&'(,#$-(!2)%!(#'%6)%!-!2)%!UI'!'%&8$!'M4I'%&)%!J!2-!6'%$!*'!(#'%6)%!4'(,#&'!-*'.I-(!2-%!,'*#*-%!-!*#.V)%!(#'%6)%D!
N! L$!'2!%'$&#*)!O)(,-2!*'!!-I&)(#Q-.#5$!4-(-!,-$'F-(!#$O)(,-.#5$!.2-%#O#.-*-D!T)%!4().'%)%!*'!-.('*#&-.#5$!%'!-FI%&-$!-!2-!$)(,-&#:-!-42#.-12'!'$!.-*-!.-%)D!
"-6'(#&!:'(%#5$!<! ! Z'-2#Q-.#5$!*'2!-$82#%#%!J!6'%$!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!@G!?*'!@ABC!
2. Realización del análisis y de la gestión L%&'!.-4R&I2)!'M4)$'!*'!O)(,-!.)$.'4&I-2!'$!UI;!.)$%#%&'!'%&)!*'2!-$82#%#%!*'!(#'%6)%!J!-UI'22)!*'!%I!6'%$W!UI;!%'!1I%.-!'$!.-*-!,),'$&)!J!UI;!.)$.2I%#)$'%!%'!*'(#:-$D!!
i-J!*)%!6(-$*'%!&-('-%!-!('-2#Q-([!
I. análisis de riesgos,
UI'!4'(,#&'!*'&'(,#$-(!UI;!&#'$'!2-!E(6-$#Q-.#5$!J!'%&#,-(!2)!UI'!4)*(R-!4-%-(D!
L2','$&)%[!
@D! -.&#:)%W!UI'!$)!%)$!%#$)!2)%!'2','$&)%!*'2!%#%&',-!*'!#$O)(,-.#5$!?)!'%&('.V-,'$&'!('2-.#)g$-*)%!.)$!'%&'C!UI'!-4)(&-$!:-2)(!-!2-!E(6-$#Q-.#5$!
<D! -,'$-Q-%W!UI'!$)!%)$!%#$)!.)%-%!UI'!2'%!4I'*'$!4-%-(!-!2)%!-.&#:)%!.-I%-$*)!I$!4'(FI#.#)!-!2-!E(6-$#Q-.#5$!
>D! %-2:-6I-(*-%!?)!.)$&(-!,'*#*-%CW!UI'!$)!%)$!%#$)!'2','$&)%!*'!*'O'$%-!*'%42'6-*)%!4-(-!UI'!-UI'22-%!-,'$-Q-%!$)!.-I%'$!p&-$&)q!*-c)D!
3)$!'%&)%!'2','$&)%!%'!4I'*'!'%&#,-([!
@D! '2!#,4-.&)[!2)!UI'!4)*(R-!4-%-(!
<D! '2!(#'%6)[!2)!UI'!4()1-12','$&'!4-%'!
L2!-$82#%#%!*'!(#'%6)%!4'(,#&'!-$-2#Q-(!'%&)%!'2','$&)%!*'!O)(,-!,'&5*#.-!4-(-!22'6-(!-!.)$.2I%#)g$'%!.)$!OI$*-,'$&)D!
II. gestión de riesgos,
UI'!4'(,#&'!)(6-$#Q-(! 2-!*'O'$%-!.)$.#'$QI*-!J!4(I*'$&'W!*'O'$*#'$*)!4-(-!UI'!$)!4-%'!$-*-!,-2)!J!-2!&#',4)!'%&-$*)!4('4-(-*)%!4-(-!-&-F-(!2-%!','(6'$.#-%W!%)1(':#:#(!-!2)%!#$.#g*'$&'%!J!%'6I#(!)4'(-$*)!'$!2-%!,'F)('%!.)$*#.#)$'%h!.),)!$-*-!'%!4'(O'.&)W!%'!*#.'!UI'!'2!(#'%6)!%'!('*I.'!-!I$!$#:'2!('%#*I-2!UI'!2-!\#('..#5$!-%I,'D!
H$O)(,-2,'$&'W!%'!4I'*'!*'.#(!UI'!2-!6'%$!*'!2-!%'6I(#*-*!*'!I$!%#%&',-!*'!#$O)(,-.#5$!'%!2-!6'%$!*'!%I%!(#'%6)%!J!UI'!'2!-$82#%#%!4'(,#&'!(-.#)$-2#Q-(!*#.V-!6'%$D!
2.1. Análisis de Riesgos L2!-$82#%#%!*'!(#'%6)%!'%!I$-!-4()M#,-.#5$!,'&5*#.-!4-(-!*'&'(,#$-(!'2!(#'%6)!%#6I#'$*)!I$)%!4-g%)%!4-I&-*)%[!
@D! *'&'(,#$-(!2)%!-.&#:)%!('2':-$&'%!4-(-!2-!E(6-$#Q-.#5$W!%I!#$&'(('2-.#5$!J!%I!:-2)(W!'$!'2!%'$g&#*)!*'!UI;!4'(FI#.#)!?.)%&'C!%I4)$*(R-!%I!*'6(-*-.#5$!
<D! *'&'(,#$-(!-!UI;!-,'$-Q-%!'%&8$!'M4I'%&)%!-UI'22)%!-.&#:)%!
>D! *'&'(,#$-(!UI;!%-2:-6I-(*-%!V-J!*#%4I'%&-%!J!.I8$!'O#.-.'%!%)$!O('$&'!-2!(#'%6)!
BD! '%&#,-(!'2!#,4-.&)W!*'O#$#*)!.),)!'2!*-c)!%)1('!'2!-.&#:)!*'(#:-*)!*'!2-!,-&'(#-2#Q-.#5$!*'!2-!-,'$-Q-!
AD! '%&#,-(!'2!(#'%6)W!*'O#$#*)!.),)!'2!#,4-.&)!4)$*'(-*)!.)$!2-!&-%-!*'!).I(('$.#-!?)!'M4'.&-g&#:-!*'!,-&'(#-2#Q-.#5$C!*'!2-!-,'$-Q-!
3)$!'2!)1F'&)!*'!)(6-$#Q-(!2-!4('%'$&-.#5$W!%'!&(-&-$!4(#,'()!2)%!4-%)%!@W!<W!B!J!AW!)1:#-$*)!'2!4-g%)! >W! *'! O)(,-! UI'! 2-%! '%&#,-.#)$'%! *'! #,4-.&)! J! (#'%6)! %'-$! j4)&'$.#-2'%k[! .-%)! *'! UI'! $)!VI1#'(-!%-2:-6I-(*-!-26I$-!*'%42'6-*-D!9$-!:'Q!)1&'$#*)!'%&'!'%.'$-(#)!&'5(#.)W!%'!#$.)(4)(-$!2-%!%-2:-6I-(*-%!*'2!4-%)!>W!*'(#:-$*)!'%&#,-.#)$'%!('-2#%&-%!*'!#,4-.&)!J!(#'%6)D!
"-6'(#&!:'(%#5$!<! ! Z'-2#Q-.#5$!*'2!-$82#%#%!J!6'%$!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!@K!?*'!@ABC!
T-!%#6I#'$&'!O#6I(-!('.)6'!'%&'!4(#,'(!('.)((#*)W!.IJ)%!4-%)%!%'!*'&-22-$!'$!2-%!%#6I#'$&'%!%'..#)g$'%P[!
activosactivos
amenazasamenazas
frecuenciafrecuencia
impactoimpacto
valorvalor
riesgoriesgo
'%&8$!'M4I'%&)%!-
H$&'('%-$!4)(!%I
degradacióndegradación.-I%-$!I$-!.#'(&-
.)$!I$-!.#'(&-
!
2.1.1. Paso 1: Activos
]'!*'$),#$-$!-.&#:)%!2)%!recursos del sistema de información o relacionados con éste, ne-cesarios para que la Organización funcione correctamente y alcance los objetivos propues-tos por su dirección.
L2!-.&#:)!'%'$.#-2!'%!2-!#$O)(,-.#5$!UI'!,-$'F-!'2!%#%&',-h!)!%'-!2)%!*-&)%D!o!-2('*'*)(!*'!'%&)%!*-&)%!%'!4I'*'$!#*'$&#O#.-(!)&()%!-.&#:)%!('2':-$&'%[!
Los servicios!UI'!%'!4I'*'$!4('%&-(!6(-.#-%!-!-UI'22)%!*-&)%W!J!2)%!%'(:#.#)%!UI'!%'!$'.'%#&-$!4-(-!4)*'(!6'%&#)$-(!*#.V)%!*-&)%D!
Las aplicaciones informáticas (software) UI'!4'(,#&'$!,-$'F-(!2)%!*-&)%D!
Los equipos informáticos (hardware) J! UI'! 4'(,#&'$! V)%4'*-(! *-&)%W! -42#.-.#)$'%! J! %'(:#g.#)%D!
Los soportes de información UI'!%)$!*#%4)%#&#:)%!*'!-2,-.'$-,#'$&)!*'!*-&)%D!
El equipamiento auxiliar UI'!.),42','$&-!'2!,-&'(#-2!#$O)(,8&#.)D!
Las redes de comunicaciones!UI'!4'(,#&'$!#$&'(.-,1#-(!*-&)%D!
Las instalaciones UI'!-.)6'$!'UI#4)%!#$O)(,8&#.)%!J!*'!.),I$#.-.#)$'%D!
Las personas UI'!'M42)&-$!I!)4'(-$!&)*)%!2)%!'2','$&)%!-$&'(#)(,'$&'!.#&-*)%D!
Tipos de activos
7)!&)*)%!2)%!-.&#:)%!%)$!*'!2-!,#%,-!'%4'.#'D!\'4'$*#'$*)!*'2!)!*'!-.&#:)W!2-%!-,'$-Q-%!J!2-%!%-2:-6I-(*-%!%)$!*#O'('$&'%@SD!L2!.-4R&I2)!<!*'2!m3-&82)6)!*'!L2','$&)%m!4('%'$&-!I$-!('2-.#5$!*'!)%!*'!-.&#:)%D!
]#!'2! %#%&',-!,-$'F-!*-&)%!*'!.-(8.&'(!4'(%)$-2W!'%&)%!%I'2'$!%'(! #,4)(&-$&'%!4)(!%R!,#%,)%!J!('UI'(#(!I$-!%'(#'!*'!%-2:-6I-(*-%! O('.I'$&','$&'! ('6I2-*-%!4)(! 2'JD!L$!'%&)%!-.&#:)%! #$&'('%-!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
P! T)%!2'.&)('%!O-,#2#-(#Q-*)%!.)$!"-6'(#&!:@DSW!*'&'.&-(8$!2-!-I%'$.#-!*'!2-!:)Q!j:I2$'(-1#2#*-*kD!L2!.)$.'4g&)!*'!:I2$'(-1#2#*-*!?4)&'$.#-2#*-*!)!4)%#1#2#*-*!*'!).I(('$.#-!*'!I$-!-,'$-Q-!%)1('!I$!-.&#:)C!%'! #$g.)(4)(-!4)(!,'*#)!*'!2-%!,;&(#.-%!*'!*'6(-*-.#5$!*'2!-.&#:)!J!O('.I'$.#-!*'!).I(('$.#-!*'!2-!-,'$-Q-D!
@S!7)!%'!-&-.-!$#!%'!*'O#'$*'!*'!2-!,#%,-!,-$'(-!I$!%'(:#.#)!&'2',8&#.)!UI'!I$!2).-2!*'!&(-1-F)D!
"-6'(#&!:'(%#5$!<! ! Z'-2#Q-.#5$!*'2!-$82#%#%!J!6'%$!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!@N!?*'!@ABC!
*'&'(,#$-(!UI;!&(-&-,#'$&)!V-J!UI'!#,4)$'(2'%@@D!L2!V'.V)!*'!UI'!I$!*-&)!%'-!*'!.-(8.&'(!4'(%)g$-2!#,4-.&-!%)1('!&)*)%!2)%!-.&#:)%!#$:)2I.(-*)%!'$!%I!&(-&-,#'$&)!J!.I%&)*#-D!
+26)! %#,#2-(! ).I(('! .)$! 2)%!*-&)%! %),'&#*)%!-!I$-! .2-%#O#.-.#5$!*'! .)$O#*'$.#-2#*-*D!3I-$*)! %'!*#.'!UI'!I$!.#'(&)!#$O)(,'!'%&8!.2-%#O#.-*)!.),)!“reservado”, *'!O)(,-!UI'!2-%!.)4#-%!'%&8$!$I,'g(-*-%W! %52)!4I'*'$! 22'6-(!-! .#'(&-%!4'(%)$-%W!$)!*'1'$!%-2#(! *'2! ('.#$&)! J!*'1'$!%'(!*'%&(I#*-%!.)$.#'$QI*-,'$&'W!'&.D!%'!'%&8$! #,4)$#'$*)!I$-!%'(#'!*'!%-2:-6I-(*-%!4)(UI'! 2)!)(*'$-!'2! ('g62-,'$&)W!%'.&)(#-2!)!'%4'.RO#.)!*'!2-!E(6-$#Q-.#5$D!
Dependencias
T)%!-.&#:)%!,8%! 22-,-&#:)%!%I'2'$!%'(! 2)%!*-&)%!J! 2)%!%'(:#.#)%h!4'()!'%&)%!-.&#:)%!*'4'$*'$!*'!)&()%!-.&#:)%!,8%!4()%-#.)%!.),)!4I'*'$!%'(! 2)%!'UI#4)%W! 2-%!.),I$#.-.#)$'%!)! 2-%! O('.I'$&'g,'$&'!)2:#*-*-%!4'(%)$-%!UI'! &(-1-F-$!.)$!-UI'22)%D!/)(!'22)!-4-('.'!.),)! #,4)(&-$&'!'2!.)$g.'4&)!*'!j*'4'$*'$.#-%!'$&('!-.&#:)%k!)!2-!,'*#*-!'$!UI'!I$!-.&#:)!superior %'!:'(R-!-O'.&-*)!4)(!I$!#$.#*'$&'!*'!%'6I(#*-*!'$!I$!-.&#:)!inferior !@<.
]'!*#.'!UI'!I$!j-.&#:)!%I4'(#)(k!*'4'$*'!*'!)&()!j-.&#:)!#$O'(#)(k!.I-$*)!2-%!$'.'%#*-*'%!*'!%'6Ig(#*-*!*'2!%I4'(#)(!%'!('O2'F-$!'$!2-%!$'.'%#*-*'%!*'!%'6I(#*-*!*'2!#$O'(#)(D!EW!*#.V)!'$!)&(-%!4-2-g1(-%W!.I-$*)!2-!,-&'(#-2#Q-.#5$!*'!I$-!-,'$-Q-!'$!'2!-.&#:)!#$O'(#)(!&#'$'!.),)!.)$%'.I'$.#-!I$!4'(FI#.#)!%)1('!'2!-.&#:)!%I4'(#)(D!H$O)(,-2,'$&'!4I'*'!#$&'(4('&-(%'!UI'!2)%!-.&#:)%!#$O'(#)('%!%)$!2)%!4#2-('%!'$!2)%!UI'!%'!-4)J-!2-!%'6I(#*-*!*'!2)%!-.&#:)%!%I4'(#)('%D!
+I$UI'!'$!.-*-!.-%)!V-J!UI'!-*-4&-(%'!-!2-!E(6-$#Q-.#5$!)1F'&)!*'2!-$82#%#%W!.)$!O('.I'$.#-!%'!4I'*'!'%&(I.&I(-(!'2!.)$FI$&)!*'!-.&#:)%!'$!.-4-%W!*)$*'!2-%!.-4-%!%I4'(#)('%!*'4'$*'$!*'!2-%!#$O'(#)('%[!
!" .-4-!@[!el entorno[!-.&#:)%!UI'!%'!4('.#%-$!4-(-!6-(-$&#Q-(!2-%!%#6I#'$&'%!.-4-%!
!" 'UI#4-,#'$&)!J!%I,#$#%&()%[!'$'(6R-W!.2#,-&#Q-.#5$W!.),I$#.-.#)$'%!
!" 4'(%)$-2[!*'!*#('..#5$W!*'!)4'(-.#5$W!*'!*'%-(()22)W!'&.D!
!" )&()%[!'*#O#.#)%W!,)1#2#-(#)W!'&.D!
!" .-4-!<[!el sistema de información!4()4#-,'$&'!*#.V)!
!" 'UI#4)%!#$O)(,8&#.)%!(hardware)
!" -42#.-.#)$'%!(software)
!" .),I$#.-.#)$'%!
!" %)4)(&'%!*'!#$O)(,-.#5$[!*#%.)%W!.#$&-%W!'&.D!
!" .-4-!>[!la información
!" *-&)%!
!" ,'&-g*-&)%[!'%&(I.&I(-%W!R$*#.'%W!.2-:'%!*'!.#O(-W!'&.D!
!" .-4-!B[! las funciones de la OrganizaciónW!UI'!FI%&#O#.-$!2-!'M#%&'$.#-!*'2!%#%&',-!*'!#$gO)(,-.#5$!J!2'!*-$!O#$-2#*-*!
!" )1F'&#:)%!J!,#%#5$!
!" 1#'$'%!J!%'(:#.#)%!4()*I.#*)%!
!" .-4-!A[!otros!-.&#:)%!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
@@!L%!.),)!%#!'2!2'6#%2-*)(!VI1#'(-!('-2#Q-*)!'2!-$82#%#%!*'!(#'%6)%!4)(!$)%)&()%!J!VI1#'(-!*'&'(,#$-*)!2-%!%-2:-6I-(*-%!4'(&#$'$&'%D!L$!&)*)!.-%)W!2'J'%!J!('6I2-.#)$'%!'M#%&'$!J!-JI*-$!-!UI'!'%&)%!*-&)%W!.#'(g&-,'$&'!#,4)(&-$&'%W!'%&;$!4()&'6#*)%D!
@<!9$!'F',42)!4I'*'!%'(!,'F)(!UI'!,#2!4-2-1(-%D!]#!%'!UI',-!'2!2).-2!UI'!V)%4'*-!2)%!'UI#4)%W!2)!UI'!$)!OI$.#)$-!'%!'2!%'(:#.#)!4'(.#1#*)!4)(!'2!I%I-(#)!-!r#25,'&()%!*'!*#%&-$.#-D!]#!()1-$!'2!4)(&8!*'!I$!'F'.Ig&#:)!.)$!#$O)(,-.#5$!'%&(-&;6#.-!*'!2-!',4('%-W!2)!UI'!%IO('!'%!2-!.)$O#*'$.#-2#*-*!*'!*#.V-!#$O)(,-.#5$D!T-%!#$%&-2-.#)$'%!%'!('.)$%&(IJ'$h!4'()!4I'*'!V-1'(%'!4-%-*)!2-!)4)(&I$#*-*!*'!4('%&-(!'2!%'(:#.#)D!L2!()1)!%'!%I1%-$-!.),4(-$*)!)&()!4)(&8h!4'()!'2!%'.('&)!J-!'%&8!4'(*#*)D!
"-6'(#&!:'(%#5$!<! ! Z'-2#Q-.#5$!*'2!-$82#%#%!J!6'%$!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!@P!?*'!@ABC!
!" .('*#1#2#*-*!)!1I'$-!#,-6'$!
!" .)$).#,#'$&)!-.I,I2-*)!
!" #$*'4'$*'$.#-!*'!.(#&'(#)!)!-.&I-.#5$!
!" #$&#,#*-*!*'!2-%!4'(%)$-%!
!" #$&'6(#*-*!OR%#.-!*'!2-%!4'(%)$-%!
Valoración
X/)(!UI;!#$&'('%-!I$!-.&#:)Y!/)(!2)!UI'!:-2'D!
7)!%'!'%&8!V-12-$*)!*'!2)!UI'!.I'%&-$!2-%!.)%-%W!%#$)!*'!2)!UI'!:-2'$D!]#!-26)!$)!:-2'!4-(-!$-*-W!4('%.R$*-%'!*'!'22)D!]#!$)!%'!4I'*'!4('%.#$*#(!#,4I$','$&'!*'!I$!-.&#:)W!'%!UI'!-26)!:-2'h!'%)!'%!2)!UI'!V-J!UI'!-:'(#6I-(!4I'%!'%)!'%!2)!UI'!V-J!UI'!4()&'6'(D!
L2!:-2)(!4I'*'!%'(!4()4#)W!)!4I'*'!%'(!-.I,I2-*)D!]'!*#.'!UI'! 2)%!-.&#:)%! #$O'(#)('%!'$!I$!'%gUI',-!*'!*'4'$*'$.#-%W!-.I,I2-$!'2!:-2)(!*'!2)%!-.&#:)%!UI'!%'!-4)J-$!'$!'22)%D!
L2!:-2)(!$I.2'-(!%I'2'!'%&-(!'$!2-!#$O)(,-.#5$!?)!*-&)%C!UI'!'2!%#%&',-!,-$'F-W!UI'*-$*)!2)%!*'g,8%!-.&#:)%!%I1)(*#$-*)%!-! 2-%!$'.'%#*-*'%!*'!'M42)&-.#5$!J!4()&'..#5$!*'! 2-! #$O)(,-.#5$D!/)(!)&(-!4-(&'W!2)%!%#%&',-%!*'!#$O)(,-.#5$!'M42)&-$!2)%!*-&)%!4-(-!4()4)(.#)$-(!%'(:#.#)%W!#$&'($)%!-!2-!E(6-$#Q-.#5$!)!*'%&#$-*)%!-!&'(.'()%W!-4-('.#'$*)!I$-!%'(#'!*'!*-&)%!$'.'%-(#)%!4-(-!4('%&-(!I$!%'(:#.#)D!]#$!'$&(-(!'$!*'&-22'%! &;.$#.)%!*'!.5,)!%'!V-.'$! 2-%!.)%-%W!'2!.)$FI$&)!*'!*-&)%!J!%'(:#.#)%! O#$-2'%! 4'(,#&'! .-(-.&'(#Q-(! OI$.#)$-2,'$&'! I$-! )(6-$#Q-.#5$D! T-%! *'4'$*'$.#-%! '$&('!-.&#:)%!4'(,#&'$!('2-.#)$-(!2)%!*',8%!-.&#:)%!.)$!*-&)%!J!%'(:#.#)%D!
Dimensiones
\'!I$!-.&#:)!4I'*'!#$&'('%-(!.-2#1(-(!*#O'('$&'%!*#,'$%#)$'%[!
!" %I!autenticidad: XUI;!4'(FI#.#)!.-I%-(R-!$)!%-1'(!'M-.&-,'$&'!UI#'$!V-.'!)!V-!V'.V)!.-*-!.)%-Y!
L%&-!:-2)(-.#5$!'%!&R4#.-!*'!%'(:#.#)%!?-I&'$&#.#*-*!*'2!I%I-(#)C!J!*'!2)%!*-&)%!?-I&'$&#.#g*-*!*'!UI#'$!-..'*'!-!2)%!*-&)%!4-(-!'%.(#1#(!)W!%#,42','$&'W!.)$%I2&-(C!
!" %I!confidencialidad[!XUI;!*-c)!.-I%-(R-!UI'!2)!.)$).#'(-!UI#'$!$)!*'1'Y!
L%&-!:-2)(-.#5$!'%!&R4#.-!*'!*-&)%D!
!" %I!integridad[!XUI;!4'(FI#.#)!.-I%-(R-!UI'!'%&I:#'(-!*-c-*)!)!.)((I4&)Y!
L%&-!:-2)(-.#5$!'%!&R4#.-!*'!2)%!*-&)%W!UI'!4I'*'$!'%&-(!,-$#4I2-*)%W!%'(!&)&-2!)!4-(.#-2g,'$&'!O-2%)%!)W!#$.2I%)W!O-2&-(!*-&)%D!
!" %I!disponibilidad[!XUI;!4'(FI#.#)!.-I%-(R-!$)!&'$'(2)!)!$)!4)*'(!I#Q-(2)Y!
L%&-!:-2)(-.#5$!'%!&R4#.-!*'!2)%!%'(:#.#)%@>D!
L$!%#%&',-%!*'*#.-*)%!-!2-!-*,#$#%&(-.#5$!'2'.&(5$#.-!)!-2!.),'(.#)!'2'.&(5$#.)W!'2!.)$).#,#'$&)!*'!2)%!-.&)('%!'%!OI$*-,'$&-2!4-(-!4)*'(!4('%&-(!'2!%'(:#.#)!.)(('.&-,'$&'!J!4)*'(!4'(%'6I#(!2)%!O-22)%!?-..#*'$&-2'%!)!*'2#1'(-*)%C!UI'!4I*#'(-$!*-(%'D!L$!'%&)%!-.&#:)%W!-*',8%!*'!2-!-I&'$&#.#g*-*W!#$&'('%-!.-2#1(-(!2-[!
!" 2-!trazabilidad!*'2!I%)!*'2!%'(:#.#)[!XUI;!*-c)!.-I%-(R-!$)!%-1'(!-!UI#;$!%'!2'!4('%&-!&-2!%'(:#.#)Y!E!%'-W!XUI#;$!V-.'!UI;!J!.I8$*)Y!
!" 2-!trazabilidad!*'2!-..'%)!-!2)%!*-&)%[!XUI;!*-c)!.-I%-(R-!$)!%-1'(!UI#;$!-..'*'!-!UI;!*-&)%!J!UI;!V-.'!.)$!'22)%Y!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
@>!i-J!%'(:#.#)%!O#$-2'%!UI'!,-&'(#-2#Q-$!2-!,#%#5$!02&#,-!*'!2-!E(6-$#Q-.#5$D!i-J!%'(:#.#)%!#$&'($)%!*'!2)%!UI'!2-!E(6-$#Q-.#5$!%'!%#(:'!4-(-!'%&(I.&I(-(!%I!4()4#-!*#%&(#1I.#5$!*'!('%4)$%-1#2#*-*'%D!/)(!02&#,)W!V-J!%'(:#.#)%!UI'!%'!-*UI#'('$!*'!)&(-%!)(6-$#Q-.#)$'%[!%I,#$#%&()%!'M&'($)%D!
"-6'(#&!:'(%#5$!<! ! Z'-2#Q-.#5$!*'2!-$82#%#%!J!6'%$!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!<S!?*'!@ABC!
]'!('.)$).'$!V-1#&I-2,'$&'!2-%!*#,'$%#)$'%!18%#.-%[!-I&'$&#.#*-*W!.)$O#*'$.#-2#*-*W!#$&'6(#*-*!J!*#%4)$#1#2#*-*D!L$!'%&-!,'&)*)2)6R-!%'!V-!('O#$-*)!2-!-I&'$&#.#*-*!4-(-!*#%&#$6I#(!'$&('!'2!I%)!*'!I$!%'(:#.#)!J!'2!-..'%)!-!I$)%!*-&)%D!+*',8%!%'!V-! #$&()*I.#*)!'2!.)$.'4&)!*'!&(-Q-1#2#*-*!?*'2!#$62;%W!accountabilityC!&),-*)!*'!2-%!6IR-%!H]EdHL3!@>>>AW!#6I-2,'$&'!%'6,'$&-*-!'$&(-!2-!&(-Q-g1#2#*-*!*'2!%'(:#.#)!J!2-!*'!2)%!*-&)%D!T)%!-%4'.&)%!*'!-I&'$&#.#*-*!J!&(-Q-1#2#*-*!*'!2)%!*-&)%!%)$!.(R&#.)%!4-(-!%-&#%O-.'(!,'*#*-%! ('62-,'$&-(#-%!%)1('! O#.V'()%!UI'!.)$&'$6-$!*-&)%!*'!.-(8.&'(!4'(%)$-2D!
L2!.-4R&I2)!>!*'2!m3-&82)6)!*'!L2','$&)%m!4('%'$&-!I$-!('2-.#5$!*'!*#,'$%#)$'%!*'!%'6I(#*-*D!
L$!I$!8(1)2!*'!*'4'$*'$.#-%W!*)$*'!2)%!-.&#:)%!%I4'(#)('%!*'4'$*'$!*'!2)%!#$O'(#)('%W!'%!#,4('%g.#$*#12'!:-2)(-(! 2)%!-.&#:)%!%I4'(#)('%W! 2)%!UI'!%)$! #,4)(&-$&'%!4)(!%R!,#%,)%D!+I&),8&#.-,'$&'!'%&'!:-2)(!%'!-.I,I2-!'$!2)%!#$O'(#)('%W!2)!UI'!$)!'%!51#.'!4-(-!UI'!&-,1#;$!4I'*-$!,'('.'(W!-*#g.#)$-2,'$&'W!%I!:-2)(-.#5$!4()4#-D!
¿Cuánto vale la “salud” de los activos?
9$-!:'Q!*'&'(,#$-*-%!UI;!*#,'$%#)$'%!?*'!%'6I(#*-*C!#$&'('%-$!*'!I$!-.&#:)!V-J!UI'!4().'*'(!-!:-2)(-(2)D!T-!:-2)(-.#5$!'%! 2-!*'&'(,#$-.#5$!*'2!.)%&'!UI'!%I4)$*(R-!%-2#(!*'!I$-! #$.#*'$.#-!UI'!*'%&()Q-(-!'2!-.&#:)D!i-J!,I.V)%!O-.&)('%!-!.)$%#*'(-([!
!" .)%&'!*'!('4)%#.#5$[!-*UI#%#.#5$!'!#$%&-2-.#5$!
!" .)%&'!*'!,-$)!*'!)1(-!?'%4'.#-2#Q-*-C!#$:'(&#*-!'$!('.I4'(-(!?'2!:-2)(C!*'2!-.&#:)!
!" 2I.()!.'%-$&'[!4;(*#*-!*'!#$6('%)%!
!" .-4-.#*-*!*'!)4'(-([!.)$O#-$Q-!*'!2)%!I%I-(#)%!J!4():''*)('%!UI'!%'!&(-*I.'!'$!I$-!4;(*#g*-!*'!-.&#:#*-*!)!'$!4')('%!.)$*#.#)$'%!'.)$5,#.-%!
!" %-$.#)$'%!4)(!#$.I,42#,#'$&)!*'!2-!2'J!I!)12#6-.#)$'%!.)$&(-.&I-2'%!
!" *-c)!-!)&()%!-.&#:)%W!4()4#)%!)!-F'$)%!
!" *-c)!-!4'(%)$-%!
!" *-c)%!,'*#)-,1#'$&-2'%!
T-!:-2)(-.#5$!4I'*'!%'(!.I-$&#&-&#:-!?.)$!I$-!.-$&#*-*!$I,;(#.-C!)!.I-2#&-&#:-!?'$!-26I$-!'%.-2-!*'!$#:'2'%CD!T)%!.(#&'(#)%!,8%!#,4)(&-$&'%!-!('%4'&-(!%)$[!
!" 2-! homogeneidad[! '%! #,4)(&-$&'! 4)*'(! .),4-(-(! :-2)('%! -I$UI'! %'-$! *'! *#O'('$&'%! *#g,'$%#)$'%!-!O#$!*'!4)*'(!.),1#$-(!:-2)('%!4()4#)%!J!:-2)('%!-.I,I2-*)%W!-%R!.),)!4)*'(!*'&'(,#$-(!%#!'%!,8%!6(-:'!'2!*-c)!'$!I$-!*#,'$%#5$!)!'$!)&(-!
!" 2-!relatividad[!'%!#,4)(&-$&'!4)*'(!('2-&#:#Q-(!'2!:-2)(!*'!I$!-.&#:)!'$!.),4-(-.#5$!.)$!)&()%!-.&#:)%!
`)*)%!'%&)%!.(#&'(#)%!%'!%-&#%O-.'$!.)$!:-2)(-.#)$'%!'.)$5,#.-%!?.)%&'!*#$'(-(#)!('UI'(#*)!4-(-!j.I(-(k!'2!-.&#:)C!J!'%!O('.I'$&'!2-!&'$&-.#5$!*'!4)$'(2'!4('.#)!-!&)*)D!]#!%'!.)$%#6I'W!'M.'2'$&'D!H$.2I%)!'%!O8.#2!4)$'(2'!4('.#)!-!2)%!-%4'.&)%!,8%!&-$6#12'%!?'UI#4-,#'$&)W!V)(-%!*'!&(-1-F)W!'&.DCh!4'()!-2!'$&(-(!'$!:-2)(-.#)$'%!,8%!-1%&(-.&-%!?#$&-$6#12'%!.),)!2-!.('*#1#2#*-*!*'!2-!E(6-$#Q-.#5$C!2-!:-2)(-.#5$!'.)$5,#.-!'M-.&-!4I'*'!%'(!'%.I((#*#Q-!J!,)&#:)!*'!-6(#-%!*#%4I&-%!'$&('!'M4'(&)%D!
L2!.-4R&I2)!B!*'2!m3-&82)6)!*'!L2','$&)%m!4('%'$&-!I$-%!4-I&-%!4-(-!2-!:-2)(-.#5$!%#%&',8&#.-!*'!-.&#:)%D!
Valoración cualitativa
T-%!'%.-2-%!.I-2#&-&#:-%!4'(,#&'$!-:-$Q-(!.)$!(-4#*'QW!4)%#.#)$-$*)!'2!:-2)(!*'!.-*-!-.&#:)!'$!I$!)(*'$! ('2-&#:)! ('%4'.&)! *'! 2)%! *',8%D! L%! O('.I'$&'! 42-$&'-(! '%&-%! '%.-2-%! .),)! j5(*'$'%! *'!,-6$#&I*k!JW!'$!.)$%'.I'$.#-W!*'(#:-(!'%&#,-.#)$'%!*'2!)(*'$!*'!,-6$#&I*!*'2!(#'%6)D!
T-!2#,#&-.#5$!*'!2-%!:-2)(-.#)$'%!.I-2#&-&#:-%!'%!UI'!$)!4'(,#&'$!.),4-(-(!:-2)('%!,8%!-228!*'!%I!)(*'$!('2-&#:)D!7)!%'!4I'*'$!%I,-(!:-2)('%D!
"-6'(#&!:'(%#5$!<! ! Z'-2#Q-.#5$!*'2!-$82#%#%!J!6'%$!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!<@!?*'!@ABC!
L2!.-4R&I2)!ND@!*'!2-!m^IR-!*'!`;.$#.-%m!4('%'$&-!I$!,)*'2)!*'!-$82#%#%!1-%-*)!'$!:-2)(-.#)$'%!.I-2#&-&#:-%D!
Valoración cuantitativa
T-%!:-2)(-.#)$'%!$I,;(#.-%!-1%)2I&-%!.I'%&-$!,I.V)!'%OI'(Q)h!4'()!$)!-*)2'.'$!*'!2)%!4()12'g,-%!*'!2-%!:-2)(-.#)$'%!.I-2#&-&#:-%D!]I,-(!:-2)('%!$I,;(#.)%!'%!-1%)2I&-,'$&'!j$-&I(-2k!J!2-!#$g&'(4('&-.#5$!*'!2-%!%I,-%!$)!'%!$I$.-!,)&#:)!*'!.)$&():'(%#-D!
]#! 2-!:-2)(-.#5$!'%!*#$'(-(#-W!-*',8%!%'!4I'*'$!V-.'(!'%&I*#)%!'.)$5,#.)%!.),4-(-$*)!2)!UI'!%'!-((#'%6-!.)$!2)!UI'!.I'%&-!2-!%)2I.#5$!('%4)$*#'$*)!-!2-%!4('6I$&-%[!
!" X_-2'!2-!4'$-!#$:'(&#(!&-$&)!*#$'()!'$!'%&-!%-2:-6I-(*-Y!
!" XsI;!.)$FI$&)!*'!%-2:-6I-(*-%!)4&#,#Q-$!2-!#$:'(%#5$Y!
!" XL$!UI;!42-Q)!*'!&#',4)!%'!('.I4'(-!2-!#$:'(%#5$Y!
!" X3I8$&)!'%!(-Q)$-12'!UI'!.I'%&'!2-!4(#,-!*'!I$!%'6I()Y!
L2!.-4R&I2)!ND<!*'!2-!m^IR-!*'!`;.$#.-%m!4('%'$&-!I$!,)*'2)!*'!-$82#%#%!1-%-*)!'$!:-2)(-.#)$'%!.I-$&#&-&#:-%D!
El valor de la interrupción del servicio
3-%#!&)*-%!2-%!*#,'$%#)$'%!,'$.#)$-*-%!-$&'(#)(,'$&'!4'(,#&'$!I$-!:-2)(-.#5$!%#,42'W!.I-2#&-&#g:-!)!.I-$&#&-&#:-D!/'()!V-J!I$-!'M.'4.#5$W!2-!*#%4)$#1#2#*-*D!
7)!'%!2)!,#%,)!#$&'((I,4#(!I$!%'(:#.#)!I$-!V)(-!)!I$!*R-!)!I$!,'%D!/I'*'!UI'!I$-!V)(-!*'!*'&'$g.#5$!%'-!#(('2':-$&'W!,#'$&(-%!UI'!I$!*R-!%#$!%'(:#.#)!.-I%-!I$!*-c)!,)*'(-*)h!4'()!I$!,'%!*'&'g$#*)!%I4)$6-!2-!&'(,#$-.#5$!*'!2-!-.&#:#*-*D!o!2)!,-2)!'%!UI'!$)!'M#%&'!4()4)(.#)$-2#*-*!'$&('!'2!&#',4)!*'!#$&'((I4.#5$!J!2-%!.)$%'.I'$.#-%D!!
L$!.)$%'.I'$.#-W!4-(-!:-2)(-(!2-!p#$&'((I4.#5$!*'!2-q!*#%4)$#1#2#*-*!*'!I$!-.&#:)!V-J!UI'!I%-(!I$-!'%&(I.&I(-!,8%!.),42'F-!UI'!%'!4I'*'!('%I,#(!'$!-260$!6(8O#.)!.),)!'2!%#6I#'$&'[!
@A, >S, @V <V GV @* <* @% <% @, <, G, @- &)&-2
S
@
<
>
coste de [la interrupción de la] disponibilidad
!
*)$*'! -4-('.'! I$-! %'(#'! *'! '%.-2)$'%! *'! #$&'((I4.#5$! UI'! &'(,#$-$! .)$! 2-! *'%&(I..#5$! &)&-2! )!4'(,-$'$&'!*'2! -.&#:)D!L$!'2! 'F',42)!-$&'(#)(W! 4-(-*-%!*'!V-%&-!G!V)(-%!%'!4I'*'$!-%I,#(! %#$!.)$%'.I'$.#-%D!/'()!-!2-%!G!V)(-%!%'!*#%4-(-$!2-%!-2-(,-%!UI'!-I,'$&-$!%#!2-!4-(-*-!%I4'(-!2)%!<!*R-%D!o!%#!2-!4-(-*-!%I4'(-!'2!,'%W!%'!4I'*'!*'.#(!UI'!2-!E(6-$#Q-.#5$!V-!4'(*#*)!%I!.-4-.#*-*!*'!)4'(-([!V-!,I'(&)D!\'%*'!'2!4I$&)!*'!:#%&-!*'!2)%!(','*#)%W!2-!6(8O#.-!*#.'!*#('.&-,'$&'!UI'!$)!V-J!UI'!6-%&-(%'!$#!I$!'I()!4)(!':#&-(!4-(-*-%!*'!,'$)%!*'!G!V)(-%D!_-2'!2-!4'$-!I$!.#'(&)!6-%&)!4)(!#,4'*#(!UI'!I$-!4-(-*-!%I4'('!2-%!G!V)(-%!)!2)%!<!*R-%D!o!.I-$*)!%'!:-2)('!2)!UI'!.I'%&-!#,g4'*#(!UI'!2-!4-(-*-!%I4'(-!'2!,'%W!V-J!UI'!4)$'(!'$!2-!1-2-$Q-!&)*)!'2!:-2)(!*'!2-!E(6-$#Q-.#5$!O('$&'!-2!.)%&'!*'!2-%!%-2:-6I-(*-%D!/I*#'(-!%'(!UI'!$)!:-2#'(-!2-!4'$-D!
"-6'(#&!:'(%#5$!<! ! Z'-2#Q-.#5$!*'2!-$82#%#%!J!6'%$!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!<<!?*'!@ABC!
2.1.2. Paso 2: Amenazas
L2! %#6I#'$&'! 4-%)! .)$%#%&'! '$! *'&'(,#$-(! 2-%! -,'$-Q-%! UI'! 4I'*'$! -O'.&-(! -! .-*-! -.&#:)D! T-%!-,'$-Q-%!%)$!j.)%-%!UI'!).I(('$kD!oW!*'!&)*)!2)!UI'!4I'*'!).I((#(W!#$&'('%-!2)!UI'!4I'*'!4-%-(2'!-!$I'%&()%!-.&#:)%!J!.-I%-(!I$!*-c)D!!
i-J!-..#*'$&'%!$-&I(-2'%!?&'((',)&)%W! #$I$*-.#)$'%W! DDDC!J!*'%-%&('%! #$*I%&(#-2'%!?.)$&-,#$-.#5$W!O-22)%!'2;.&(#.)%W!DDDC!-$&'!2)%!.I-2'%!'2!%#%&',-!*'!#$O)(,-.#5$!'%!:R.&#,-!4-%#:-h!4'()!$)!4)(!%'(!4-%#:)%!V-J!UI'!4'(,-$'.'(!#$*'O'$%)%D!i-J!-,'$-Q-%!.-I%-*-%!4)(!2-%!4'(%)$-%W!1#'$!'(()('%W!1#'$!-&-UI'%!#$&'$.#)$-*)%D!!
L2!.-4R&I2)!A!*'2!m3-&82)6)!*'!L2','$&)%m!4('%'$&-!I$-!('2-.#5$!*'!-,'$-Q-%!&R4#.-%D!
7)!&)*-%!2-%!-,'$-Q-%!-O'.&-$!-!&)*)%!2)%!-.&#:)%@BW!%#$)!UI'!V-J!I$-!.#'(&-!('2-.#5$!'$&('!'2!)!*'!-.&#:)!J!2)!UI'!2'!4)*(R-!).I((#(D!
Valoración de las amenazas
3I-$*)!I$!-.&#:)!'%!:R.&#,-!*'!I$-!-,'$-Q-W!$)!%'!:'!-O'.&-*)!'$!&)*-%!%I%!*#,'$%#)$'%W!$#!'$!2-!,#%,-!.I-$&R-D!
9$-!:'Q!*'&'(,#$-*)!UI'!I$-!-,'$-Q-!4I'*'!4'(FI*#.-(!-!I$!-.&#:)W!V-J!UI'!'%&#,-(!.I8$!:I2$'g(-12'@A!'%!'2!-.&#:)W!'$!*)%!%'$&#*)%[!
degradación:!.I8$!4'(FI*#.-*)!('%I2&-(R-!'2!-.&#:)!
frecuencia: .-*-!.I8$&)!%'!,-&'(#-2#Q-!2-!-,'$-Q-!
T-!*'6(-*-.#5$!,#*'!'2!*-c)!.-I%-*)!4)(!I$!#$.#*'$&'!'$!'2!%I4I'%&)!*'!UI'!).I((#'(-D!
T-!*'6(-*-.#5$!%'!%I'2'!.-(-.&'(#Q-(!.),)!I$-!O(-..#5$!*'2!:-2)(!*'2!-.&#:)!J!-%R!-4-('.'$!'M4('g%#)$'%! .),)! UI'! I$! -.&#:)! %'! V-! :#%&)! j&)&-2,'$&'! *'6(-*-*)kW! )! j*'6(-*-*)! '$! I$-! 4'UI'c-!O(-..#5$kD!3I-$*)! 2-%!-,'$-Q-%!$)!%)$! #$&'$.#)$-2'%W!4()1-12','$&'!1-%&'!.)$).'(! 2-! O(-..#5$!OR%#.-,'$&'!4'(FI*#.-*-!*'!I$!-.&#:)!4-(-!.-2.I2-(!2-!4;(*#*-!4()4)(.#)$-2!*'!:-2)(!UI'!%'!4#'(*'D!/'()!.I-$*)!2-!-,'$-Q-!'%!#$&'$.#)$-2W!$)!%'!4I'*'!4'$%-(!'$!4()4)(.#)$-2#*-*!-26I$-!4I'%!'2!-&-.-$&'!4I'*'!.-I%-(!,I.VR%#,)!*-c)!*'!O)(,-!%'2'.&#:-D!
T-!O('.I'$.#-@G!4)$'!'$!4'(%4'.&#:-!-UI'22-!*'6(-*-.#5$W!4I'%!I$-!-,'$-Q-!4I'*'!%'(!*'!&'((#g12'%!.)$%'.I'$.#-%!4'()!*'!,IJ! #,4()1-12'!,-&'(#-2#Q-.#5$h!,#'$&(-%!UI'!)&(-!-,'$-Q-!4I'*'!%'(!*'!,IJ!1-F-%!.)$%'.I'$.#-%W!4'()!&-$!O('.I'$&'!.),)!4-(-!-.-1-(!-.I,I2-$*)!I$!*-c)!.)$g%#*'(-12'D!
T-!O('.I'$.#-!%'!,)*'2-!.),)!I$-!&-%-!-$I-2!*'!).I(('$.#-W!%#'$*)!:-2)('%!&R4#.)%!
@SS! ,IJ!O('.I'$&'! -!*#-(#)!
@S! O('.I'$&'! ,'$%I-2,'$&'!
@! $)(,-2! I$-!:'Q!-2!-c)!
@d@S! 4).)!O('.I'$&'! .-*-!:-(#)%!-c)%!
!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
@B!T-%!#$%&-2-.#)$'%!4I'*'$!#$.'$*#-(%'h!4'()!2-%!-42#.-.#)$'%W!$)D!T-%!4'(%)$-%!4I'*'$!%'(!)1F'&)!*'!I$!-&-UI'!1-.&'(#)256#.)h!4'()!2)%!%'(:#.#)%W!$)D!]#$!',1-(6)W!2)%!:#(I%!#$O)(,8&#.)%!-O'.&-$!-!2-%!-42#.-.#)g$'%W!$)!-!2-%!4'(%)$-%D!
@A!T)%!2'.&)('%!O-,#2#-(#Q-*)%!.)$!"-6'(#&!:@DSW!*'&'.&-(8$!2-!-I%'$.#-!*'!2-!:)Q!j:I2$'(-1#2#*-*kD!L2!.)$.'4g&)!*'!:I2$'(-1#2#*-*!?4)&'$.#-2#*-*!)!4)%#1#2#*-*!*'!).I(('$.#-!*'!I$-!-,'$-Q-!%)1('!I$!-.&#:)C!%'! #$g.)(4)(-!4)(!,'*#)!*'!2-%!,;&(#.-%!*'!*'6(-*-.#5$!*'2!-.&#:)!J!O('.I'$.#-!*'!).I(('$.#-!*'!2-!-,'$-Q-D!
@G!]'!,#*'!.),)!'2!$0,'()!,'*#)!*'!).I(('$.#-%!*'!2-!-,'$-Q-!'$!I$!#$&'(:-2)!*'&'(,#$-*)!*'!&#',4)D!`R4#.-,'$&'!'%&#,-!%)1('!4'(#)*)%!-$I-2'%D!/)(!'F',42)W!%#!'$!I$!.#'(&)!%#%&',-!%'!4()*I.'!I$-!-:'(R-!*'2!-#('!-.)$*#.#)$-*)!I$!4(),'*#)!*'!.#$.)!:'.'%!'$!I$!-c)W!'%-!'%!2-!O('.I'$.#-[!AD!
"-6'(#&!:'(%#5$!<! ! Z'-2#Q-.#5$!*'2!-$82#%#%!J!6'%$!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!<>!?*'!@ABC!
2.1.3. Paso 4: Determinación del impacto
]'!*'$),#$-!#,4-.&)!-!2-!,'*#*-!*'2!*-c)!%)1('!'2!-.&#:)!*'(#:-*)!*'!2-!,-&'(#-2#Q-.#5$!*'!I$-!-,'$-Q-D!3)$).#'$*)!'2!:-2)(!*'!2)%!-.&#:)%!?'$!:-(#-%!*#,'$%#)$'%C!J!2-!*'6(-*-.#5$!UI'!.-I%-$!2-%!-,'$-Q-%W!'%!*#('.&)!*'(#:-(!'2!#,4-.&)!UI'!'%&-%!&'$*(R-$!%)1('!'2!%#%&',-D!T-!0$#.-!.)$%#*'g(-.#5$!UI'!UI'*-!V-.'(!'%!('2-&#:-!-!2-%!*'4'$*'$.#-%!'$&('!-.&#:)%D!L%!O('.I'$&'!UI'!'2!:-2)(!*'2!%#%&',-!*'! #$O)(,-.#5$!%'!.'$&('!'$! 2)%!%'(:#.#)%!UI'!4('%&-!J! 2)%!*-&)%!UI'!,-$'F-W!-2! &#',4)!UI'!2-%!-,'$-Q-%!%I'2'$!,-&'(#-2#Q-(%'!'$!2)%!,'*#)%D!
Impacto acumulado
L%!'2!.-2.I2-*)!%)1('!I$!-.&#:)!&'$#'$*)!'$!.I'$&-!
!" %I!:-2)(!-.I,I2-*)!?'2!4()4#)!,-%!'2!-.I,I2-*)!*'!2)%!-.&#:)%!UI'!*'4'$*'$!*'!;2C!
!" 2-%!-,'$-Q-%!-!UI'!'%&8!'M4I'%&)!
L2!#,4-.&)!-.I,I2-*)!%'!.-2.I2-!4-(-!.-*-!-.&#:)W!4)(!.-*-!-,'$-Q-!J!'$!.-*-!*#,'$%#5$!*'!:-g2)(-.#5$W!%#'$*)!I$-!OI$.#5$!*'2!:-2)(!-.I,I2-*)!J!*'!2-!*'6(-*-.#5$!.-I%-*-D!
L2!#,4-.&)!'%!&-$&)!,-J)(!.I-$&)!,-J)(!'%!'2!:-2)(!4()4#)!)!-.I,I2-*)!%)1('!I$!-.&#:)D!
L2!#,4-.&)!'%!&-$&)!,-J)(!.I-$&)!,-J)(!%'-!2-!*'6(-*-.#5$!*'2!-.&#:)!-&-.-*)D!
L2! #,4-.&)!-.I,I2-*)W!-2!.-2.I2-(%'!%)1('!2)%!-.&#:)%!UI'!%)4)(&-$!'2!4'%)!*'2!%#%&',-!*'!#$O)(g,-.#5$W!4'(,#&'!*'&'(,#$-(!2-%!%-2:-6I-(*-%!*'!UI'!V-J!UI'!*)&-(!-!2)%!,'*#)%!*'!&(-1-F)[!4()g&'..#5$!*'!2)%!'UI#4)%W!.)4#-%!*'!('%4-2*)W!'&.D!
Impacto repercutido
L%!'2!.-2.I2-*)!%)1('!I$!-.&#:)!&'$#'$*)!'$!.I'$&-!
!" %I!:-2)(!4()4#)!
!" 2-%!-,'$-Q-%!-!UI'!'%&8$!'M4I'%&)%!2)%!-.&#:)%!*'!2)%!UI'!*'4'$*'!
L2! #,4-.&)! ('4'(.I&#*)!%'!.-2.I2-!4-(-!.-*-!-.&#:)W!4)(!.-*-!-,'$-Q-!J!'$!.-*-!*#,'$%#5$!*'!:-2)(-.#5$W!%#'$*)!I$-!OI$.#5$!*'2!:-2)(!4()4#)!J!*'!2-!*'6(-*-.#5$!.-I%-*-D!
L2!#,4-.&)!'%!&-$&)!,-J)(!.I-$&)!,-J)(!'%!'2!:-2)(!4()4#)!*'!I$!-.&#:)D!
L2!#,4-.&)!'%!&-$&)!,-J)(!.I-$&)!,-J)(!%'-!2-!*'6(-*-.#5$!*'2!-.&#:)!-&-.-*)D!
L2!#,4-.&)!'%!&-$&)!,-J)(!.I-$&)!,-J)(!%'-!2-!*'4'$*'$.#-!*'2!-.&#:)!-&-.-*)D!
L2!#,4-.&)!('4'(.I&#*)W!-2!.-2.I2-(%'!%)1('!2)%!-.&#:)%!UI'!&#'$'$!:-2)(!4()4#)W!4'(,#&'!*'&'(,#$-(!2-%!.)$%'.I'$.#-%!*'!2-%!#$.#*'$.#-%!&;.$#.-%!%)1('!2-!,#%#5$!*'2!%#%&',-!*'!#$O)(,-.#5$D!L%!4I'%!I$-!4('%'$&-.#5$!6'('$.#-2! UI'!-JI*-!-! &),-(!I$-!*'! 2-%!*'.#%#)$'%!.(R&#.-%!*'!I$!-$82#%#%!*'!(#'%6)%[!-.'4&-(!I$!.#'(&)!$#:'2!*'!(#'%6)D!!
Agregación de valores de impacto
T)%!48((-O)%!-$&'(#)('%!*'&'(,#$-$!'2!#,4-.&)!UI'!%)1('!I$!-.&#:)!&'$*(R-!I$-!-,'$-Q-!'$!!I$-!.#'(&-!*#,'$%#5$D!L%&)%!#,4-.&)%!%#$6I2-('%!4I'*'$!-6('6-(%'!1-F)!.#'(&-%!.)$*#.#)$'%[!
!" 4I'*'!-6('6-(%'!'2!#,4-.&)!('4'(.I&#*)!%)1('!*#O'('$&'%!-.&#:)%W!
!" 4I'*'!-6('6-(%'!'2!#,4-.&)!-.I,I2-*)!%)1('!-.&#:)%!UI'!$)!%'-$!*'4'$*#'$&'%!'$&('!%RW!$#!*'4'$*-$!*'!$#$60$!-.&#:)!%I4'(#)(!.),0$W!
!" $)!*'1'!-6('6-(%'!'2! #,4-.&)!-.I,I2-*)!%)1('!-.&#:)%!UI'!$)!%'-$!#$*'4'$*#'$&'%W!4I'%!'22)!%I4)$*(R-!%)1('!4)$*'(-(!'2!#,4-.&)!-2!#$.2I#(!:-(#-%!:'.'%!'2!:-2)(!-.I,I2-*)!*'!-.&#g:)%!%I4'(#)('%W!
!" 4I'*'!-6('6-(%'!'2! #,4-.&)!*'!*#O'('$&'%!-,'$-Q-%!%)1('!I$!,#%,)!-.&#:)W!-I$UI'!.)$g:#'$'!.)$%#*'(-(!'$!UI;!,'*#*-!2-%!*#O'('$&'%!-,'$-Q-%!%)$!#$*'4'$*#'$&'%!J!4I'*'$!%'(!.)$.I(('$&'%W!
"-6'(#&!:'(%#5$!<! ! Z'-2#Q-.#5$!*'2!-$82#%#%!J!6'%$!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!<B!?*'!@ABC!
!" 4I'*'!-6('6-(%'!'2!#,4-.&)!*'!I$-!-,'$-Q-!'$!*#O'('$&'%!*#,'$%#)$'%D!
2.1.4. Paso 5: Determinación del riesgo
]'!*'$),#$-!(#'%6)!-!2-!,'*#*-!*'2!*-c)!4()1-12'!%)1('!I$!%#%&',-D!3)$).#'$*)!'2!#,4-.&)!*'!2-%!-,'$-Q-%!%)1('! 2)%!-.&#:)%W!'%!*#('.&)!*'(#:-(!'2! (#'%6)!%#$!,8%!UI'! &'$'(!'$!.I'$&-! 2-! O('g.I'$.#-!*'!).I(('$.#-D!
L2!(#'%6)!.('.'!.)$!'2!#,4-.&)!J!.)$!2-!O('.I'$.#-D!
Riesgo acumulado
L%!'2!.-2.I2-*)!%)1('!I$!-.&#:)!&'$#'$*)!'$!.I'$&-!
!" '2!#,4-.&)!-.I,I2-*)!%)1('!I$!-.&#:)!*'1#*)!-!I$-!-,'$-Q-!J!
!" 2-!O('.I'$.#-!*'!2-!-,'$-Q-!
L2!(#'%6)!-.I,I2-*)!%'!.-2.I2-!4-(-!.-*-!-.&#:)W!4)(!.-*-!-,'$-Q-!J!'$!.-*-!*#,'$%#5$!*'!:-2)g(-.#5$W! %#'$*)! I$-! OI$.#5$! *'2! :-2)(! -.I,I2-*)W! 2-! *'6(-*-.#5$! .-I%-*-! J! 2-! O('.I'$.#-! *'! 2-!-,'$-Q-D!
L2!(#'%6)!-.I,I2-*)W!-2!.-2.I2-(%'!%)1('!2)%!-.&#:)%!UI'!%)4)(&-$!'2!4'%)!*'2!%#%&',-!*'!#$O)(,-g.#5$W!4'(,#&'!*'&'(,#$-(!2-%!%-2:-6I-(*-%!*'!UI'!V-J!UI'!*)&-(!-!2)%!,'*#)%!*'!&(-1-F)[!4()&'.g.#5$!*'!2)%!'UI#4)%W!.)4#-%!*'!('%4-2*)W!'&.D!
Riesgo repercutido
L%!'2!.-2.I2-*)!%)1('!I$!-.&#:)!&'$#'$*)!'$!.I'$&-!
!" '2!#,4-.&)!('4'(.I&#*)!%)1('!I$!-.&#:)!*'1#*)!-!I$-!-,'$-Q-!J!
!" 2-!O('.I'$.#-!*'!2-!-,'$-Q-!
L2!(#'%6)!('4'(.I&#*)!%'!.-2.I2-!4-(-!.-*-!-.&#:)W!4)(!.-*-!-,'$-Q-!J!'$!.-*-!*#,'$%#5$!*'!:-2)g(-.#5$W!%#'$*)!I$-!OI$.#5$!*'2!:-2)(!4()4#)W!2-!*'6(-*-.#5$!.-I%-*-!J!2-!O('.I'$.#-!*'!2-!-,'$-gQ-D!
L2! (#'%6)!('4'(.I&#*)W!-2!.-2.I2-(%'!%)1('! 2)%!-.&#:)%!UI'! &#'$'$!:-2)(!4()4#)W!4'(,#&'!*'&'(,#$-(!2-%!.)$%'.I'$.#-%!*'!2-%!#$.#*'$.#-%!&;.$#.-%!%)1('!2-!,#%#5$!*'2!%#%&',-!*'!#$O)(,-.#5$D!L%!4I'%!I$-!4('%'$&-.#5$!6'('$.#-2! UI'!-JI*-!-! &),-(!I$-!*'! 2-%!*'.#%#)$'%!.(R&#.-%!*'!I$!-$82#%#%!*'!(#'%6)%[!-.'4&-(!I$!.#'(&)!$#:'2!*'!(#'%6)D!!
Agregación de riesgos
T)%!48((-O)%!-$&'(#)('%!*'&'(,#$-$!'2! (#'%6)!UI'!%)1('!I$!-.&#:)! &'$*(R-!I$-!-,'$-Q-!'$! !I$-!.#'(&-!*#,'$%#5$D!L%&)%!(#'%6)%!%#$6I2-('%!4I'*'$!-6('6-(%'!1-F)!.#'(&-%!.)$*#.#)$'%[!
!" 4I'*'!-6('6-(%'!'2!(#'%6)!('4'(.I&#*)!%)1('!*#O'('$&'%!-.&#:)%W!
!" 4I'*'!-6('6-(%'!'2! (#'%6)!-.I,I2-*)!%)1('!-.&#:)%!UI'!$)!%'-$!*'4'$*#'$&'%!'$&('!%RW!$#!*'4'$*-$!*'!$#$60$!-.&#:)!%I4'(#)(!.),0$W!
!" $)!*'1'!-6('6-(%'!'2!(#'%6)!-.I,I2-*)!%)1('!-.&#:)%!UI'!$)!%'-$!#$*'4'$*#'$&'%W!4I'%!'22)!%I4)$*(R-!%)1('!4)$*'(-(!'2!(#'%6)!-2!#$.2I#(!:-(#-%!:'.'%!'2!:-2)(!-.I,I2-*)!*'!-.&#:)%!%Ig4'(#)('%W!
!" 4I'*'!-6('6-(%'!'2!(#'%6)!*'!*#O'('$&'%!-,'$-Q-%!%)1('!I$!,#%,)!-.&#:)W!-I$UI'!.)$:#'$'!.)$%#*'(-(!'$!UI;!,'*#*-!2-%!*#O'('$&'%!-,'$-Q-%!%)$!#$*'4'$*#'$&'%!J!4I'*'$!%'(!.)$.Ig(('$&'%W!
!" 4I'*'!-6('6-(%'!'2!(#'%6)!*'!I$-!-,'$-Q-!'$!*#O'('$&'%!*#,'$%#)$'%D!
2.1.5. Paso 3: Salvaguardas
L$! 2)%!4-%)%!-$&'(#)('%!$)!%'!V-$! &),-*)!'$!.)$%#*'(-.#5$! 2-%!%-2:-6I-(*-%!*'%42'6-*-%D!]'!,#*'$W!4)(!&-$&)W!2)%!#,4-.&)%!J!(#'%6)%!-!UI'!'%&-(R-$!'M4I'%&)%!2)%!-.&#:)%!%#!$)!%'!4()&'6#'(-$!
"-6'(#&!:'(%#5$!<! ! Z'-2#Q-.#5$!*'2!-$82#%#%!J!6'%$!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!<A!?*'!@ABC!
'$!-1%)2I&)D!L$!2-!4(8.&#.-!$)!'%!O('.I'$&'!'$.)$&(-(!%#%&',-%!*'%4()&'6#*)%[!2-%!,'*#*-%!.#&-*-%!#$*#.-$!2)!UI'!).I((#(R-!%#!%'!('&#(-(-$!2-%!%-2:-6I-(*-%!4('%'$&'%D!
]'!*'O#$'$!2-%!%-2:-6I-(*-%!)!.)$&(-!,'*#*-%!.),)!-UI'22)%!4().'*#,#'$&)%!)!,'.-$#%,)%!&'.g$)256#.)%!UI'!('*I.'$!'2!(#'%6)D!i-J!-,'$-Q-%!UI'!%'!.)$FI(-(!%#,42','$&'!)(6-$#Q8$*)%'!-*'g.I-*-,'$&'W!)&(-%!('UI#'('%!'2','$&)%!&;.$#.)%!?4()6(-,-%!)!'UI#4)%CW!)&(-%!%'6I(#*-*!OR%#.-!JW!4)(!02&#,)W!'%&8!2-!4)2R&#.-!*'!4'(%)$-2D!
L2!.-4R&I2)!G!*'2!m3-&82)6)!*'!L2','$&)%m!4('%'$&-!I$-!('2-.#5$!*'!%-2:-6I-(*-%!-*'.I-*-%!4-(-!.-*-!)!*'!-.&#:)%D!
T-%!%-2:-6I-(*-%!'$&(-$!'$!'2!.82.I2)!*'2!(#'%6)!*'!*)%!O)(,-%[!
Reduciendo la frecuencia de las amenazas.
]'! 22-,-$! %-2:-6I-(*-%! 4(':'$&#:-%D! T-%! #*'-2'%! 22'6-$! -! #,4'*#(! .),42'&-,'$&'! UI'! 2-!-,'$-Q-!%'!,-&'(#-2#.'D!
Limitando el daño causado.
i-J!%-2:-6I-(*-%!UI'!*#('.&-,'$&'!2#,#&-$!2-!4)%#12'!*'6(-*-.#5$W!,#'$&(-%!UI'!)&(-%!4'(g,#&'$!*'&'.&-(!#$,'*#-&-,'$&'!'2!-&-UI'!4-(-!O('$-(!UI'!2-!*'6(-*-.#5$!-:-$.'D!H$.2I%)!-2g6I$-%!%-2:-6I-(*-%!%'!2#,#&-$!-!4'(,#&#(!2-!4()$&-!('.I4'(-.#5$!*'2!%#%&',-!.I-$*)!2-!-,'g$-Q-!2)!*'%&(IJ'D!L$!.I-2UI#'(-!*'!2-%!:'(%#)$'%W!2-!-,'$-Q-!%'!,-&'(#-2#Q-h!4'()!2-%!.)$g%'.I'$.#-%!%'!2#,#&-$D!
-.&#:)%-.&#:)%
-,'$-Q-%-,'$-Q-%
frecuenciaresidual
frecuenciaresidual
impactoresidual
impactoresidual
:-2)(:-2)(
riesgoresidual
riesgoresidual
'%&8$!'M4I'%&)%!-
H$&'('%-$!4)(!%I
degradaciónresidual
degradaciónresidual
.-I%-$!I$-!.#'(&-
.)$!I$-!.#'(&-
)!*'!-.&#:)*#,'$%#5$-,'$-Q-
$#:'2!*'!(#'%6)
salvaguardassalvaguardas
!
T-%!%-2:-6I-(*-%!%'!.-(-.&'(#Q-$W!-*',8%!*'!4)(!%I!'M#%&'$.#-W!4)(!%I!'O#.-.#-! O('$&'!-2! (#'%6)!UI'!4('&'$*'$!.)$FI(-(D!T-!%-2:-6I-(*-!#*'-2!'%!@SSt!'O#.-QW!2)!UI'!#,42#.-!UI'[!
!" '%!&'5(#.-,'$&'!#*5$'-!
!" '%&8!4'(O'.&-,'$&'!*'%42'6-*-W!.)$O#6I(-*-!J!,-$&'$#*-!
!" %'!',42'-!%#',4('!
!" 'M#%&'$!4().'*#,#'$&)%!.2-()%!*'!I%)!$)(,-2!J!'$!.-%)!*'!#$.#*'$.#-%!
!" 2)%!I%I-(#)%!'%&8$!O)(,-*)%!J!.)$.#'$.#-*)%!
!" 'M#%&'$!.)$&()2'%!UI'!-:#%-$!*'!4)%#12'%!O-22)%!
L$&('!I$-!'O#.-.#-!*'2!St!4-(-!-UI'22-%!UI'!'%&8$!*'!-*)($)!J!'2!@SSt!4-(-!-UI'22-%!UI'!%)$!4'(O'.&-%W!%'!'%&#,-(8!I$!6(-*)!*'!'O#.-.#-!('-2!'$!.-*-!.-%)!.)$.('&)D!
"-6'(#&!:'(%#5$!<! ! Z'-2#Q-.#5$!*'2!-$82#%#%!J!6'%$!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!<G!?*'!@ABC!
2.1.6. Revisión del paso 4: impacto residual
]#!%'!V-$!V'.V)!&)*)%!2)%!*'1'('%!-!2-!4'(O'..#5$W!'2!#,4-.&)!('%#*I-2!*'1'!%'(!*'%4('.#-12'D!
]#!V-J!*'1'('%!-!,'*#)!V-.'(!?$)(,-%!#,4('.#%-%W!4().'*#,#'$&)%!#$.),42'&)%W!%-2:-6I-(*-%!#$g-*'.I-*-%!)!#$%IO#.#'$&'%W!)!.)$&()2'%!UI'!$)!.)$&()2-$C!'$&)$.'%!%'!*#.'!UI'!'2!%#%&',-!4'(,-g$'.'!%),'&#*)!-!I$!#,4-.&)!('%#*I-2D!
L2!.82.I2)!*'2!#,4-.&)!('%#*I-2!'%!%'$.#22)D!3),)!$)!V-$!.-,1#-*)!2)%!-.&#:)%W!$#!%I%!*'4'$*'$g.#-%W!%#$)!%)2-,'$&'! 2-!,-6$#&I*!*'! 2-!*'6(-*-.#5$W!%'!('4#&'$! 2)%!.82.I2)%!*'! #,4-.&)!.)$!'%&'!$I':)!$#:'2!*'!*'6(-*-.#5$D!
T-!,-6$#&I*!*'!2-!*'6(-*-.#5$!&),-$*)!'$!.I'$&-!2-!'O#.-.#-!*'!2-%!%-2:-6I-(*-%W!'%!2-!4()4)(g.#5$!UI'!('%&-!'$&('!2-!'O#.-.#-!4'(O'.&-!J!2-!'O#.-.#-!('-2D!
L2! #,4-.&)!('%#*I-2!4I'*'!.-2.I2-(%'!-.I,I2-*)!%)1('!2)%!-.&#:)%!#$O'(#)('%W!)!('4'(.I&#*)!%)1('!2)%!-.&#:)%!%I4'(#)('%D!
2.1.7. Revisión del paso 5: riesgo residual
]#!%'!V-$!V'.V)!&)*)%!2)%!*'1'('%!-!2-!4'(O'..#5$W!'2!(#'%6)!('%#*I-2!*'1'!%'(!*'%4('.#-12'D!
]#!V-J!*'1'('%!-!,'*#)!V-.'(!?$)(,-%!#,4('.#%-%W!4().'*#,#'$&)%!#$.),42'&)%W!%-2:-6I-(*-%!#$g-*'.I-*-%!)!#$%IO#.#'$&'%W!)!.)$&()2'%!UI'!$)!.)$&()2-$C!'$&)$.'%!%'!*#.'!UI'!'2!%#%&',-!4'(,-g$'.'!%),'&#*)!-!I$!(#'%6)!('%#*I-2D!
L2!.82.I2)!*'2!(#'%6)!('%#*I-2!'%!%'$.#22)D!3),)!$)!V-$!.-,1#-*)!2)%!-.&#:)%W!$#!%I%!*'4'$*'$.#-%W!%#$)!%)2-,'$&'!2-!,-6$#&I*!*'!2-!*'6(-*-.#5$!J!2-!O('.I'$.#-!*'!2-%!-,'$-Q-%W!%'!('4#&'$!2)%!.82g.I2)%!*'!(#'%6)!I%-$*)!'2!#,4-.&)!('%#*I-2!J!2-!$I':-!&-%-!*'!).I(('$.#-D!
T-!,-6$#&I*!*'!2-!*'6(-*-.#5$!%'!&),-!'$!.)$%#*'(-.#5$!'$!'2!.82.I2)!*'2!#,4-.&)!('%#*I-2D!
T-!,-6$#&I*!*'!2-!O('.I'$.#-!&),-$*)!'$!.I'$&-!2-!'O#.-.#-!*'!2-%!%-2:-6I-(*-%W!'%!2-!4()4)(.#5$!UI'!('%&-!'$&('!2-!'O#.-.#-!4'(O'.&-!J!2-!'O#.-.#-!('-2D!
L2!(#'%6)!('%#*I-2!4I'*'!.-2.I2-(%'!-.I,I2-*)!%)1('!2)%!-.&#:)%!#$O'(#)('%W!)!('4'(.I&#*)!%)1('!2)%!-.&#:)%!%I4'(#)('%D!
2.2. Gestión de Riesgos L2!-$82#%#%!*'!(#'%6)%!*'&'(,#$-!#,4-.&)%!J!(#'%6)%D!T)%!#,4-.&)%!('.)6'$!*-c)%!-1%)2I&)%W!#$*'g4'$*#'$&','$&'!*'!UI'!%'-!,8%!)!,'$)%!4()1-12'!UI'!%'!*;!2-!.#(.I$%&-$.#-D!L$!.-,1#)!'2!(#'%g6)!4)$*'(-!2-!4()1-1#2#*-*!*'!UI'!).I((-D!L2!#,4-.&)!('O2'F-!'2!*-c)!4)%#12'W!,#'$&(-%!UI'!'2!(#'%g6)!('O2'F-!'2!*-c)!4()1-12'D!
]#!'2!#,4-.&)!J!'2!(#'%6)!('%#*I-2'%!%)$!*'%4('.#-12'%W!%'!V-!&'(,#$-*)D!]#!$)W!V-J!UI'!V-.'(!-26)D!
2.2.1. La interpretación de los valores de impacto y riesgo residuales
H,4-.&)!J!(#'%6)!('%#*I-2!%)$!I$-!,'*#*-!*'2!'%&-*)!4('%'$&'W!'$&('!2-!#$%'6I(#*-*!4)&'$.#-2!?%#$!%-2:-6I-(*-!-26I$-C!J!2-%!,'*#*-%!-*'.I-*-%!UI'!('*I.'$!#,4-.&)!J!(#'%6)!-!:-2)('%!*'%4('.#-g12'%D!])$!4I'%!I$-!,;&(#.-!*'!.-('$.#-%D!
T)%!48((-O)%!%#6I#'$&'%!%'!('O#'('$!.)$FI$&-,'$&'!-!#,4-.&)!J!(#'%6)D!
]#!'2!:-2)(!('%#*I-2!'%!#6I-2!-2!:-2)(!4)&'$.#-2W!2-%!%-2:-6I-(*-%!'M#%&'$&'%!$)!:-2'$!4-(-!$-*-W!&R4#g.-,'$&'!$)!4)(UI'!$)!V-J-!$-*-!V'.V)W!%#$)!4)(UI'!V-J!'2','$&)%!OI$*-,'$&-2'%!%#$!V-.'(D!!
]#! '2! :-2)(! ('%#*I-2! '%! *'%4('.#-12'W! J-! '%&8D!L%&)! $)! UI#'('! *'.#(! *'%.I#*-(! 2-! 6I-(*#-h! 4'()! %#!-O()$&-(!'2!*R-!.)$!.#'(&-!.)$O#-$Q-@KD!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
@K!\)$!sI#F)&'!?3-4R&I2)!nC!22-,-1-!2-!-&'$.#5$!%)1('!'2!j182%-,)!*'!e#'(-1(8%k!UI'!j'%!I$!182%-,)!DDD!.)$!'2!.I-2!$)!V-J!UI'!&'$'(!&',)(!-!2-!,I'(&'W!$#!V-J!4'$%-(!,)(#(!*'!O'(#*-!-26I$-D!j!7)!4I'*'!'2!('%4)$g%-12'!*'!%'6I(#*-*!.-'(!'$!2-!.)$O#-$Q-!.#'6-!4I'%!2)%!%#%&',-%!':)2I.#)$-$W!2)%!-&-.-$&'%!#$:'$&-$W!2)%!
"-6'(#&!:'(%#5$!<! ! Z'-2#Q-.#5$!*'2!-$82#%#%!J!6'%$!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!<K!?*'!@ABC!
"#'$&(-%!'2!:-2)(!('%#*I-2!%'-!,8%!UI'!*'%4('.#-12'W!V-J!I$-!.#'(&-!'M4)%#.#5$D!
L%!#,4)(&-$&'!'$&'$*'(!UI'!I$!:-2)(!('%#*I-2!'%!%52)!I$!$0,'()D!/-(-!%I!.)(('.&-!#$&'(4('&-.#5$!*'1'!:'$#(!-.),4-c-*)!*'!2-!('2-.#5$!*'!2)!UI'!%'!*'1'(R-!V-.'(!J!$)!%'!V-!V'.V)D!T)%!('%4)$g%-12'%! *'! 2-! &),-!*'! *'.#%#)$'%! *'1'(8$! 4('%&-(! .I#*-*)%-! -&'$.#5$! -! '%&-! ('2-.#5$! *'! &-('-%!4'$*#'$&'%W!UI'!%'!*'$),#$-!Informe de InsuficienciasD!
2.2.2. Selección de salvaguardas
T-%!-,'$-Q-%!V-J!UI'!.)$FI(-(2-%W!4)(!4(#$.#4#)!J!,#'$&(-%!$)!%'!FI%&#O#UI'!2)!.)$&(-(#)D!
i-J!UI'!42-$#O#.-(!'2! .)$FI$&)!*'!%-2:-6I-(*-%!4'(&#$'$&'%!4-(-!-&-F-(! &-$&)!'2! #,4-.&)!.),)!'2!(#'%6)W! ('*I.#'$*)!1#'$! 2-!*'6(-*-.#5$!*'2!-.&#:)! ?,#$#,#Q-$*)!'2!*-c)CW!1#'$! ('*I.#'$*)! 2-! O('g.I'$.#-!*'!2-!-,'$-Q-!?,#$#,#Q-$*)!%I%!)4)(&I$#*-*'%CD!
`)*-!-,'$-Q-!*'1'!%'(!.)$FI(-*-!4()O'%#)$-2,'$&'W!2)!UI'!UI#'('!*'.#(!UI'!V-J!UI'[!
@D! '%&-12'.'(!I$-!4)2R&#.-!*'!2-!E(6-$#Q-.#5$!-2!('%4'.&)h!)!%'-W!I$-%!*#('.&(#.'%!6'$'(-2'%!*'!UI#;$!'%!('%4)$%-12'!*'!.-*-!.)%-!
<D! '%&-12'.'(!I$-!$)(,-h!)!%'-W!I$)%!)1F'&#:)%!-!%-&#%O-.'(!4-(-!4)*'(!*'.#(!.)$!4()4#'*-*!UI'!2-!-,'$-Q-!V-!%#*)!.)$FI(-*-!
>D! '%&-12'.'(!I$)%!4().'*#,#'$&)%h!)!%'-W!#$%&(I..#)$'%!4-%)!-!4-%)!*'!UI;!V-J!UI'!V-.'(!
BD! *'%42'6-(!%-2:-6I-(*-%!&;.$#.-%!UI'!'O'.&#:-,'$&'!%'!'$O('$&'$!-!2-%!-,'$-Q-%!.)$!.-4-g.#*-*!4-(-!.)$FI(-(2-%!
AD! *'%42'6-(!.)$&()2'%!UI'!4'(,#&-$!%-1'(!UI'!&)*)!2)!-$&'(#)(!'%&8!OI$.#)$-$*)!%'60$!2)!4('g:#%&)!
+!'%&'!.)$FI$&)!*'!'2','$&)%!%'!2'!'$.-%#22-!V-1#&I-2,'$&'!1-F)!'2!$),1('!*'!]#%&',-!*'!^'%$!*'!2-!]'6I(#*-*!*'!2-!H$O)(,-.#5$!?]^]HCW!-I$UI'!%'!'%&8!6'%&#)$-$*)!&-$&)!.),)!-.&I-$*)D!
L2!48((-O)!-$&'(#)(!4I'*'!22-,-(!-!'$6-c)!%#!'2!2'.&)(!#$&'(4('&-!UI'!V-J!UI'!22':-(!-!.-1)!&)*)%!J!.-*-!I$)!*'!2)%!4I$&)%!4-(-!.-*-!-,'$-Q-D!7)D!L$!2-!4(8.&#.-!2)!*#.V)!%'!&(-*I.'!'$!*'%-(()22-(!I$-!4)2R&#.-W!I$-%!$)(,-%!J!I$)%!4().'*#,#'$&)%! FI$&)!.)$!'2!*'%42#'6I'!*'!I$-!%'(#'!*'!%-2:-g6I-(*-%!J!.)$&()2'%!JW!-V)(-!%RW!:'(#O#.-(!UI'!&)*-%!J!.-*-!I$-!*'!2-%!-,'$-Q-%!&#'$'$!I$-!('%g4I'%&-!-*'.I-*-D!
\'!2)%!4I$&)%!-$&'(#)('%W!'2!,8%!j-1#'(&)k!'%!'2!*'!*'&'(,#$-.#5$!*'!2-%!%-2:-6I-(*-%!-4()4#-*-%D!L%! ('-2,'$&'!I$!-(&'!UI'! ('UI#'('!4'(%)$-2!'%4'.#-2#Q-*)!-I$UI'!'$! 2-!4(8.&#.-! 2-%!%#&I-.#)$'%!,8%!V-1#&I-2'%!'%&8$!4'(O'.&-,'$&'!*).I,'$&-*-%!'$!2-!2#&'(-&I(-!J!1-%&-!'2'6#(!*'!'$&('!I$!.-&8g2)6)!'$!OI$.#5$!*'!2-!,-6$#&I*!*'2!(#'%6)D!
Tipos de salvaguardas
9$!%#%&',-!*'1'!.)$%#*'(-(!4(#)(#&-(#-,'$&'!2-%!%-2:-6I-(*-%!*'!)!4(':'$&#:)!UI'!1I%.-$!UI'!2-!-,'$-Q-!$)!).I((-!)!%I!*-c)!%'-!*'%4('.#-12'D!L%!*'.#(W!#,4'*#(!#$.#*'$&'%!)!-&-UI'%D!
L$!2-!4(8.&#.-W!$)!&)*)!'%!4(':#%#12'W!$#!&)*)!2)!4(':#%#12'!'%!'.)$5,#.-,'$&'!(-Q)$-12'!-&-F-(2)!'$!%I%!)(R6'$'%D!`-$&)!4-(-!'$O('$&-(! 2)!*'%.)$).#*)!.),)!4-(-!4()&'6'(%'!*'!-UI'22)!-!2)!UI'!%'!4'(,-$'.'!'M4I'%&)W!'%!$'.'%-(#)!*#%4)$'(!*'!'2','$&)%!UI'!*'&'.&'$!'2!#$#.#)!*'!I$!#$.#*'$&'!J!4'(,#&-$!('-..#)$-(!.)$!4('%&'Q-!#,4#*#'$*)!UI'!%'!.)$:#'(&-!'$!I$!*'%-%&('D!
`-$&)! 2-%!,'*#*-%! 4(':'$&#:-%! .),)! 2-%! *'! ','(6'$.#-! -*,#&'$!I$-! .#'(&-!*'6(-*-.#5$!*'! 2)%!-.&#:)%!4)(! 2)!UI'!V-1(8!UI'!*#%4)$'(!4)(!02&#,)!*'!,'*#*-%!*'! ('.I4'(-.#5$!UI'!*':I'2:-$!'2!:-2)(!4'(*#*)!4)(!2)%!-.&#:)%D!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
I%I-(#)%!%)$!#,4('*'.#12'%!'$!%I%!'(()('%!J!'$!*'O#$#&#:-!%#',4('!V-J!UI'!'%&-(!-&'$&)!J!4()$&)!-!('-.g.#)$-(!-$&'!$I':-%!('-2#*-*'%D!
"-6'(#&!:'(%#5$!<! ! Z'-2#Q-.#5$!*'2!-$82#%#%!J!6'%$!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!<N!?*'!@ABC!
L%!*'!%'$&#*)!.),0$!#$&'$&-(!-.&I-(!*'!O)(,-!4(':'$&#:-!4-(-!UI'!2-%!.)%-%!$)!4I'*-$!).I((#(!)!$)!4I'*-$!.-I%-(!,I.V)!*-c)h!4'()!$)!%#',4('!'%!4)%#12'@N!J!V-J!UI'!'%&-(!4('4-(-*)%!4-(-!UI'!).I((-$D!T)!UI'!$)!*'1'!%'(!*'!$#$6I$-!,-$'(-!'%!UI'!I$!-&-UI'!4-%'!#$-*:'(&#*)[!V-J!UI'!*'g&'.&-(2)W!('6#%&(-(2)!J!('-..#)$-(!4(#,'()!.)$!I$!42-$!*'!','(6'$.#-!?UI'!4-('!J!2#,#&'!'2!#$.#*'$&'C!J!*'%4I;%!.)$!I$!42-$!*'!.)$&#$I#*-*!J!('.I4'(-.#5$!4-(-!('6('%-(!-!*)$*'!%'!*'1'!'%&-(D!
/)(!02&#,)W!%#$!8$#,)!*'!%-&I(-(!-2!2'.&)(W!V-J!UI'!('.)(*-(!UI'!.)$:#'$'!22'6-(!-!I$!.#'(&)!'UI#2#g1(#)!'$&('!
salvaguardas técnicas:!'$!-42#.-.#)$'%W!'UI#4)%!J!.),I$#.-.#)$'%!
salvaguardas físicas:!4()&'6#'$*)!'2!'$&)($)!*'!&(-1-F)!*'!2-%!4'(%)$-%!J!2)%!'UI#4)%!
medidas de organización: *'!4(':'$.#5$!J!6'%$!*'!2-%!#$.#*'$.#-%!
política de personal:!UI'W!-!O#$!*'!.I'$&-%W!'%!'2!'%2-15$!#,4('%.#$*#12'!J!,8%!*'2#.-*)[!4)2Rg&#.-!*'!.)$&(-&-.#5$W!O)(,-.#5$!4'(,-$'$&'W!E(6-$#Q-.#5$!*'!('4)(&'!*'!#$.#*'$.#-%W!42-$!*'!('-..#5$!J!,'*#*-%!*#%.#42#$-(#-%D!
2.2.3. Pérdidas y ganancias
L%!*'!%'$&#*)!.),0$!UI'!$)!%'!4I'*'!#$:'(&#(!'$!%-2:-6I-(*-%!,8%!-228!*'2!:-2)(!*'!2)%!4()4#)%!-.&#:)%!-!4()&'6'(D!
+4-('.'$!'$!2-!4(8.&#.-!6(8O#.)%!.),)!'2!%#6I#'$&'!UI'!4)$'$!I$)!O('$&'!-2!)&()!'2!.)%&'!*'!2-!#$g%'6I(#*-*!?2)!UI'!.)%&-(R-!$)!'%&-(!4()&'6#*)%C!J!'2!.)%&'!*'!2-%!%-2:-6I-(*-%D!
S @S <S >S BS AS GS KS NS PS @SS
grado de seguridad
(#'%6)!('%#*I-2 6-%&)!'$!%-2:-6I-(*-% .)%&'!&)&-2!
L%&'!)!*'!6(8O#.-%!#$&'$&-$!('O2'F-(!.5,)!-2!-:-$Q-(!*'!I$!6(-*)!*'!%'6I(#*-*!S!V-.#-!I$!6(-*)!*'!%'6I(#*-*!*'2!@SStW!'2!.)%&'!*'!2-!#$%'6I(#*-*!?'2!(#'%6)C!*#%,#$IJ'W!,#'$&(-%!UI'!'2!.)%&'!*'!2-!#$:'(%#5$!'$!%-2:-6I-(*-%!-I,'$&-D!L%!#$&'$.#)$-*)!'2!V'.V)!*'!UI'!'2!(#'%6)!.-#6-!OI'(&','$g&'!.)$!4'UI'c-%!#$:'(%#)$'%@P!J!UI'!'2!.)%&'!*'!2-%!#$:'(%#)$'%!%'!*#%4-('!4-(-!-2.-$Q-(!$#:'2'%!*'!%'6I(#*-*!.'(.-$)%!-2!@SSt<SD!T-!.I(:-!.'$&(-2!%I,-!'2!.)%&'!4-(-!2-!E(6-$#Q-.#5$W!1#'$!*'(#g
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
@N!i-J!,#2! (-Q)$'%!UI'!4I'*'$! #,4'*#(!I$-!4()&'..#5$!-1%)2I&-[!.)%&'W!*#O#.I2&-*! &;.$#.-W! 2R,#&'%! 2'6-2'%W!'&.D!7)!)1%&-$&'W!I$-!*'!2-%!(-Q)$'%!,8%!OI'(&'%!4-(-!$)!4)*'(!4(':'$#(!'%!'2!,'()!*'%.)$).#,#'$&)!*'!2)!UI'!4I'*'!4-%-(D!/)*',)%!4(':'(!UI'!%'!('4#&-!2)!UI'!V-!).I((#*)!'$!'2!4-%-*)h!4'()!'%!*#OR.#2!4(':'(!'2!4(5M#,)!-&-UI'!#$&'$.#)$-*)!4I'%!V-J!I$!.),4)$'$&'!.('-&#:)!*'!4-(&'!*'2!-&-.-$&'D!
@P!"'*#*-%!18%#.-%!*'!%'6I(#*-*!%I4)$'$!I$!#,4)(&-$&'!*'%.'$%)!*'2!(#'%6)D!/)(!'22)!%)$!#$'M.I%-12'%D!<S!Z'O2'F-$*)!I$-!:'Q!,8%!UI'!2-!%'6I(#*-*!-1%)2I&-!?(#'%6)!.'()C!$)!'M#%&'D!
"-6'(#&!:'(%#5$!<! ! Z'-2#Q-.#5$!*'2!-$82#%#%!J!6'%$!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!<P!?*'!@ABC!
:-*)!*'2! (#'%6)! ?1-F-! %'6I(#*-*CW! 1#'$! *'(#:-*)!*'! 2-! #$:'(%#5$! '$! 4()&'..#5$D!\'!-26I$-! O)(,-!'M#%&'!I$!4I$&)!*'!'UI#2#1(#)!'$&('!2)!UI'!%'!-((#'%6-!J!2)!UI'!%'!#$:'(&'!'$!*'O'$%-W!4I$&)!-2!UI'!V-J!UI'!&'$*'(!%#!2-!0$#.-!.)$%#*'(-.#5$!'%!'.)$5,#.-D!
/'()!22':-(!'2!%'$&#*)!.),0$!-!2-!4(8.&#.-!$)!'%!':#*'$&'W!$#!4)(!2-!4-(&'!*'2!.82.I2)!*'2!(#'%6)W!$#!4)(!2-!4-(&'!*'2!.82.I2)!*'2!.)%&'!*'!2-%!%-2:-6I-(*-%D!L$!)&(-%!4-2-1(-%W!2-!.I(:-!-$&'(#)(!'%!.)$g.'4&I-2!J!$)!%'!4I'*'!*#1IF-(!'$!I$!.-%)!('-2D!
L$!2-!4(8.&#.-W!.I-$*)!V-J!UI'!4()&'6'(%'!*'!I$!(#'%6)!UI'!%'!.)$%#*'(-!%#6$#O#.-&#:)W!-4-('.'$!:-(#)%!'%.'$-(#)%!V#4)&;&#.)%[!
E0: %#!$)!%'!V-.'!$-*-!
E1: %#!%'!-42#.-!I$!.#'(&)!.)$FI$&)!*'!%-2:-6I-(*-%!
E2: %#!%'!-42#.-!)&()!.)$FI$&)!*'!%-2:-6I-(*-%!
o!-%R!7!'%.'$-(#)%!.)$!*#O'('$&'%!.),1#$-.#)$'%!*'!%-2:-6I-(*-%D!
L2!-$82#%#%!'.)$5,#.)!&'$*(8!.),)!,#%#5$!*'.#*#(!'$&('!'%&-%!)4.#)$'%W!%#'$*)!LS!?$)!V-.'(!$-*-C!I$-!)4.#5$!4)%#12'W!UI'!4I*#'(-!'%&-(!FI%&#O#.-*-!'.)$5,#.-,'$&'D!
L$!.-*-!'%.'$-(#)!V-J!UI'!'%&#,-(!-!2)! 2-(6)!*'2!&#',4)!'2!.)%&'!UI'!:-!-!%I4)$'(D!/-(-!4)*'(!-6('6-(!.)%&'%W!%'!.)$&-1#2#Q-$!.),)!:-2)('%!$'6-&#:)%!2-%!4;(*#*-%!*'!*#$'()!J!.),)!:-2)('%!4)g%#&#:)%!2-%!'$&(-*-%!*'!*#$'()D!3)$%#*'(-$*)!2)%!%#6I#'$&'%!.),4)$'$&'%[!
!! ?('.I(('$&'C!(#'%6)!('%#*I-2<@!
!! ?I$-!:'QC!.)%&'!*'!2-%!%-2:-6I-(*-%<<!
!! ?('.I(('$&'C!.)%&'!-$I-2!*'!,-$&'$#,#'$&)!*'!2-%!%-2:-6I-(*-%!
"! ?('.I(('$&'C!,'F)(-!'$!2-!4()*I.&#:#*-*<>!
"! ?('.I(('$&'C!,'F)(-%!'$!2-!.-4-.#*-*!*'!2-!E(6-$#Q-.#5$!4-(-!4('%&-(!$I':)%!%'(:#.#)%W!.)$%'6I#(!,'F)('%!.)$*#.#)$'%!*'! 2)%!4():''*)('%W!'$&(-(!'$!-%).#-.#5$!.)$!)&(-%!)(g6-$#Q-.#)$'%W!'&.D!
L2!'%.'$-(#)!LS!'%!,IJ!%#,42'[!&)*)%!2)%!-c)%!%'!-O()$&-!I$!6-%&)!,-(.-*)!4)(!'2!(#'%6)W!UI'!%'!-.I,I2-!-c)!&(-%!-c)D!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
<@!]#!2-!O('.I'$.#-!*'!2-%!-,'$-Q-%!%'!V-!'%&#,-*)!.),)!&-%-!-$I-2W!2)%!*-&)%!*'!(#'%6)!('%#*I-2!'%&-(8$!-I&),8&#.-,'$&'! -$I-2#Q-*)%D! ]#! %'! VI1#'(-! ',42'-*)! )&(-! '%.-2-W! V-1(R-! UI'! .)$:'(&#(2-! -! &;(,#$)%!-$I-2'%D!
<<!]#!2-!%-2:-6I-(*-!J-!'M#%&'W!.)%&'!*'!,'F)(-D!]#!$)!'M#%&#'(-W!.)%&'!*'!-*UI#%#.#5$!'!#$%&-2-.#5$D!L$!.I-2gUI#'(!.-%)!V-J!UI'!#,4I&-(!.)%&'%!*'!O)(,-.#5$!*'!2)%!)4'(-*)('%W!I%I-(#)%W!'&.D!
<>!L%&'!'4R6(-O'!4I'*'!%'(!4)%#&#:)!%#!2-!E(6-$#Q-.#5$!,'F)(-!%I!4()*I.&#:#*-*h!)!4I'*'!%'(!$'6-&#:)W!%#!',g4')(-D!3),)!'F',42)!&R4#.)!*'!%-2:-6I-(*-%!UI'!,'F)(-$!2-!4()*I.&#:#*-*!4)*',)%!.#&-(!2-!#$&()*I..#5$!*'!*#%4)%#&#:)%!*'!-I&'$&#.-.#5$!'$!%I%&#&I.#5$!*'!2-!.28%#.-!.)$&(-%'c-D!3),)!'F',42)!&R4#.)!*'!%-2:-g6I-(*-%!UI'!,#$)(-$!2-!4()*I.&#:#*-*!4)*',)%!.#&-(!2-!.2-%#O#.-.#5$!*'!*).I,'$&-.#5$!.)$!.)$&()2!*'!-.g.'%)!('%&(#$6#*)D!
"-6'(#&!:'(%#5$!<! ! Z'-2#Q-.#5$!*'2!-$82#%#%!J!6'%$!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!>S!?*'!@ABC!
L$!2)%!*',8%!'%.'$-(#)%W!V-J!.)%-%!UI'!%I,-$!J!.)%-%!UI'!('%&-$W!4I*#'$*)!*-(%'!:-(#-%!%#&I-g.#)$'%<B[!
gNS
gKS
gGS
gAS
gBS
g>S
g<S
g@S
S
@S
@ < > B A
LS
L@
L<
L>
!
!" L$!LS!%'!%-1'!2)!UI'!.-*-!-c)!?%'!'%&#,-!UI'C!%'!4#'(*'!
!" L2!'%.'$-(#)!L@!-4-('.'!.),)!,-2-!#*'-W!4I'%!%I4)$'!I$!6-%&)!-c-*#*)!'2!4(#,'(!-c)h!4'()!'%&'!6-%&)!$)!%'!('.I4'(-!'$!-c)%!:'$#*'()%D!
!" 7)!-%R! '2! '%.'$-(#)!L<!UI'W! %I4)$#'$*)!I$!,-J)(!*'%',1)2%)! #$#.#-2W! ',4#'Q-!-! %'(!('$&-12'!-!4-(&#(!*'2!.I-(&)!-c)D!
!" "8%!-&(-.&#:)!-0$!'%!'2!'%.'$-(#)!L>!'$!'2!UI'!-!.)%&-!*'!I$!,-J)(!*'%',1)2%)!#$#.#-2W!%'!',4#'Q-!-!-V)((-(!-2!&'(.'(!-c)W!'!#$.2I%)!%'!22'6-!-!)1&'$'(!1'$'O#.#)%!)4'(-&#:)%!-!4-(&#(!*'2!UI#$&)!-c)D!]'!4I'*'!*'.#(!UI'!'$!'%.'$-(#)!L>!%'!V-!V'.V)!I$-!1I'$-!#$g:'(%#5$D!
2.2.4. La actitud de la Dirección
T-!*#('..#5$!*'!2-!E(6-$#Q-.#5$!%),'&#*-!-2!-$82#%#%!*'!(#'%6)%!*'1'!*'&'(,#$-(!'2!$#:'2!*'!#,4-.g&)!J!(#'%6)!-.'4&-12'D!"8%!4()4#-,'$&'!*#.V)W!*'1'!-.'4&-(! 2-!('%4)$%-1#2#*-*!*'!2-%!#$%IO#.#'$g.#-%D!L%&-!*'.#%#5$!$)!'%!&;.$#.-D!/I'*'!%'(!I$-!*'.#%#5$!4)2R&#.-!)!6'('$.#-2!)!4I'*'!:'$#(!*'&'(g,#$-*-!4)(! 2'J!)!4)(! .),4(),#%)%! .)$&(-.&I-2'%! .)$!4():''*)('%!)!I%I-(#)%D!L%&)%!$#:'2'%!*'!-.'4&-.#5$!%'!4I'*'$!'%&-12'.'(!4)(!-.&#:)!)!4)(!-6('6-.#5$!*'!-.&#:)%!?'$!I$!*'&'(,#$-*)!*'g4-(&-,'$&)W!'$!I$!*'&'(,#$-*)!%'(:#.#)W!'$!I$-!*'&'(,#$-*-!*#,'$%#5$W!DDDC!
3I-2UI#'(! $#:'2! *'! #,4-.&)! Jd)! (#'%6)!'%!-.'4&-12'! %#! 2)! .)$).'!J!-.'4&-! O)(,-2,'$&'! 2-!\#('.g.#5$ "<AD!
]#!'2!#,4-.&)!Jd)!'2!(#'%6)!'%&8$!4)(!'$.#,-!*'!2)!-.'4&-12'W!%'!4I'*'[!
@D! '2#,#$-(!'2!-.&#:)h!%I'$-!,IJ!OI'(&'W!4'()!-!:'.'%!V-J!-.&#:)%!UI'W!%#,42','$&'W!$)!:-2'!2-!4'$-!,-$&'$'(<G!
<D! #$&()*I.#(!$I':-%!%-2:-6I-(*-%!)!,'F)(-(!2-!'O#.-.#-!*'!2-%!4('%'$&'%!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
<B!L$!'2!'F'!n!%'!,I'%&(-$!-c)%W!'$!('O'('$.#-!-2!-c)!S!'$!UI'!%'!('-2#Q-!'2!-$82#%#%!*'!(#'%6)%D!L$!)(*'$-g*-%!-4-('.'$!.)%&'%!'$!I$#*-*'%!-(1#&(-(#-%D!
<A!i-12-(!*'!\#('..#5$!'%!4'.-(!*'!%#,42#O#.-(!2-!('-2#*-*D!L$!#$62;%!%I'2'!',42'-(%'!'2!&;(,#$)!j%&-r'V)2g*'(%k!?)!&'$'*)('%!*'!2-!'%&-.-C!4-(-!('O'(#(%'!-!2)%!-O'.&-*)%!4)(!2-%!*'.#%#)$'%!'%&(-&;6#.-%!*'!I$-!E(g6-$#Q-.#5$[!*I'c)%W!6'('$&'%W!I%I-(#)%W!',42'-*)%!'!#$.2I%)!2-!%).#'*-*!'$!6'$'(-2D!/)(UI'!-2!O#$-2!%#!%'!-.'4&-$!(#'%6)%! #,4(I*'$&','$&'!'2':-*)%W!'2!4'(FI*#.-*)!4I'*'!$)!%'(!%52)!'2!UI'!*#(#6'W!%#$)!&)*)%!2)%!UI'! &#'$'$!%I!.)$O#-$Q-!4I'%&-!'$! 2-!E(6-$#Q-.#5$!J!.IJ)! 2-,'$&-12'!*'%',4'c)!)%.I('.'(R-!%I%!2'6R&#,-%!'M4'.&-&#:-%D!L$!02&#,-!#$%&-$.#-!4I'*'!:'(%'!-O'.&-*-!2-!.)$O#-$Q-!'$!I$!%'.&)(!)!'$!I$-!&'.g$)2)6R-!4)(!2-!#,4(I*'$&'!4I'%&-!'$!'%.'$-!*'!-26I$)%!-.&)('%D!
<G!X7'.'%#&-!('-2,'$&'!,-$&'$'(!'%&'!*-&)!*'!.-(8.&'(!4'(%)$-2!J!$#:'2!-2&)Y!XL%!('-2,'$&'!$'.'%-(#-!2-!('*!#$-28,1(#.-!'$!2-!)O#.#$-Y!
"-6'(#&!:'(%#5$!<! ! Z'-2#Q-.#5$!*'2!-$82#%#%!J!6'%$!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!>@!?*'!@ABC!
2.2.5. Revisión del paso 1: activos
+26I$-%! %-2:-6I-(*-%W! $)&-12','$&'! 2-%! *'! )! &;.$#.)W! %'! &(-*I.'$! '$! '2! *'%42#'6I'! *'!,8%!'UI#4-,#'$&)<K!UI'!%'!.)$:#'(&'!-!%I!:'Q!'$!I$!-.&#:)!*'2!%#%&',-D!L%&)%!-.&#:)%!%)4)(&-$!4-(&'!*'2!:-2)(!*'2!%#%&',-!J!'%&8$!-!%I!:'Q!%IF'&)%!-!-,'$-Q-%!UI'!4I'*'$!4'(FI*#.-(!-!2)%!-.&#:)%!*'!:-2)(D!
i-J!4I'%!UI'!('4'&#(!'2!-$82#%#%!*'!(#'%6)%W!-,42#8$*)2)!.)$!'2!$I':)!*'%42#'6I'!*'!,'*#)%!JW!4)(!%I4I'%&)W!.'(.#)(-(%'!*'!UI'!'2!(#'%6)!*'2!%#%&',-!-,42#-*)!'%!,'$)(!UI'!'2!*'2!%#%&',-!)(#6#$-2h!'%!*'.#(W!UI'!2-%!%-2:-6I-(*-%!'O'.&#:-,'$&'!*#%,#$IJ'$!'2!'%&-*)!*'!(#'%6)!*'!2-!E(6-$#Q-.#5$D!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
<K!LF',42)%!&R4#.)%!4I'*'$!%'(!I$!'UI#4)!.)(&-OI'6)%W!I$!%#%&',-!*'!6'%$!*'!('*'%!4(#:-*-%!:#(&I-2'%W!&-(F'&-%!#$&'2#6'$&'%!*'!#*'$&#O#.-.#5$!*'!2)%!I%I-(#)%W!I$-!/uH!*'!.2-:'!4012#.-W!'&.D!
"-6'(#&!:'(%#5$!<! ! L%&(I.&I(-.#5$!*'2!4()J'.&)!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!><!?*'!@ABC!
3. Estructuración del proyecto ]#!'$!'2!.-4R&I2)!-$&'(#)(!%'!V-!,-(.-*)!*'!O)(,-!.)$.'4&I-2!.5,)!22':-(!-!.-1)!I$!-$82#%#%!J!I$-!6'%$!*'!(#'%6)%W!'$!'%&'!.-4#&I2)!%'!42-%,-$!-UI'22)%!.)$.'4&)%!'$!.),4)$'$&'%!*'!I$!4()gJ'.&)!*'!-$82#%#%!J!6'%$!*'!(#'%6)%!?+^ZC<ND!T)%!4-%)%!%'!)(6-$#Q-$!'$!&('%!6(-$*'%!4().'%)%!?4('4-(-.#5$W!-$82#%#%!J!6'%$CD!3-*-!4().'%)!%'!)(6-$#Q-!'$!-.&#:#*-*'%!UI'W!O#$-2,'$&'W!%'!'%g&(I.&I(-$!'$!&-('-%!-!('-2#Q-(D!L$!.-*-!&-('-!%'!#$*#.-!2)!UI'!V-J!UI'!V-.'(!-%R!.),)!2-%!4)%#12'%!*#O#.I2&-*'%!4-(-!.)$%'6I#(2)!J!2-!O)(,-!*'!-O()$&-(2-!.)$!;M#&)<PD!L$!.-*-!4().'%)!%'!#$*#.-$!2)%!V#&)%!UI'!:-$!,-(.-$*)!'2!4()6('%)!*'2!4()J'.&)!V-%&-!%I!&'(,#$-.#5$D!
"-6'(#&!.I1('!I$!'%4'.&()!,IJ!-,42#)!*'!#$&'('%'%!*'!%I%!I%I-(#)%D!L$!'2!42-$&'-,#'$&)!*'!'%&-%!6IR-%!%'!V-!%'6I#*)!I$!.(#&'(#)!j*'!,8M#,)%kW!('O2'F-$*)!&)*)!)!*'!-.&#:)%W!&)*)!)!*'!-%4'.g&)%!*'!%'6I(#*-*W! &)*)! )!*'!%#&I-.#)$'%W!'$!*'O#$#&#:-D!L$! 2-!4(8.&#.-W!'2!I%I-(#)!4I'*'!'$.)$g&(-(%'!-$&'!%#&I-.#)$'%!*)$*'!'2!-$82#%#%!'%!,8%!('%&(#$6#*)D!]#6I'$!-26I$)%!.-%)%!4(8.&#.)%!O('g.I'$&'%[!
!" %52)!%'!('UI#'('!I$!'%&I*#)!*'!2)%!O#.V'()%!-O'.&)%!-!2-!2'6#%2-.#5$!*'!*-&)%!*'!.-(8.&'(!4'(%)$-2!
!" %52)!%'!('UI#'('!I$!'%&I*#)!*'!2-%!6-(-$&R-%!*'!.)$O#*'$.#-2#*-*!*'!2-!#$O)(,-.#5$!
!" %52)!%'!('UI#'('!I$!'%&I*#)!*'!2-!%'6I(#*-*!*'!2-%!.),I$#.-.#)$'%!
!" %52)!%'!('UI#'('!I$!'%&I*#)!*'!2-!%'6I(#*-*!4'(#,'&(-2!
!" %52)!%'!('UI#'('!I$!'%&I*#)!*'!2-!*#%4)$#1#2#*-*!*'!2)%!%'(:#.#)%!?&R4#.-,'$&'!4)(UI'!%'!1I%.-!'2!*'%-(()22)!*'!I$!42-$!*'!.)$&#$6'$.#-C!
!" %'!1I%.-!I$-!V),)2)6-.#5$!)!-.('*#&-.#5$!*'2!%#%&',-!)!*'!I$!4()*I.&)!
!" %'!1I%.-!2-$Q-(!I$!4()J'.&)!*'!,;&(#.-%!*'!%'6I(#*-*W!*'1#'$*)!#*'$&#O#.-(!UI;!4I$&)%!#$&'('%-!.)$&()2-(!J!.)$!UI;!6(-*)!*'!4'(#)*#.#*-*!J!*'&-22'!
!" '&.D!
L%&-%!%#&I-.#)$'%W!O('.I'$&'%W!%'!('.)6'$!O)(,-2,'$&'!'$!2-%!&-('-%!*'!2-!-.&#:#*-*!+@D<!'!#$O)(g,-2,'$&'!.),'$&-$*)!UI'!'%!.)$%&(I.&#:)!.'$&(-(%'!'$!I$!*),#$#)!('*I.#*)!'!#(!-,42#-$*)!'$!2-!,'*#*-!*'!2-%!$'.'%#*-*'%W!-$&'%!UI'!-O()$&-(!2-!&)&-2#*-*D!!
+*',8%!*'!.I1(#(!I$!*),#$#)!,8%!)!,'$)%!'M&'$%)W!4I'*'$!*-(%'!%#&I-.#)$'%!'$!2-%!UI'!%'!('gUI#'('$!-$82#%#%!*'!*#O'('$&'!.-2-*)[!
!" I$!-$82#%#%!I(6'$&'!4-(-!*'&'(,#$-(!2)%!-.&#:)%!.(R&#.)%!
!" I$!-$82#%#%!62)1-2!4-(-!*'&'(,#$-(!2-%!,'*#*-%!6'$'(-2'%!
!" I$!-$82#%#%!*'!*'&-22'!4-(-!*'&'(,#$-(!%-2:-6I-(*-%!'%4'.RO#.-%!4-(-!.#'(&)%!'2','$&)%!*'2!%#%&',-!*'!#$O)(,-.#5$!
!" I$!-$82#%#%!*'!*'&-22'!.I-$&#&-&#:)!4-(-!*'&'(,#$-(!2-!)4)(&I$#*-*!*'!I$!6-%&)!'2':-*)!
!" DDD!
L$!('%I,'$W!2-%!&-('-%!UI'!-!.)$&#$I-.#5$!%'!*'&-22-$!V-J!UI'!-*-4&-(2-%!
@D! V)(#Q)$&-2,'$&'!-2!-2.-$.'!UI'!%'!('UI#'('!?-.&#:#*-*!+@D<C!
<D! :'(&#.-2,'$&'!-!2-!4()OI$*#*-*!)4)(&I$-!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
<N!3)(('%4)$*'!-2!j")*'2)!*'!4().'%)%k!*'!"-6'(#&!:'(%#5$!@DSD!<P!L$!'2!.-4R&I2)!G!%'!#$.2IJ'$!.)$%'F)%!4(8.&#.)%!-*#.#)$-2'%D!
"-6'(#&!:'(%#5$!<! ! L%&(I.&I(-.#5$!*'2!4()J'.&)!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!>>!?*'!@ABC!
3.1. Participantes \I(-$&'! '2! *'%-(()22)! *'2! 4()J'.&)!+^ZW! *'%*'! %I! #$#.#)! -! %I! &'(,#$-.#5$W! %'! #*'$&#O#.-$! 2)%! %#g6I#'$&'%!5(6-$)%!.)2'6#-*)%>S[!
Comité de Dirección
L2!4'(O#2!('UI'(#*)!4-(-!'%&'!6(I4)!*'!4-(&#.#4-$&'%!#$.2IJ'!-!4'(%)$-%!.)$!I$!$#:'2!-2&)!'$!2-!*#('..#5$!*'!2-!E(6-$#Q-.#5$W!.)$).#,#'$&)!*'!2)%!)1F'&#:)%!'%&(-&;6#.)%!J!*'!$'6).#)!UI'!%'!4'(%#6I'$!J!-I&)(#*-*!4-(-!:-2#*-(!J!-4()1-(!.-*-!I$)!*'!2)%!4().'%)%!('-2#Q-*)%!*I(-$&'!'2!*'%-(()22)!*'2!4()J'.&)D!
T-%!('%4)$%-1#2#*-*'%!*'!'%&'!.),#&;!.)$%#%&'$!'$!
!" -%#6$-(!2)%!('.I(%)%!$'.'%-(#)%!4-(-!2-!'F'.I.#5$!*'2!4()J'.&)!
!" -4()1-(!2)%!('%I2&-*)%!O#$-2'%!*'!.-*-!4().'%)!
L2!.),#&;!*'!*#('..#5$!O)(,-2#Q-!%I%!OI$.#)$'%!'$!2-!&-('-!`@D>D<D!
Comité de Seguimiento
L%&8!.)$%&#&I#*)!4)(! 2)%!('%4)$%-12'%!*'! 2-%!I$#*-*'%!-O'.&-*-%!4)(!'2!4()J'.&)h!-%R!.),)!4)(! 2)%!('%4)$%-12'%!*'!2-!#$O)(,8&#.-!J!*'!2-!6'%$!*'$&()!*'!*#.V-%!I$#*-*'%D!`-,1#;$!%'(8!#,4)(&-$&'!2-!4-(&#.#4-.#5$!*'!2)%!%'(:#.#)%!.),I$'%!*'!2-!E(6-$#Q-.#5$!?42-$#O#.-.#5$W!4('%I4I'%&)W!('.I(%)%!VI,-$)%W!-*,#$#%&(-.#5$W!'&.DC!!L$!.I-2UI#'(!.-%)!2-!.),4)%#.#5$!*'2!.),#&;!*'4'$*'!*'!2-%!.-(-.&'(R%&#.-%!*'!2-%!I$#*-*'%!-O'.&-*-%D!
T-%!('%4)$%-1#2#*-*'%!*'!'%&'!.),#&;!.)$%#%&'$!'$!
!" ('%)2:'(!2-%!#$.#*'$.#-%!*I(-$&'!'2!*'%-(()22)!*'2!4()J'.&)!
!" -%'6I(-(!2-!*#%4)$#1#2#*-*!*'!('.I(%)%!VI,-$)%!.)$!2)%!4'(O#2'%!-*'.I-*)%!J!%I!4-(g&#.#4-.#5$!'$!2-%!-.&#:#*-*'%!*)$*'!'%!$'.'%-(#-!%I!.)2-1)(-.#5$!
!" -4()1-(!2)%!#$O)(,'%!#$&'(,'*#)%!J!O#$-2'%!*'!.-*-!4().'%)!
!" '2-1)(-(!2)%!#$O)(,'%!O#$-2'%!4-(-!'2!.),#&;!*'!*#('..#5$!
L2! .),#&;! *'! %'6I#,#'$&)! %'! .('-! '$! 2-! &-('-! `@D@D@! J! %I%! OI$.#)$'%! %'! O)(,-2#Q-$! '$!`@D>D<DD!!
Equipo de proyecto
e)(,-*)!4)(!4'(%)$-2!'M4'(&)!'$!&'.$)2)6R-%!J!%#%&',-%!*'!#$O)(,-.#5$!J!4'(%)$-2!&;.$#.)!.I-2#O#.-*)!*'2!*),#$#)!-O'.&-*)W!.)$!.)$).#,#'$&)%!*'!6'%$!*'!%'6I(#*-*!'$!6'$'(-2!J!*'!2-!-42#.-.#5$!*'!2-!,'&)*)2)6R-!*'!-$82#%#%!J!6'%$!*'!(#'%6)%!'$!4-(&#.I2-(D!]#!'2!4()J'.&)!%'!V-.'!.)$!-%#%&'$.#-!&;.$#.-!,'*#-$&'!.)$&(-&-.#5$!'M&'($-W!'2!%I1%#6I#'$&'!4'(%)$-2!'%g4'.#-2#%&-!'$!%'6I(#*-*!*'!%#%&',-%!*'!#$O)(,-.#5$!%'!#$&'6(-(8!'$!'%&'!'UI#4)!*'!4()J'.&)D!
T-%!('%4)$%-1#2#*-*'%!*'!'%&'!'UI#4)!.)$%#%&'$!'$!
!" 22':-(!-!.-1)!2-%!&-('-%!*'2!4()J'.&)!
!" ('.)4#2-(W!4().'%-(!J!.)$%)2#*-(!*-&)%!
!" '2-1)(-(!2)%!#$O)(,'%!
L2!'UI#4)!*'!4()J'.&)!%'!*'&'(,#$-!'$!2-!&-('-!`@D>D<D!
Grupos de Interlocutores
L%&8!O)(,-*)!4)(!I%I-(#)%!('4('%'$&-&#:)%!*'$&()!*'!2-%!I$#*-*'%!-O'.&-*-%!4)(!'2!4()J'.&)D!T)!.)$%&#&IJ'$!:-(#)%!4)%#12'%!%I16(I4)%[!
!" Z'%4)$%-12'%!*'!%'(:#.#)W!.)$%.#'$&'%!*'!2-!,#%#5$!*'!2-!E(6-$#Q-.#5$!J!%I%!'%&(-g&'6#-%!-!,'*#)!J!2-(6)!42-Q)!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
>S!L%!#,4)(&-$&'!O)(,-2#Q-(!2)%!()2'%!*'!2)%!4-(&#.#4-$&'%!'$!'2!4()J'.&)D!L$!'%&-!%'..#5$!%'!#*'$&#O#.-$!*#g.V)%!()2'%!J!%'!2'%!*-!I$!$),1('!'%&8$*-(D!"8%!-*'2-$&'!%'!*'&-22-!'$!UI;!,),'$&)!?&-('-C!*'2!4()J'.&)!%'!.)$%&#&IJ'$!O)(,-2,'$&'D!
"-6'(#&!:'(%#5$!<! ! L%&(I.&I(-.#5$!*'2!4()J'.&)!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!>B!?*'!@ABC!
!" Z'%4)$%-12'%!*'!%'(:#.#)%!#$&'($)%!
!" /'(%)$-2!*'!'M42)&-.#5$!J!)4'(-.#5$!*'!2)%!%'(:#.#)%!#$O)(,8&#.)%W!.)$%.#'$&'%!*'!2)%!,'*#)%!*'%42'6-*)%!?*'!4()*I..#5$!J!%-2:-6I-(*-%C!J!*'!2-%!#$.#*'$.#-%!V-1#&I-2'%!
T-%!I$#*-*'%!-O'.&-*-%!%'!*'&'(,#$-$!'$!2-%!&-('-%!`@D<D<!J!`@D<D>D!T)%!#$&'(2).I&)('%!*'!#*'$&#O#.-$!'$!2-!&-('-!`@D>D@D!
+*',8%!*'!*#.V)%!5(6-$)%!.)2'6#-*)%W!V-J!UI'!#*'$&#O#.-(!-26I$)%!()2'%!%#$6I2-('%[!
Promotor
L%!I$-!O#6I(-!%#$6I2-(!UI'!2#*'(-!2-%!4(#,'(-%!&-('-%!*'2!4()J'.&)W!4'(O#2-$*)!%I!)4)(&I$#*-*!J!-2.-$.'!4-(-!2-$Q-(!'2!4()J'.&)!+^Z!4()4#-,'$&'!*#.V)D!
\'1'!%'(!I$-!4'(%)$-!.)$!:#%#5$!62)1-2!*'!2)%!%#%&',-%!*'!#$O)(,-.#5$!J!%I!4-4'2!'$!2-%!-.g&#:#*-*'%!*'! 2-!E(6-$#Q-.#5$W!%#$!$'.'%#*-*!*'!.)$).'(! 2)%!*'&-22'%h!4'()!%#!-2! &-$&)!*'!2-%!#$.#*'$.#-%D!
L2!4(),)&)(!&#'$'!%I!4-4'2!'$!2-!&-('-!`@D@D@D!
Director del Proyecto
\'1'!%'(!I$!*#('.&#:)!*'!-2&)!$#:'2W!.)$!('%4)$%-1#2#*-*'%!'$!%'6I(#*-*!*'$&()!*'!2-!E(6-$#gQ-.#5$W!*'!%#%&',-%!*'!#$O)(,-.#5$!)W!'$!%I!*'O'.&)W!*'!42-$#O#.-.#5$W!*'!.))(*#$-.#5$!)!*'!,-&'(#-%W!%'(:#.#)%!)!8('-%!%','F-$&'%D!
L%!2-!.-1'Q-!:#%#12'!*'2!'UI#4)!*'!4()J'.&)D!
L2!*#('.&)(!*'2!4()J'.&)!%'!*'%#6$-!'$!2-!&-('-!`@D<D<D!
Enlace operacional
]'(8!I$-!4'(%)$-!*'!2-!E(6-$#Q-.#5$!.)$!1I'$!.)$).#,#'$&)!*'!2-%!4'(%)$-%!J!*'!2-%!I$#g*-*'%!#,42#.-*-%!'$!'2!4()J'.&)!+^ZW!UI'!&'$6-!.-4-.#*-*!4-(-!.)$'.&-(!-2!'UI#4)!*'!4()gJ'.&)!.)$!'2!6(I4)!*'!I%I-(#)%D!
L%!'2!#$&'(2).I&)(!:#%#12'!*'2!.),#&;!*'!%'6I#,#'$&)D!
L2!'$2-.'!)4'(-.#)$-2!%'!*'%#6$-!'$!2-!&-('-!`@D>D<D!
3)$:#'$'!('.)(*-(!UI'!I$!4()J'.&)!+^Z!%#',4('!'%!,#M&)!4)(!%I!4()4#-!$-&I(-2'Q-h!'%!*'.#(W!('gUI#'('! 2-! .)2-1)(-.#5$! 4'(,-$'$&'! *'! '%4'.#-2#%&-%! J! I%I-(#)%! &-$&)! '$! 2-%! O-%'%! 4('4-(-&)(#-%!.),)!'$!%I!*'%-(()22)D!T-!O#6I(-!*'2!'$2-.'!)4'(-.#)$-2!-*UI#'('!I$-!('2':-$.#-!4'(,-$'$&'!UI'!$)!'%!V-1#&I-2!'$!)&()!)!*'!4()J'.&)%!,8%!&;.$#.)%D!
3.2. Desarrollo del proyecto L$!'%&-!%'..#5$!%'!)(*'$-$!J!O)(,-2#Q-$! 2-%!-..#)$'%!-!('-2#Q-(!-! 2)! 2-(6)!*'!I$!4()J'.&)!+^ZW!'%&-12'.#'$*)!I$!,-(.)!$)(,-2#Q-*)!*'!*'%-(()22)D!L%&'!,-(.)!*'!&(-1-F)!*'O#$'[!
@D! I$-!'%&(I.&I(-.#5$!*'2!4()J'.&)!UI'!%#(:'!*'!6IR-!-2!'UI#4)!*'!&(-1-F)!J!UI'!4'(,#&'!#$:)2Ig.(-(!'$!-UI;2!-!2)%!('%4)$%-12'%!J!-!2)%!I%I-(#)%D!
<D! I$!.)$FI$&)!*'!4()*I.&)%!-!)1&'$'(!
>D! I$!.)$FI$&)!*'!&;.$#.-%!4-(-!)1&'$'(!2)%!4()*I.&)%!
BD! 2-%!OI$.#)$'%!J!('%4)$%-1#2#*-*'%!*'!2)%!*#%&#$&)%!4-(&#.#4-$&'%!
L2!4()J'.&)!%'!*#:#*'!'$!&('%!6(-$*'%!4().'%)%W!*'%62)%8$*)%'!.-*-!I$)!'$!I$-!%'(#'!*'!-.&#:#g*-*'%!J!'%&-%W!-!%I!:'QW!'$!&-('-%!.)$!'2!6(-*)!*'!*'&-22'!)4)(&I$)D!!
3-*-!&-('-!'%4'.#O#.-!2)%!%#6I#'$&'%!.)$.'4&)%[!
!" -..#)$'%!-!('-2#Q-(!
!" *-&)%!*'!'$&(-*-!
!" *-&)%!*'!%-2#*-[!4()*I.&)%!J!*).I,'$&)%!-!)1&'$'(!.),)!4()*I.&)!*'!2-%!-..#)$'%!
"-6'(#&!:'(%#5$!<! ! L%&(I.&I(-.#5$!*'2!4()J'.&)!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!>A!?*'!@ABC!
!" &;.$#.-%!('.),'$*-*-%!4-(-!22':-(!-!1I'$!&;(,#$)!2)%!)1F'&#:)%!*'!2-!&-('-!
!" 4-(&#.#4-$&'%!UI'!#$&'(:#'$'$!)!'%&8$!-O'.&-*)%!4)(!2-!.I,42#,'$&-.#5$!*'!2-%!-..#)$'%!
9$!4()J'.&)!+^Z!.)$22':-!&('%!4().'%)%[!
!
Proceso P1: Planificación
!" ]'!'%&-12'.'$!2-%!.)$%#*'(-.#)$'%!$'.'%-(#-%!4-(-!-((-$.-(!'2!4()J'.&)!+^ZD!
!" ]'!#$:'%-!2-!)4)(&I$#*-*!*'!('-2#Q-(2)D!
!" ]'!*'O#$'$!2)%!)1F'&#:)%!UI'!V-!*'!.I,42#(!J!'2!*),#$#)!?8,1#&)C!UI'!-1-(.-(8D!
!" ]'!42-$#O#.-$!2)%!,'*#)%!,-&'(#-2'%!J!VI,-$)%!4-(-!%I!('-2#Q-.#5$D!
!" ]'!4().'*'!-2!2-$Q-,#'$&)!*'2!4()J'.&)D!
!
Proceso P2: Análisis de riesgos
!" ]'!#*'$&#O#.-$!2)%!-.&#:)%!-!&(-&-(W!2-%!('2-.#)$'%!'$&('!'22)%!J!2-!:-2)(-.#5$!UI'!,'('.'$D!
!" ]'!#*'$&#O#.-$!2-%!-,'$-Q-%!%#6$#O#.-&#:-%!%)1('!-UI'22)%!-.&#:)%!J!%'!:-2)(-$!'$!&;(,#$)%!*'!O('.I'$.#-!*'!).I(('$.#-!J!*'6(-*-.#5$!UI'!.-I%-$!%)1('!'2!:-2)(!*'2!-.&#:)!-O'.&-*)D!
!" ]'!#*'$&#O#.-$!2-%!%-2:-6I-(*-%!'M#%&'$&'%!J!%'!:-2)(-!2-!'O#.-.#-!*'!%I!#,42-$&-.#5$D!
!" ]'!'%&#,-!'2!#,4-.&)!J!'2!(#'%6)!-2!UI'!'%&8$!'M4I'%&)%!2)%!-.&#:)%!*'2!%#%&',-D!
!" ]'!#$&'(4('&-!'2!%#6$#O#.-*)!*'2!#,4-.&)!J!'2!(#'%6)D!
!
Proceso P3: Gestión de riesgos
!" ]'!'2#6'!I$-!'%&(-&'6#-!4-(-!,#-(!#,4-.&)!J!(#'%6)D!
!" ]'!*'&'(,#$-$!2-%!%-2:-6I-(*-%!)4)(&I$-%!4-(-!'2!)1F'&#:)!-$&'(#)(D!
!" ]'!*'&'(,#$-!2-!.-2#*-*!$'.'%-(#-!4-(-!*#.V-%!%-2:-6I-(*-%D!
!" ]'!*#%'c-!I$!42-$!*'!%'6I(#*-*!?42-$!*'!-..#5$!)!42-$!*#('.&)(C!4-(-!22':-(!'2!#,4-.&)!J!'2!(#'%6)!-!$#:'2'%!-.'4&-12'%D!
!" ]'!22':-!-!.-1)!'2!42-$!*'!%'6I(#*-*D!
!
L%&)%!&('%!4().'%)%!$)!%)$!$'.'%-(#-,'$&'!%'.I'$.#-2'%D!L2!4().'%)!/@!'%!.2-(-,'$&'!'2!#$#.#-g*)(!*'2!4()J'.&)D!L2!4().'%)!/<! OI$.#)$-!.),)!%)4)(&'!*'2!4().'%)!/>!'$!'2! %'$&#*)!*'!UI'! 2-!6'%$!*'!(#'%6)%!?/>C!'%!I$-!&-('-!.)$&#$I-!%)4)(&-*-!4)(!2)%!&;.$#.-%!*'!-$82#%#%!?/<CD!T-!6'%g$!*'!(#'%6)%!%I4)$'!%#',4('!2-!-2&'(-.#5$!*'2!.)$FI$&)!*'!%-2:-6I-(*-%W!1#'$!4)(UI'!-4-('.'$!$I':-%!%-2:-6I-(*-%W!1#'$!4)(UI'!%'!('',42-Q-$!I$-%!4)(!)&(-%W!1#'$!4)(UI'!%'!,'F)(-$!2-%!'M#%g&'$&'%D!T-!6'%$!*'!(#'%6)%!4I'*'!%I4)$'(! 2-!-2&'(-.#5$!*'2!.)$FI$&)!*'!-.&#:)%>@W!1#'$!4)(UI'!-4-('.'$!$I':)%!-.&#:)%!?'2','$&)%!*'!%-2:-6I-(*-!UI'!4-%-$!-!O)(,-(!4-(&'!*'2!%#%&',-C!)!4)(gUI'!%'!'2#,#$-$!-.&#:)%!*'2!%#%&',-D!L$!*'O#$#&#:-W!-!2)!2-(6)!*'2!4().'%)!/>!%'!('.I((#(8!-!&-('-%!*'2!4().'%)!/<D!
!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
>@!e)(,-2,'$&'!%'!*#.'!UI'! 2-! #$&()*I..#5$!*'!%-2:-6I-(*-%!4-(-!,#-(!.#'(&)%!(#'%6)%!4I'*'!#$&()*I.#(!$I':)%!(#'%6)%!'$!'2!%#%&',-D!
"-6'(#&!:'(%#5$!<! ! L%&(I.&I(-.#5$!*'2!4()J'.&)!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!>G!?*'!@ABC!
/@[!/2-$#O#.-.#5$/@[!/2-$#O#.-.#5$ /<[!+$82#%#%!*'!(#'%6)%/<[!+$82#%#%!*'!(#'%6)%
/>[!^'%$!*'!(#'%6)%/>[!^'%$!*'!(#'%6)%!
!
+!2)!2-(6)!*'!'%&)%!4().'%)%!%'!6'$'(-$!I$-!%'(#'!*'!*).I,'$&)%!*'!#$&'(;%!6'$'(-2><[!
P1: Planificación
!" `#4)2)6R-!*'!-.&#:)%!
!" \#,'$%#)$'%!*'!%'6I(#*-*!('2':-$&'%!
!" 3(#&'(#)%!*'!':-2I-.#5$!
P2: Análisis de riesgos
!" ")*'2)!*'!:-2)(!
!" "-4-!*'!(#'%6)%!
!" L:-2I-.#5$!*'!%-2:-6I-(*-%!
!" L%&-*)!*'!(#'%6)!
!" H$O)(,'!*'!#$%IO#.#'$.#-%!
P3: Gestión de riesgos
!" /2-$!*'!%'6I(#*-*!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
><!]#$!'$&(-(!'$!*).I,'$&)%!*'!&(-1-F)!*'2!4()4#)!4()J'.&)!+^ZW!UI'!%'!*'&-22-$!'$!2-%!&-('-%D!
"-6'(#&!:'(%#5$!<! ! L%&(I.&I(-.#5$!*'2!4()J'.&)!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!>K!?*'!@ABC!
3.2.1. Visión global
]#$!4'(FI#.#)!*'!I$-!'M4)%#.#5$!*'&-22-*-!,8%!-*'2-$&'W!%'!('2-.#)$-!-!.)$&#$I-.#5$!'2!8(1)2!.),g42'&)!*'!4().'%)%W!-.&#:#*-*'%!J!&-('-%!UI'!:'(&'1(-$!I$!4()J'.&)!+^ZD!
Procesos, actividades y tareas
Proceso P1: Planificación
+.&#:#*-*!+@D@[!L%&I*#)!*'!)4)(&I$#*-*!`-('-!`@D@D@[!\'&'(,#$-(!2-!)4)(&I$#*-*!
+.&#:#*-*!+@D<[!\'&'(,#$-.#5$!*'2!-2.-$.'!*'2!4()J'.&)!`-('-!`@D<D@[!E1F'&#:)%!J!('%&(#..#)$'%!6'$'(-2'%!`-('-!`@D<D<[!\'&'(,#$-.#5$!*'2!*),#$#)!J!2R,#&'%!`-('-!`@D<D>[!H*'$&#O#.-.#5$!*'2!'$&)($)!`-('-!`@D<DB[!L%&#,-.#5$!*'!*#,'$%#)$'%!J!.)%&'!
+.&#:#*-*!+@D>[!/2-$#O#.-.#5$!*'2!4()J'.&)!`-('-!`@D>D@[!L:-2I-(!.-(6-%!J!42-$#O#.-(!'$&(':#%&-%!`-('-!`@D>D<[!E(6-$#Q-(!-!2)%!4-(&#.#4-$&'%!`-('-!`@D>D>[!/2-$#O#.-(!'2!&(-1-F)!
+.&#:#*-*!+@DB[!T-$Q-,#'$&)!*'2!4()J'.&)!`-('-!`@DBD@[!+*-4&-(!2)%!.I'%&#)$-(#)%!`-('-!`@DBD<[!3(#&'(#)%!*'!':-2I-.#5$!`-('-!`@DBD>[!Z'.I(%)%!$'.'%-(#)%!`-('-!`@DBDB[!]'$%#1#2#Q-.#5$!
Proceso P2: Análisis de riesgos
+.&#:#*-*!+<D@[!3-(-.&'(#Q-.#5$!*'!2)%!-.&#:)%!`-('-!`<D@D@[!H*'$&#O#.-.#5$!*'!2)%!-.&#:)%!`-('-!`<D@D<[!\'4'$*'$.#-%!'$&('!-.&#:)%!`-('-!`<D@D>[!_-2)(-.#5$!*'!2)%!-.&#:)%!
+.&#:#*-*!+<D<[!3-(-.&'(#Q-.#5$!*'!2-%!-,'$-Q-%!`-('-!`<D<D@[!H*'$&#O#.-.#5$!*'!2-%!-,'$-Q-%!`-('-!`<D<D<[!_-2)(-.#5$!*'!2-%!-,'$-Q-%!
+.&#:#*-*!+<D>[!3-(-.&'(#Q-.#5$!*'!2-%!%-2:-6I-(*-%!`-('-!`<D>D@[!H*'$&#O#.-.#5$!*'!2-%!%-2:-6I-(*-%!'M#%&'$&'%!`-('-!`<D>D<[!_-2)(-.#5$!*'!2-%!%-2:-6I-(*-%!'M#%&'$&'%!
+.&#:#*-*!+<DB[!L%&#,-.#5$!*'2!'%&-*)!*'!(#'%6)!`-('-!`<DBD@[!L%&#,-.#5$!*'2!#,4-.&)!`-('-!`<DBD<[!L%&#,-.#5$!*'2!(#'%6)!`-('-!`<DBD>[!H$&'(4('&-.#5$!*'!2)%!('%I2&-*)%!
Proceso P3: Gestión de riesgos
+.&#:#*-*!+>D@[!`),-!*'!*'.#%#)$'%!`-('-!`>D@D@[!3-2#O#.-.#5$!*'!2)%!(#'%6)%!
+.&#:#*-*!+>D<[!/2-$!*'!%'6I(#*-*!`-('-!`>D<D@[!/()6(-,-%!*'!%'6I(#*-*!`-('-!`>D<D<[!/2-$!*'!'F'.I.#5$!
+.&#:#*-*!+>D>[!LF'.I.#5$!*'2!42-$!`-('-!`>D>Dv[!LF'.I.#5$!*'!.-*-!4()6(-,-!*'!%'6I(#*-*!
"-6'(#&!:'(%#5$!<! ! L%&(I.&I(-.#5$!*'2!4()J'.&)!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!>N!?*'!@ABC!
3.3. Proceso P1: Planificación L2! )1F'&#:)! 4(#$.#4-2! *'! '%&'! 4().'%)!'%! '%&-12'.'(! '2!,-(.)! 6'$'(-2! *'! ('O'('$.#-! 4-(-! &)*)!'2!4()J'.&)D!
3),)!)1F'&#:)%!.),42','$&-(#)%!%'!4I'*'$!#*'$&#O#.-(!2)%!%#6I#'$&'%[!
!" ")&#:-(W!.)$.#'$.#-(!'!#$:)2I.(-(!-!2-!\#('..#5$!)!^'('$.#-!*'!2-!E(6-$#Q-.#5$D!
!" Z-Q)$-(!2-!)4)(&I$#*-*!*'!('-2#Q-(!I$!4()J'.&)!+^ZD!
!" +O#(,-(!J!*-(!-!.)$).'(!2-!:)2I$&-*!*'!%I!('-2#Q-.#5$!4)(!4-(&'!*'!2-!\#('..#5$D!
!" 3('-(!2-%!.)$*#.#)$'%!VI,-$-%!J!,-&'(#-2'%!4-(-!'2!1I'$!*'%-(()22)!*'2!4()J'.&)D!
L%&'!4().'%)!%'!*'%-(()22-!4)(!,'*#)!*'!2-%!%#6I#'$&'%!-.&#:#*-*'%!J!&-('-%[!
Actividad A1.1: Estudio de oportunidad
]'!OI$*-,'$&-!2-!)4)(&I$#*-*!*'!2-!('-2#Q-.#5$W!-V)(-W!*'2!4()J'.&)!+^ZW!'$,-(.8$*)2)!'$!'2!*'%-(()22)!*'!2-%!*',8%!-.&#:#*-*'%!*'!2-!E(6-$#Q-.#5$D!
L2!('%I2&-*)!*'!'%&-!-.&#:#*-*!'%!'2!#$O)(,'!*'$),#$-*)!j4('2#,#$-(kD!
`-('-%[!
Tarea T1.1.1: \'&'(,#$-(!2-!)4)(&I$#*-*!
Actividad A1.2: Determinación del alcance del proyecto
]'!*'O#$'$!2)%!)1F'&#:)%!O#$-2'%!*'2!4()J'.&)W!%I!*),#$#)!J!%I%!2R,#&'%D!]'!('-2#Q-!I$-!4(#,'g(-!#*'$&#O#.-.#5$!*'2!'$&)($)!J!*'!2-%!('%&(#..#)$'%!6'$'(-2'%!-!.)$%#*'(-(D!o!4)(!02&#,)!%'!'%g&#,-!'2!.)%&'!UI'!:-!-!%I4)$'(D!
L2!('%I2&-*)!*'!'%&-!-.&#:#*-*!'%!I$!4'(O#2!*'!4()J'.&)!+^ZD!
`-('-%[!
Tarea T1.2.1: E1F'&#:)%!J!('%&(#..#)$'%!6'$'(-2'%!
Tarea T1.2.2: \'&'(,#$-.#5$!*'2!*),#$#)!J!2R,#&'%!
Tarea T1.2.3: H*'$&#O#.-.#5$!*'2!'$&)($)!
Tarea T1.2.4: L%&#,-.#5$!*'!*#,'$%#)$'%!J!.)%&'!
Actividad A1.3: Planificación del proyecto
]'!*'&'(,#$-$! 2-%!.-(6-%!*'! &(-1-F)!UI'!%I4)$'! 2-! ('-2#Q-.#5$!*'2!4()J'.&)D!]'!42-$#O#.-$!2-%!'$&(':#%&-%!UI'!%'!:-$!-!('-2#Q-(!4-(-!2-!('.)6#*-!*'!#$O)(,-.#5$[!UI#;$'%!:-$!-!%'(!!'$g&(':#%&-*)%D!]'!'2-1)(-!'2!42-$!*'!&(-1-F)!4-(-!2-!('-2#Q-.#5$!*'2!4()J'.&)D!
L$!'%&-!-.&#:#*-*! %'!*'&'(,#$-$! 2)%!4-(&#.#4-$&'%!J! %'!'%&(I.&I(-$! 2)%!*#O'('$&'%!6(I4)%!J!.),#&;%!4-(-!22':-(!-!.-1)!'2!4()J'.&)D!
L2!('%I2&-*)!*'!'%&-!-.&#:#*-*!'%&8!.)$%&#&I#*)!4)([!
!" I$!42-$!*'!&(-1-F)!4-(-!'2!4()J'.&)!+^Z!
!" 4().'*#,#'$&)%!*'!6'%$!*'!2-!#$O)(,-.#5$!6'$'(-*-!
`-('-%[!
Tarea T1.3.1: L:-2I-(!.-(6-%!J!42-$#O#.-(!'$&(':#%&-%!
Tarea T1.3.2: E(6-$#Q-(!-!2)%!4-(&#.#4-$&'%!
Tarea T1.3.3: /2-$#O#.-(!'2!&(-1-F)!
"-6'(#&!:'(%#5$!<! ! L%&(I.&I(-.#5$!*'2!4()J'.&)!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!>P!?*'!@ABC!
Actividad A1.4: Lanzamiento del proyecto
]'!-*-4&-$!2)%!.I'%&#)$-(#)%!4-(-!2-!('.)6#*-!*'!#$O)(,-.#5$!-*-4&8$*)2)%!-2!4()J'.&)!4('g%'$&'D!]'!'2#6'$!2-%!&;.$#.-%!4(#$.#4-2'%!*'!':-2I-.#5$!*'!(#'%6)!-!I#Q-(!J!%'!-%#6$-$!2)%!('.I(%)%!$'.'%-(#)%!4-(-!'2!.),#'$Q)!*'2!4()J'.&)D!`-,1#;$!%'!('-2#Q-!I$-!.-,4-c-!#$O)(g,-&#:-!*'!%'$%#1#2#Q-.#5$!-!2)%!-O'.&-*)%!%)1('!2-%!O#$-2#*-*'%!J!('UI'(#,#'$&)%!*'!%I!4-(&#g.#4-.#5$D!
L2!('%I2&-*)!*'!'%&-!-.&#:#*-*!'%&8!.)$%&#&I#*)!4)([!
!" 2)%!.I'%&#)$-(#)%!4-(-!2-%!'$&(':#%&-%!
!" '2!42-$!*'!'$&(':#%&-%!
!" '2!.-&82)6)!*'!)%!*'!-.&#:)%!
!" 2-!('2-.#5$!*'!*#,'$%#)$'%!*'!%'6I(#*-*!J!!
!" 2)%!.(#&'(#)%!*'!:-2)(-.#5$!
`-('-%[!
Tarea T1.4.1: +*-4&-(!2)%!.I'%&#)$-(#)%!
Tarea T1.4.2: 3(#&'(#)%!*'!':-2I-.#5$!
Tarea T1.4.3: Z'.I(%)%!$'.'%-(#)%!
Tarea T1.4.4: ]'$%#1#2#Q-.#5$!
"-6'(#&!:'(%#5$!<! ! L%&(I.&I(-.#5$!*'2!4()J'.&)!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!BS!?*'!@ABC!
3.3.1. Actividad A1.1: Estudio de oportunidad
3)$%&-!*'!I$-!0$#.-!&-('-[!
`@D@D@[!\'&'(,#$-(!2-!)4)(&I$#*-*!
P1: Planificación A1.1: Estudio de oportunidad T1.1.1: Determinar la oportunidad
Objetivos
!" H*'$&#O#.-(!)!%I%.#&-(!'2! #$&'(;%!*'! 2-!\#('..#5$!*'! 2-!E(6-$#Q-.#5$!'$! 2-! ('-2#Q-.#5$!*'!I$!4()J'.&)!+^Z!
Productos de entrada
Productos de salida
!" Informe preliminar ('.),'$*-$*)!2-!'2-1)(-.#5$!*'2!4()J'.&)!+^Z!
!" ]'$%#1#2#Q-.#5$!J!-4)J)!*'!2-!\#('..#5$!-!2-!('-2#Q-.#5$!*'2!4()J'.&)!+^Z!
!" 3('-.#5$!*'2!.),#&;!*'!%'6I#,#'$&)!
Técnicas, prácticas y pautas
!" L$&(':#%&-%!?:'(!m^IR-!*'!`;.$#.-%m!>DGD@C!
!" Z'I$#)$'%!?:'(!m^IR-!*'!`;.$#.-%m!>DGD<C!
Participantes
!" L2!4(),)&)(!
!
T-!\#('..#5$!%I'2'!%'(!,IJ!.)$%.#'$&'!*'! 2-%!:'$&-F-%!UI'!-4)(&-$! 2-%!&;.$#.-%!'2'.&(5$#.-%W! #$gO)(,8&#.-%!J!&'2',8&#.-%!-!%I!OI$.#)$-,#'$&)h!4'()!$)!&-$&)!*'!2)%!$I':)%!4()12',-%!*'!%'6I(#g*-*!UI'!'%&-%!&;.$#.-%!#,42#.-$W!)!*'!2-%!)12#6-.#)$'%!2'6-2'%!)!('62-,'$&-(#-%!UI'!2'%!-O'.&-$!
L$! &)*-!E(6-$#Q-.#5$!4012#.-!)!4(#:-*-!'%! #,4)(&-$&'! &(-$%O)(,-(!'$!,'*#*-%!.)$.('&-%! 2-!.('g.#'$&'!4(').I4-.#5$!4)(!2-!O-2&-!*'!%'6I(#*-*!*'!2)%!%#%&',-%!*'!#$O)(,-.#5$W!4)(!%I!%)4)(&'!J!'$g&)($)W!4I'%&)!UI'!%I%!'O'.&)%!$)!%52)!-O'.&-$!-!*#.V)%!%#%&',-%W!%#$)!-2!4()4#)!OI$.#)$-,#'$&)!*'!2-!E(6-$#Q-.#5$!JW!'$!2-%!%#&I-.#)$'%!.(R&#.-%W!-!%I!4()4#-!,#%#5$!J!.-4-.#*-*!*'!%I4'(:#:'$.#-D!
Desarrollo
T-!#$#.#-&#:-!4-(-! 2-!('-2#Q-.#5$!*'!I$!4()J'.&)!+^Z!4-(&'!*'!I$!4(),)&)(! #$&'($)!)!'M&'($)!-!2-!E(6-$#Q-.#5$W!.)$%.#'$&'!*'!2)%!4()12',-%!('2-.#)$-*)%!.)$!2-!%'6I(#*-*!*'!2)%!%#%&',-%!*'!#$gO)(,-.#5$W!.),)!4)(!'F',42)[!
!" H$.#*'$&'%!.)$&#$I-*)%!('2-.#)$-*)%!.)$!2-!%'6I(#*-*D!
!" H$'M#%&'$.#-!*'!4(':#%#)$'%!'$!.I'%&#)$'%!('2-.#)$-*-%!.)$!2-!':-2I-.#5$!*'!$'.'%#*-*'%!J!,'*#)%!4-(-!-2.-$Q-(!I$!$#:'2!-.'4&-12'!*'!%'6I(#*-*!*'! 2)%!%#%&',-%!*'! #$O)(,-.#5$!UI'!%'-!.),4-'!.)$!'2!.I,42#,#'$&)!.)(('.&)!*'!2-!,#%#5$!J!OI$.#)$'%!*'!2-!E(6-$#Q-.#5$D!
!" Z''%&(I.&I(-.#)$'%!'$!2)%!4()*I.&)%!)!%'(:#.#)%!4()4)(.#)$-*)%D!
!" 3-,1#)%!'$!2-!&'.$)2)6R-!I#Q-*-D!
!" \'%-(()22)!*'!$I':)%!%#%&',-%!*'!#$O)(,-.#5$D!
L2!4(),)&)(!4I'*'!'2-1)(-(!I$!cuestionario-marco ?*).I,'$&)!4).)!%#%&',-&#Q-12'!UI'!*'1'(8!.('-(!'$!.-*-!.-%)!.)$.('&)C!4-(-!4():).-(!2-!('O2'M#5$!%)1('!-%4'.&)%!*'!2-!%'6I(#*-*!*'!2)%!%#%g&',-%!*'!#$O)(,-.#5$!4)(!4-(&'!*'
"-6'(#&!:'(%#5$!<! ! L%&(I.&I(-.#5$!*'2!4()J'.&)!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!B@!?*'!@ABC!
Los responsables de las unidades operativas (responsables de servicios).
L2!.I'%&#)$-(#)!4'(,#&'!4().'*'(!-!I$!'M-,'$!#$O)(,-2!*'!2-!%#&I-.#5$!'$!.I-$&)!-!2-!%'6I(#g*-*!*'!%I%!%#%&',-%!*'!#$O)(,-.#5$h!*'1'$!4)*'(!'M4('%-(!%I!)4#$#5$!4)(!2)%!4()J'.&)%!*'!%'6I(#*-*!J-!('-2#Q-*)%!?.)$!%I!6(-*)!*'!%-&#%O-..#5$!)!.)$!2-%!2#,#&-.#)$'%!*'!;%&)%CW!-%R!.),)!%I%!'M4'.&-&#:-%!-$&'!2-!'2-1)(-.#5$!*'!I$!4()J'.&)!+^Z>>D!L%&-!-4()M#,-.#5$!*'!-2&)!$#:'2!4'(,#&'!)1&'$'(!I$-!4(#,'(-!:#%#5$!*'!2)%!)1F'&#:)%!.)$.('&)%!J!2-%!)4.#)$'%!UI'!&'$g*(R-$!UI'!%I1J-.'(!-!2-!'2-1)(-.#5$!*'2!4()J'.&)D!
Los responsables de informática.
L2!.I'%&#)$-(#)!4'(,#&'!)1&'$'(!I$-!4-$)(8,#.-!&;.$#.-!4-(-! 2-!'2-1)(-.#5$!*'2!4()J'.&)!J!4)%#1#2#&-!-1)(*-(!'2!'%&I*#)!*'!)4)(&I$#*-*!*'!('-2#Q-.#5$W!&(-%!#$&'6(-(!2-%!)4.#)$'%!-$&'(#)g('%D!
\'!2-%!('%4I'%&-%!-2!.I'%&#)$-(#)g,-(.)!J!*'! 2-%!'$&(':#%&-%!,-$&'$#*-%!.)$! 2)%!('%4)$%-12'%!J!.)2'.&#:)%!-$&'(#)('%W!'2!4(),)&)(!)1&#'$'!I$-!4(#,'(-!-4()M#,-.#5$!%)1('!2-%!OI$.#)$'%W!2)%!%'(:#g.#)%!J!2)%!4()*I.&)%!#,42#.-*)%!'$!.I'%&#)$'%!*'!%'6I(#*-*!*'!2)%!%#%&',-%!*'!#$O)(,-.#5$W!2-!I1#g.-.#5$!6')6(8O#.-!*'!-UI;22)%W!2)%!,'*#)%!&;.$#.)%W!2)%!,'*#)%!VI,-$)%W!'&.D!
3)$!'%&)%!'2','$&)%!'2!4(),)&)(!('-2#Q-!'2!informe preliminar ('.),'$*-$*)!2-!'2-1)(-.#5$!*'2!4()J'.&)!+^Z!'!#$.2IJ'$*)!'%&)%!'2','$&)%[!
!" LM4)%#.#5$!*'!2)%!-(6I,'$&)%!18%#.)%D!
!" Z'2-.#5$!*'!-$&'.'*'$&'%!%)1('!2-!%'6I(#*-*!*'!2)%!%#%&',-%!*'!#$O)(,-.#5$!?/2-$!L%&(-&;g6#.)W!/2-$!*'!+.&I-.#5$W!'&.DCD!
!" /(#,'(-!-4()M#,-.#5$!-2!*),#$#)!-!#$.2I#(!'$!'2!4()J'.&)!'$!OI$.#5$!*'!
!" 2-%!O#$-2#*-*'%!*'!2-%!I$#*-*'%!)!*'4-(&-,'$&)%!
!" 2-%!)(#'$&-.#)$'%!6'('$.#-2'%!J!&;.$#.-%!
!" 2-!'%&(I.&I(-!*'!2-!E(6-$#Q-.#5$!
!" '2!'$&)($)!&;.$#.)D!
!" /(#,'(-! -4()M#,-.#5$! *'! 2)%!,'*#)%W! &-$&)! VI,-$)%! .),)!,-&'(#-2'%W! 4-(-! 2-! ('-2#Q-.#5$!*'2!4()J'.&)!+^ZD!
L2!4(),)&)(!4('%'$&-!'%&'!#$O)(,'!4('2#,#$-(!-!2-!\#('..#5$!UI'!4I'*'!*'.#*#([!
!" -4()1-(!'2!4()J'.&)W!)!1#'$!
!" ,)*#O#.-(!%I!*),#$#)!Jd)!%I%!)1F'&#:)%W!)!1#'$!
!" ('&(-%-(!'2!4()J'.&)D!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
>>!/()1-12','$&'!$)!%'!.)$)Q.-!2)!UI'!'%&)!%#6$#O#.-!J!V-J-!UI'!#$.2I#(!'$!'2!.I'%&#)$-(#)!,-(.)!I$-!%I.#$g&-!'M42#.-.#5$!*'!UI;!'%!J!UI;!)1F'&#:)%!4'(%#6I'!I$!4()J'.&)!+^ZD!
"-6'(#&!:'(%#5$!<! ! L%&(I.&I(-.#5$!*'2!4()J'.&)!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!B<!?*'!@ABC!
3.3.2. Actividad A1.2: Determinación del alcance del proyecto
9$-!:'Q!UI'!%'!V-!.)$%&-&-*)!2-!)4)(&I$#*-*!*'!('-2#Q-(!'2!4()J'.&)!+^Z!J!'2!-4)J)!4)(!2-!\#('.g.#5$W!'%&-!-.&#:#*-*!'%&#,-!2)%!'2','$&)%!*'!42-$#O#.-.#5$!*'2!4()J'.&)W!'%!*'.#(!2)%!4-(&#.#4-$&'%!J!%I%!.-(6-%!*'!&(-1-F)D!
L$!*#.V-!'%&#,-.#5$!%'!V-!*'!&'$'(!'$!.I'$&-!2-!4)%#12'!'M#%&'$.#-!*'!)&()%!42-$'%!?4)(!'F',42)!I$!/2-$!L%&(-&;6#.)!*'!]#%&',-%!*'!H$O)(,-.#5$!)!*'!]'6I(#*-*!6'$'(-2!'$!2-%!I$#*-*'%!UI'!4I'g*'$!%'(!-O'.&-*-%!)!'$!2-!E(6-$#Q-.#5$C!J!'2!42-Q)!*'!&#',4)!.)$%#*'(-*)!4-(-!2-!4I'%&-!'$!4(8.g&#.-!*'2!4()J'.&)!+^ZD!L$!4-(&#.I2-(W!2-!'M#%&'$.#-!*'!I$!/2-$!L%&(-&;6#.)!*'!]#%&',-%!*'!H$O)(,-g.#5$!4-(-!2-%!I$#*-*'%!UI'!4I'*'$!%'(!-O'.&-*-%!*'$&()!*'!2-!E(6-$#Q-.#5$!4I'*'!*'&'(,#$-(!'$!6(-$!,'*#*-!'2!-2.-$.'!J!2-!'M&'$%#5$!*'!2-%!-.&#:#*-*'%!UI'!%'!('-2#.'$!'$!'%&-!-.&#:#*-*D!
L%&-!-.&#:#*-*!.)$%&-!*'!.I-&()!&-('-%[!
`@D<D@[!E1F'&#:)%!J!('%&(#..#)$'%!6'$'(-2'%!
`@D<D<[!\'&'(,#$-.#5$!*'2!*),#$#)!J!2R,#&'%!
`@D<D>[!H*'$&#O#.-.#5$!*'2!'$&)($)!
`@D<DB[!L%&#,-.#5$!*'!*#,'$%#)$'%!J!.)%&'!
P1: Planificación A1.2: Determinación del alcance del proyecto T1.2.1: Objetivos y restricciones generales
Objetivos
!" \'&'(,#$-(!2)%!)1F'&#:)%!*'2!4()J'.&)W!*#O'('$.#-*)%!%'60$!V)(#Q)$&'%!&',4)(-2'%!-!.)(&)!J!,'*#)!42-Q)!
!" \'&'(,#$-(!2-%!('%&(#..#)$'%!6'$'(-2'%!UI'!%'!#,4)$'$!%)1('!'2!4()J'.&)!
Productos de entrada
!" Z'.)4#2-.#5$!*'!2-!*).I,'$&-.#5$!4'(&#$'$&'!*'!2-!E(6-$#Q-.#5$!
Productos de salida
!" L%4'.#O#.-.#5$!*'&-22-*-!*'!2)%!)1F'&#:)%!*'2!4()J'.&)!
!" Z'2-.#5$!*'!('%&(#..#)$'%!6'$'(-2'%!
Técnicas, prácticas y pautas
!" L$&(':#%&-%!?:'(!m^IR-!*'!`;.$#.-%m!>DGD@C!
!" Z'I$#)$'%!?:'(!m^IR-!*'!`;.$#.-%m!>DGD<C!
Participantes
!" L2!.),#&;!*'!%'6I#,#'$&)!
!
9$!4()J'.&)!+^Z!4I'*'!4'(%'6I#(!)1F'&#:)%!-!,IJ!.)(&)!42-Q)! &-2'%!.),)!'2!-%'6I(-,#'$&)!*'!.#'(&)!%#%&',-!)!I$!.#'(&)!4().'%)!*'!$'6).#)W!)!4I'*'!4('&'$*'(!)1F'&#:)%!,8%!-,42#)%!.),)!OI'g(-!'2!-$82#%#%!62)1-2!*'!2-!%'6I(#*-*!*'!2-!E(6-$#Q-.#5$D!L$!&)*)!.-%)W!V-J!UI'!*'&'(,#$-(2)D!
L%4'.#-2,'$&'!-!2-!V)(-!*'!&),-(!-..#)$'%!.)(('.&)(-%W!V-J!UI'!&'$'(!'$!.I'$&-!UI'!j$)!&)*)!:-g2'kW!%#$)!UI'!'2!4()J'.&)!%'!'$.)$&(-(8!.)$!I$-!%'(#'!*'!('%&(#..#)$'%W!$)!$'.'%-(#-,'$&'!&;.$#g.-%W!UI'!'%&-12'.'$!I$!,-(.)!-2!UI'!-&'$'(%'D!/-(-!#$.)(4)(-(!2-%!('%&(#..#)$'%!-2!-$82#%#%!J!6'%g$!*'!(#'%6)%W!'%&-%!%'!-6(I4-$!4)(!*#%&#$&)%!.)$.'4&)%W!&R4#.-,'$&'[!!
Z'%&(#..#)$'%!4)2R&#.-%!)!6'('$.#-2'%!
`R4#.-%! *'! )(6-$#Q-.#)$'%! 6I1'($-,'$&-2'%! )! OI'(&','$&'! ('2-.#)$-*-%! .)$! )(6-$#%,)%!6I1'($-,'$&-2'%W!1#'$!.),)!4():''*)('%!)!.),)!%I,#$#%&(-*)('%!*'!%'(:#.#)%D!
Z'%&(#..#)$'%!'%&(-&;6#.-%!
"-6'(#&!:'(%#5$!<! ! L%&(I.&I(-.#5$!*'2!4()J'.&)!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!B>!?*'!@ABC!
\'(#:-*-%!*'!2-!':)2I.#5$!4(':#%&-!*'!2-!'%&(I.&I(-!I!)1F'&#:)%!*'!2-!E(6-$#Q-.#5$D!
Z'%&(#..#)$'%!6')6(8O#.-%!
\'(#:-*-%!*'!2-!I1#.-.#5$!OR%#.-!*'!2-!E(6-$#Q-.#5$!)!*'!%I!*'4'$*'$.#-!*'!,'*#)%!OR%#.)%!*'!.),I$#.-.#)$'%D!H%2-%W!',42-Q-,#'$&)%!OI'(-!*'!2-%!O()$&'(-%W!'&.D!
Z'%&(#..#)$'%!&',4)(-2'%!
sI'! &),-$!'$!.)$%#*'(-.#5$!%#&I-.#)$'%!.)JI$&I(-2'%[!.)$O2#.&#:#*-*! 2-1)(-2W! .(#%#%! #$&'($-g.#)$-2W!.-,1#)!*'!2-!4()4#'*-*W!('#$6'$#'(R-!*'!4().'%)%W!'&.D!
Z'%&(#..#)$'%!'%&(I.&I(-2'%!
`),-$*)!'$!.)$%#*'(-.#5$! 2-!)(6-$#Q-.#5$!#$&'($-[!4().'*#,#'$&)%!*'!&),-!*'!*'.#%#)$'%W!*'4'$*'$.#-!*'!.-%-%!,-&(#.'%!#$&'($-.#)$-2'%W!'&.D!
Z'%&(#..#)$'%!OI$.#)$-2'%!
sI'!&#'$'$!'$!.I'$&-!2)%!)1F'&#:)%!*'!2-!E(6-$#Q-.#5$D!
Z'%&(#..#)$'%!2'6-2'%!
T'J'%W!('62-,'$&)%W!('6I2-.#)$'%!%'.&)(#-2'%W!.)$&(-&)%!'M&'($)%!'!#$&'($)%W!'&.D!
Z'%&(#..#)$'%!('2-.#)$-*-%!.)$!'2!4'(%)$-2!
/'(O#2'%!2-1)(-2'%W!.),4(),#%)%!.)$&(-.&I-2'%W!.),4(),#%)%!%#$*#.-2'%W!.-(('(-%!4()O'%#)$-g2'%W!'&.D!
Z'%&(#..#)$'%!,'&)*)256#.-%!
\'(#:-*-%!*'! 2-! $-&I(-2'Q-! *'! 2-! )(6-$#Q-.#5$! J! %I%!V81#&)%!)!V-1#2#*-*'%!*'! &(-1-F)!UI'!4I'*'$!#,4)$'(!I$-!.#'(&-!O)(,-!*'!V-.'(!2-%!.)%-%D!
Z'%&(#..#)$'%!.I2&I(-2'%!
T-!j.I2&I(-k!)!O)(,-!#$&'($-!*'!&(-1-F-(!4I'*'!%'(!#$.),4-'!.)$!.#'(&-%!%-2:-6I-(*-%!&'5g(#.-,'$&'!#*'-2'%D!
Z'%&(#..#)$'%!4('%I4I'%&-(#-%!
T-!.-$&#*-*!*'!*#$'()!'%!#,4)(&-$&'h!4'()!&-,1#;$!2-!O)(,-!*'!42-$#O#.-(!'2!6-%&)!J!*'!'F'.Ig&-(!'2!4('%I4I'%&)!
"-6'(#&!:'(%#5$!<! ! L%&(I.&I(-.#5$!*'2!4()J'.&)!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!BB!?*'!@ABC!
!
P1: Planificación A1.2: Determinación del alcance del proyecto T1.2.2: Determinación del dominio y límites
Objetivos
!" \'&'(,#$-(!'2!*),#$#)W!-2.-$.'!)!4'(R,'&()!*'2!4()J'.&)!+^Z!
Productos de entrada
!" Z'%I2&-*)%!*'!2-!&-('-!`@D<D@W!E1F'&#:)%!J!('%&(#..#)$'%!6'$'(-2'%!
!" /'(O#2!6'$'(-2!*'!2-%!I$#*-*'%!#$.2I#*-%!'$!'2!*),#$#)!*'2!4()J'.&)!
Productos de salida
!" Z'2-.#5$!*'!I$#*-*'%!*'!2-!E(6-$#Q-.#5$!UI'!%'!:'(8$!-O'.&-*-%!.),)!4-(&'!*'2!*),#$#)!*'2!4()J'.&)!
!" T#%&-!*'!()2'%!('2':-$&'%!'$!2-!I$#*-*'%!#$.2I#*-%!'$!'2!*),#$#)!
!" \'%#6$-.#5$!*'2!*#('.&)(!*'2!4()J'.&)!
Técnicas, prácticas y pautas
!" \#-6(-,-%!*'!4().'%)%!?:'(!m^IR-!*'!`;.$#.-%m!>D>C!
Participantes
!" Z'%4)$%-12'%!*'!2-%!I$#*-*'%!*'!2-!E(6-$#Q-.#5$!
!" L2!.),#&;!*'!%'6I#,#'$&)!
!
L%&-!&-('-!#*'$&#O#.-!2-%!I$#*-*'%!)1F'&)!*'2!4()J'.&)!+^Z!J!'%4'.#O#.-!2-%!.-(-.&'(R%&#.-%!6'$'(-g2'%!*'!*#.V-%!I$#*-*'%!'$!.I-$&)!-!('%4)$%-12'%W!%'(:#.#)%!4()4)(.#)$-*)%!J!I1#.-.#)$'%!6')6(8gO#.-%D!`-,1#;$! #*'$&#O#.-! 2-%!4(#$.#4-2'%!('2-.#)$'%!*'! 2-%!I$#*-*'%!)1F'&)!*'2!4()J'.&)!.)$!)&(-%!'$&#*-*'%W!4)(!'F',42)!'2! #$&'(.-,1#)!*'! #$O)(,-.#5$!'$!*#:'(%)%!%)4)(&'%W!'2! -..'%)!-!,'*#)%!#$O)(,8&#.)%!.),I$'%W!'&.D!
T-!&-('-!4('%I,'!I$!4(#$.#4#)!18%#.)[!'2!-$82#%#%!J!2-!6'%$!*'!(#'%6)%!*'1'!.'$&(-(%'!'$!I$!*)g,#$#)!2#,#&-*)W!UI'!4I'*'!#$.2I#(!:-(#-%!I$#*-*'%!)!,-$&'$'(%'!*'$&()!*'!I$-!%)2-!I$#*-*!?%'60$!2-!.),42'F#*-*!J!'2!)!*'!4()12',-!-!&(-&-(CW!J-!UI'!I$!4()J'.&)!*'!8,1#&)!*',-%#-*)!-,42#)!)!#$*'&'(,#$-*)!4)*(R-!%'(!#$-1-(.-12'W!4)(!'M.'%#:-,'$&'!6'$'(-2#%&-!)!4)(!*',-%#-*)!'M&'$*#*)!'$!'2!&#',4)W!.)$!4'(FI#.#)!'$!2-%!'%&#,-.#)$'%!*'!2)%!'2','$&)%!*'2!-$82#%#%D!
"-6'(#&!:'(%#5$!<! ! L%&(I.&I(-.#5$!*'2!4()J'.&)!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!BA!?*'!@ABC!
!
P1: Planificación A1.2: Determinación del alcance del proyecto T1.2.3: Identificación del entorno
Objetivos
!" \'O#$#(!'2!4'(R,'&()!*'2!*),#$#)!
!" \'O#$#(!2-%!('2-.#)$'%!'$&('!'2!#$&'(#)(!*'2!*),#$#)!J!'2!'$&)($)!
Productos de entrada
!" Z'%I2&-*)%!*'!2-!&-('-!`@D<D@W!E1F'&#:)%!J!('%&(#..#)$'%!6'$'(-2'%!
!" Z'%I2&-*)%!*'!2-!&-('-!`@D<D<W!\'&'(,#$-.#5$!*'2!*),#$#)!J!2R,#&'%!
!" L%UI',-!*'!2-%!('2-.#)$'%!*'!2-%!I$#*-*'%!*'2!*),#$#)!.)$!'2!'$&)($)!
!" \#-6(-,-%!*'!O2IF)!*'!*-&)%!
Productos de salida
!" Z'2-.#5$!*'!I$#*-*'%!*'!2-!E(6-$#Q-.#5$!UI'!%'!:'(8$!-O'.&-*-%!.),)!4'(R,'&()!*'2!*),#g$#)!
!" T#%&-!*'!()2'%!('2':-$&'%!'$!)&(-%!I$#*-*'%W!-!.)$%#*'(-(!4-(-!2-!.-(-.&'(#Q-.#5$!*'2!'$&)(g$)!
Técnicas, prácticas y pautas
!" \#-6(-,-%!*'!O2IF)!*'!*-&)%!?:'(!m^IR-!*'!`;.$#.-%m!>D<C!
!" \#-6(-,-%!*'!4().'%)%!?:'(!m^IR-!*'!`;.$#.-%m!>D>C!
!" L$&(':#%&-%!?:'(!m^IR-!*'!`;.$#.-%m!>DGD@C!
!" Z'I$#)$'%!?:'(!m^IR-!*'!`;.$#.-%m!>DGD<C!
Participantes
!" Z'%4)$%-12'%!*'!2-%!I$#*-*'%!#$.2I#*-%!'$!'2!*),#$#)!
!" L2!.),#&;!*'!%'6I#,#'$&)!
!
L%&-!&-('-!('-2#Q-!I$!'%&I*#)!62)1-2!*'!2)%!%#%&',-%!*'!#$O)(,-.#5$!*'!2-%!I$#*-*'%!#$.2I#*-%!'$!'2!*),#$#)!*'2!4()J'.&)W!.)$!)1F'&)!*'!#*'$&#O#.-(!%I%!OI$.#)$'%!J!O#$-2#*-*'%!4(#$.#4-2'%!J!%I%!('2-g.#)$'%!.)$!'2!'$&)($)W!-%R!.),)!%I%! &'$*'$.#-%!*'!':)2I.#5$D!L2!4'(O#2!6'$'(-2!*'! 2-%!I$#*-*'%W!4()*I.&)!)1&'$#*)!'$!2-!&-('-!-$&'(#)(W!%'!-,42#-!'$!;%&-!.)$!2-!#$O)(,-.#5$!4()4)(.#)$-*-!4)(!2)%!('%4)$%-12'%!*'!2-%!*#:'(%-%!8('-%!*'!*#.V-%!I$#*-*'%D!
"-6'(#&!:'(%#5$!<! ! L%&(I.&I(-.#5$!*'2!4()J'.&)!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!BG!?*'!@ABC!
!
P1: Planificación A1.2: Determinación del alcance del proyecto T1.2.4: Estimación de dimensiones y coste
Objetivos
!" \'&'(,#$-(!'2!:)2I,'$!*'!('.I(%)%!$'.'%-(#)%!4-(-!2-!'F'.I.#5$!*'2!4()J'.&)!+^Z[!VI,-g$)%W!&',4)(-2'%!J!O#$-$.#'()%!
Productos de entrada
!" Z'%I2&-*)%!*'!2-!&-('-!`@D<D@W!E1F'&#:)%!J!('%&(#..#)$'%!6'$'(-2'%!
!" Z'%I2&-*)%!*'!2-!&-('-!`@D<D<W!\'&'(,#$-.#5$!*'2!*),#$#)!J!2R,#&'%!
!" Z'%I2&-*)%!*'!2-!&-('-!`@D<D>W!H*'$&#O#.-.#5$!*'2!'$&)($)!
Productos de salida
!" \#,'$%#5$!*'2!4()J'.&)!
!" 3)%&'%!J!1'$'O#.#)%!*'2!4()J'.&)!
Técnicas, prácticas y pautas
!" +$82#%#%!.)%&'g1'$'O#.#)!?:'(!m^IR-!*'!`;.$#.-%m!>D@C!
!" /2-$#O#.-.#5$!*'!4()J'.&)%!?:'(!m^IR-!*'!`;.$#.-%m!>DAC!
Participantes
!" L2!*#('.&)(!*'!4()J'.&)!
!
T-!&-('-!4)%#1#2#&-!'2!*#,'$%#)$-,#'$&)!?&-,-c)W!.),42'F#*-*W!Q)$-%!*'!#$.'(&#*I,1('C!*'2!4()J'.g&)!-!4-(&#(!*'2!.)$).#,#'$&)!*'!2)%!)1F'&#:)%!*'2!4()J'.&)W!*'2!*),#$#)!J!*'2!4'(O#2!*'!2-%!I$#*-*'%!#$.2I#*-%!'$!'2!'%&I*#)D!L$!OI$.#5$!*'!2-!*#,'$%#5$!'%&#,-*-!J!*'!2)%!)1F'&#:)%!*'2!4()J'.&)!%'!'%g.)6'$!-26I$-%!*'!2-%!&;.$#.-%!-!I#Q-(!'$!'2!4()J'.&)D!/)(!'F',42)W!%#!'2!4()J'.&)!&#'$'!.),)!)1gF'&#:)!2-!('-2#Q-.#5$!*'!I$!-$82#%#%!#$#.#-2!6'$;(#.)W!2-!&;.$#.-!*'!.82.I2)!*'2!(#'%6)!%'!)(#'$&-!-!I$-!*#%.(#,#$-.#5$!*#.)&5,#.-!?'$!*)%!12)UI'%C!*'!2)%!(#'%6)%W!%'60$!UI'!'M#F-$!)!$)!)&(-%!-42#.-.#)g$'%!,8%!*'&-22-*-%!*'!-$82#%#%D!
/)(!)&(-!4-(&'!2-!&-('-!&-,1#;$!*#,'$%#)$-!'2!4()J'.&)!'$!.I-$&)!-!%I!.)%&'!J!2)%!('&)($)%!)!1'$'gO#.#)%!UI'!4I'*'!-4)(&-(W!4-(-!UI'!2-!\#('..#5$!4I'*-!&),-(!.)$!OI$*-,'$&)!2-!*'.#%#5$!*'!',g4('$*'(2)!J!-%#6$-(!2)%!('.I(%)%!$'.'%-(#)%!4-(-!%I!*'%-(()22)D!
!" L2! '%&I*#)! *'2! .)%&'! *'2! 4()J'.&)! %'! ('-2#Q-! '%&#,-$*)! 2)%! &#',4)%! J! 4'(O#2'%! *'! 4'(%)$-2!-%#6$-*)!-!2-%!'&-4-%!*'2!4()J'.&)!*#,'$%#)$-*)!-$&'(#)(,'$&'D!
!" L2! '%&I*#)! *'! 2)%! ('&)($)%! %52)!4I'*'! %'(!,IJ! #,4('.#%)!'$!'%&'!4().'%)! #$#.#-2W! 4I'%!$)!4I'*'!&'$'(!'$!.I'$&-!-0$!'2!:'(*-*'()!('&)($)!*'!I$!4()J'.&)!*'!%'6I(#*-*W!UI'!'%!4('.#g%-,'$&'!'2!.)%&'!*'!$)!&'$'(!*#.V-!%'6I(#*-*!'$!'2!*),#$#)!'%&I*#-*)!)!%'-!'2!('%I2&-*)!*'2!4()4#)!4()J'.&)!+^ZD!
"-6'(#&!:'(%#5$!<! ! L%&(I.&I(-.#5$!*'2!4()J'.&)!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!BK!?*'!@ABC!
3.3.3. Actividad A1.3: Planificación del proyecto
L$!'%&-!-.&#:#*-*!%'!*'&'(,#$-$!2)%!4-(&#.#4-$&'%!'$!'2!4()J'.&)W!*'&'(,#$-$*)!%I%!.-(6-%!*'!&(-g1-F)W!%I!'%&(I.&I(-.#5$!'$!6(I4)%!J!%I!,)*)!*'!-.&I-.#5$D!
L%&-!-.&#:#*-*!.)$%&-!*'!&('%!&-('-%[!
`@D>D@[!L:-2I-(!.-(6-%!J!42-$#O#.-(!'$&(':#%&-%!
`@D>D<[!E(6-$#Q-(!-!2)%!4-(&#.#4-$&'%!
`@D>D>[!/2-$#O#.-(!'2!&(-1-F)!
P1: Planificación A1.3: Planificación del proyecto T1.3.1: Evaluar cargas y planificar entrevistas
Objetivos
!" \'O#$#(!2)%!6(I4)%!*'!#$&'(2).I&)('%[!I%I-(#)%!-O'.&-*)%!'$!.-*-!I$#*-*!
!" /2-$#O#.-(!2-%!'$&(':#%&-%!*'!('.)6#*-!*'!#$O)(,-.#5$!
Productos de entrada
!" Z'%I2&-*)%!*'!2-!-.&#:#*-*!+@D<W!\'&'(,#$-.#5$!*'2!-2.-$.'!*'2!4()J'.&)!
Productos de salida
!" Z'2-.#5$!*'!4-(&#.#4-$&'%!'$!2)%!6(I4)%!*'!#$&'(2).I&)('%!
!" /2-$!*'!'$&(':#%&-%!
!" H$O)(,'!*'!.-(6-%!
Técnicas, prácticas y pautas
!" /2-$#O#.-.#5$!*'!4()J'.&)%!?:'(!m^IR-!*'!`;.$#.-%m!>DAC!
Participantes
!" L2!*#('.&)(!*'!4()J'.&)!
!" L2!.),#&;!*'!%'6I#,#'$&)!
!
L2!42-$!*'!'$&(':#%&-%!*'1'!*'&-22-(!-!UI;!4'(%)$-!%'!:-!-!'$&(':#%&-(W!.I8$*)!J!.)$!UI;!)1F'&#:)D!L%&'!42-$!4'(,#&'!*'&'(,#$-(!2-!.-(6-!UI'!'2!4()J'.&)!:-!-!%I4)$'(!4-(-!2-%!I$#*-*'%!-O'.&-*-%W!1#'$!*'2!*),#$#)W!1#'$!*'2!'$&)($)D!
L2!42-$!*'!'$&(':#%&-%!'%!'%4'.#-2,'$&'!#,4)(&-$&'!.I-$*)!2)%!%IF'&)%!-!'$&(':#%&-(!%'!V-J-$!'$!*#O'('$&'%! 2).-2#Q-.#)$'%!6')6(8O#.-%!J! 2-!'$&(':#%&-! ('UI#'('!'2!*'%42-Q-,#'$&)!*'!I$-!)!-,1-%!4-(&'%D!!
`-,1#;$! .)$:#'$'! )(*'$-(! 2-%! '$&(':#%&-%! *'! O)(,-!UI'!4(#,'()! %'! ('.-1'$! 2-%! )4#$#)$'%!,8%!&;.$#.-%! J! 4)%&'(#)(,'$&'! 2-%! 6'('$.#-2'%W! *'! O)(,-! UI'! '2! '$&(':#%&-*)(! 4I'*-! ':)2I.#)$-(! 2-%!4('6I$&-%! &),-$*)! '$! .)$%#*'(-.#5$! V'.V)%! ?'M4'(#'$.#-! V#%&5(#.-C! -$&'%! UI'! :-2)(-.#)$'%! J!4'(%4'.&#:-%!*'!%'(:#.#)!-!&'(.'()%D!
"-6'(#&!:'(%#5$!<! ! L%&(I.&I(-.#5$!*'2!4()J'.&)!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!BN!?*'!@ABC!
P1: Planificación A1.3: Planificación del proyecto T1.3.2: Organizar a los participantes
Objetivos!
!" \'&'(,#$-(! 2)%! 5(6-$)%! 4-(&#.#4-$&'%! '$! 2-! 6'%$W! ('-2#Q-.#5$W! %'6I#,#'$&)! J! ,-$&'$#g,#'$&)!*'2!4()J'.&)!
!" \'O#$#(!2-%!OI$.#)$'%!J!('%4)$%-1#2#*-*'%!*'!2)%!5(6-$)%!4-(&#.#4-$&'%!
!" L%&-12'.'(!2-%!('62-%!J!2)%!,)*)%!)4'(-&#:)%!
!" L%&-12'.'(!2-!.2-%#O#.-.#5$!*'!2-!#$O)(,-.#5$!6'$'(-*-!
Productos de entrada
!" Z'%I2&-*)%!*'!2-!-.&#:#*-*!+@D<W!\'&'(,#$-.#5$!*'2!-2.-$.'!*'2!4()J'.&)!
Productos de salida
!" e)(,-2#Q-.#5$!*'2!.),#&;!*'!*#('..#5$!
!" e)(,-2#Q-.#5$!*'2!.),#&;!*'!%'6I#,#'$&)!
!" 3(#&'(#)%!J!4().'*#,#'$&)%!*'!.2-%#O#.-.#5$!J!6'%$!*'!2-!#$O)(,-.#5$!6'$'(-*-!
!" \'%#6$-.#5$!*'2!'$2-.'!)4'(-.#)$-2!
!" 3('-.#5$!*'2!'UI#4)!*'!&(-1-F)!
Técnicas, prácticas y pautas
7)!-42#.-!
Participantes
!" 3),#&;!*'!%'6I#,#'$&)!
!" \#('.&)(!*'2!4()J'.&)!
!
+I$UI'!&)*)%!2)%!4()J'.&)%!+^Z!#$:)2I.(-$!18%#.-,'$&'!-!2)%!,#%,)%!.),#&;%W!'$!'%&-!&-('-!%'!.)$.('&-!2-!-4()M#,-.#5$!6'$;(#.-!-2!.-%)!4-(&#.I2-(W!4I*#'$*)!-&'$'(%'!-2!.-%)!6'$'(-2W!)!4-(&#.Ig2-(#Q-(D!
L%!4-(&#.I2-(,'$&'!('2':-$&'!*'&'(,#$-(!2-!.2-%#O#.-.#5$!*'!2)%!*).I,'$&)%!UI'!%'!4()*IQ.-$!-!2)!2-(6)!*'2!4()J'.&)D!]#!'M#%&'!I$-!$)(,-!*'!.2-%#O#.-.#5$W!.)$:#'$'!-&'$'(%'!-!'22-!4-(-!-4():'.V-(!4().'*#,#'$&)%!J-!'%&-12'.#*)%!*'! &(-&-,#'$&)!*'! 2)%!*).I,'$&)%D!]#!$)!'M#%&#'(-W!'%!$'.'%-(#)!'2-1)(-(!&-$&)!2)%!.(#&'(#)%!*'!.2-%#O#.-.#5$!.),)!2)%!4().'*#,#'$&)%!*'!&(-&-,#'$&)D!T-!.-2#O#.-.#5$!4)(!*'O'.&)!%'(8!j.)$O#*'$.#-2kW!%#'$*)!4-(&#.I2-(,'$&'!#,4)(&-$&'!4('%'(:-(!2-!.)$O#*'$.#-2#*-*!*'!2)%!*).I,'$&)%!*'!':-2I-.#5$!*'!%-2:-6I-(*-%!J!*'!#$%IO#.#'$.#-%D!
"-6'(#&!:'(%#5$!<! ! L%&(I.&I(-.#5$!*'2!4()J'.&)!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!BP!?*'!@ABC!
P1: Planificación A1.3: Planificación del proyecto T1.3.3: Planificar el trabajo
Objetivos
!" L2-1)(-(!'2!.-2'$*-(#)!.)$.('&)!*'!('-2#Q-.#5$!*'!2-%!*#%&#$&-%!'&-4-%W!-.&#:#*-*'%!J!&-('-%!*'2!4()J'.&)!
!" L%&-12'.'(!I$!.-2'$*-(#)!*'!%'6I#,#'$&)!UI'!*'O#$-!2-%!O'.V-%!&'$&-&#:-%!*'!('I$#)$'%!*'2!.),#&;!*'!*#('..#5$W!'2!42-$!*'!'$&('6-%!*'!2)%!4()*I.&)%!*'2!4()J'.&)W!2-%!4)%#12'%!,)*#O#g.-.#)$'%!'$!2)%!)1F'&#:)%!,-(.-*)%W!'&.D!
Productos de entrada
!" Z'%I2&-*)%!*'!2-!-.&#:#*-*!+@D<W!\'&'(,#$-.#5$!*'2!-2.-$.'!*'2!4()J'.&)!
!" Z'%I2&-*)%!*'!2-!&-('-!`@D>D@W!L:-2I-(!.-(6-%!J!42-$#O#.-(!'$&(':#%&-%!
!" Z'%I2&-*)%!*'!2-!&-('-!`@D>D<W!E(6-$#Q-(!-!2)%!4-(&#.#4-$&'%!
Productos de salida
!" 3()$)6(-,-!*'2!4()J'.&)!
!" \'*#.-.#)$'%!*'!2)%!4-(&#.#4-$&'%!
!" L%4'.#O#.-.#5$!*'!2)%!('.I(%)%!,-&'(#-2'%!$'.'%-(#)%!
!" \'%.(#4.#5$!*'!V#&)%!
Técnicas, prácticas y pautas
!" /2-$#O#.-.#5$!*'!4()J'.&)%!?:'(!m^IR-!*'!`;.$#.-%m!>DAC!
Participantes
!" L2!'UI#4)!*'!4()J'.&)!
"-6'(#&!:'(%#5$!<! ! L%&(I.&I(-.#5$!*'2!4()J'.&)!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!AS!?*'!@ABC!
3.3.4. Actividad A1.4: Lanzamiento del proyecto
L%&-!-.&#:#*-*!.),42'&-!2-%!&-('-%!4('4-(-&)(#-%!*'2!2-$Q-,#'$&)!*'2!4()J'.&)[!',4'Q-$*)!4)(!%'g2'..#)$-(!J!-*-4&-(!2)%!.I'%&#)$-(#)%!UI'!%'!I#Q-(8$!'$!2-!('.)6#*-!*'!*-&)%W!-%R!.),)!'%4'.#O#g.-(!2)%!.(#&'(#)%!J!2-%!&;.$#.-%!.)$.('&-%!-!',42'-(h!J!&'(,#$-$*)!4)(!-%#6$-(!2)%!('.I(%)%!$'.'%-g(#)%!4-(-!2-!('-2#Q-.#5$!*'2!4()J'.&)!J!4)(!('-2#Q-(!2-!.-,4-c-!#$O)(,-&#:-!*'!%'$%#1#2#Q-.#5$!-!2)%!#,42#.-*)%D!
L%&-!-.&#:#*-*!.)$%&-!*'!.I-&()!&-('-%[!
`@DBD@[!+*-4&-(!2)%!.I'%&#)$-(#)%!
`@DBD<[!3(#&'(#)%!*'!':-2I-.#5$!
`@DBD>[!Z'.I(%)%!$'.'%-(#)%!
`@DBDB[!]'$%#1#2#Q-.#5$!
P1: Planificación A1.4: Lanzamiento del proyecto T1.4.1: Adaptar los cuestionarios
Objetivos
!" H*'$&#O#.-(!2-!#$O)(,-.#5$!('2':-$&'!-!)1&'$'(W!-6(I4-*-!*'!-.I'(*)!-!2-!'%&(I.&I(-!*'!I$#g*-*'%!J!()2'%!*'!2)%!4-(&#.#4-$&'%!
Productos de entrada
!" Z'%I2&-*)%!*'!2-!-.&#:#*-*!+@D>W!/2-$#O#.-.#5$!*'2!4()J'.&)!
Productos de salida
!" 3I'%&#)$-(#)%!-*-4&-*)%!
Técnicas, prácticas y pautas
!" 3I'%&#)$-(#)%!?:'(!m3-&82)6)!*'!L2','$&)%m!'$!6'$'(-2!J!'2!-4;$*#.'!<!'$!4-(&#.I2-(C!
Participantes
!" L2!'UI#4)!*'!4()J'.&)!
!
T-!&-('-!-*-4&-!2)%!.I'%&#)$-(#)%!-!I#Q-(!'$!2-!('.)6#*-!*'!#$O)(,-.#5$!'$!'2!4().'%)!/@!'$!OI$g.#5$!*'!2)%!)1F'&#:)%!*'2!4()J'.&)W!*'2!*),#$#)!J!*'!2)%!&',-%!-!4()OI$*#Q-(!.)$!2)%!I%I-(#)%D!
T)%!.I'%&#)$-(#)%!%'!-*-4&-$!.)$!'2!)1F'&#:)!*'!#*'$&#O#.-(!.)(('.&-,'$&'!2)%!'2','$&)%!*'!&(-1-F)[!-.&#:)%W!-,'$-Q-%W!:I2$'(-1#2#*-*'%W! #,4-.&)%W!%-2:-6I-(*-%!'M#%&'$&'%W! ('%&(#..#)$'%!6'$'(-2'%W!'&.D!'$!4(':#%#5$!*'!2-%!$'.'%#*-*'%!*'!2-%!-.&#:#*-*'%!+<D@!?.-(-.&'(#Q-.#5$!*'!2)%!-.&#:)%CW!+<D<!?.-(-.&'(#Q-.#5$!*'!2-%!-,'$-Q-%C!J!+<D>!?.-(-.&'(#Q-.#5$!*'!2-%!%-2:-6I-(*-%CD!
T-!$'.'%#*-*!*'!I$-!-*-4&-.#5$!%#',4('!'M#%&'!?*'1#*)!-2!-,42R%#,)!'%4'.&()!*'!2)%!4()12',-%!*'!%'6I(#*-*!UI'!4I'*'!J!*'1'!&(-&-(!"-6'(#&CD!/'()!'2!6(-*)!,-J)(!)!,'$)(!*'!-*-4&-.#5$!*'g4'$*'!-*',8%!*'! 2-%! .)$*#.#)$'%!'$!UI'!%'! ('-2#.'! 2-!'M42)&-.#5$!*'!*#.V)%!.I'%&#)$-(#)%D!7)!V-1(8!2-!,#%,-!4()OI$*#*-*!*'!-*-4&-.#5$!4-(-!'$&(':#%&-%!6I#-*-%!4)(!'2!'%4'.#-2#%&-!'$!%'6I(#g*-*W!UI'!4-(-!.I'%&#)$-(#)%!!-I&)!-*,#$#%&(-*)%!4)(!'2!('%4)$%-12'!*'2!*),#$#)!)!4)(!2)%!I%I-(#)%!*'!%I%!%#%&',-%!*'!#$O)(,-.#5$D!
"-6'(#&!:'(%#5$!<! ! L%&(I.&I(-.#5$!*'2!4()J'.&)!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!A@!?*'!@ABC!
P1: Planificación A1.4: Lanzamiento del proyecto T1.4.2: Criterios de evaluación
Objetivos
!" \'&'(,#$-(!'2!.-&82)6)!*'!)%!*'!-.&#:)%!
!" \'&'(,#$-(!2-%!*#,'$%#)$'%!*'!:-2)(-.#5$!*'!-.&#:)%!
!" \'&'(,#$-(!2)%!$#:'2'%!*'!:-2)(-.#5$!*'!-.&#:)%W!#$.2IJ'$*)!I$-!6IR-!I$#O#.-*-!*'!.(#&'(#)%!4-(-!-%#6$-(!I$!.#'(&)!$#:'2!-!I$!.#'(&)!-.&#:)!
!" \'&'(,#$-(!2)%!$#:'2'%!*'!:-2)(-.#5$!*'!2-%!-,'$-Q-%[!O('.I'$.#-!J!*'6(-*-.#5$!
Productos de entrada
!" 3-&82)6)!*'!'2','$&)%!
!" Z'%I2&-*)%!*'!2-!-.&#:#*-*!+@D>W!/2-$#O#.-.#5$!*'2!4()J'.&)!
Productos de salida
!" 3-&82)6)!*'!)%!*'!-.&#:)%!
!" Z'2-.#5$!*'!*#,'$%#)$'%!*'!%'6I(#*-*!
!" 3(#&'(#)%!*'!:-2)(-.#5$!
Técnicas, prácticas y pautas
!" _'(!m3-&82)6)!*'!L2','$&)%m!.-4R&I2)%!<W!>!J!B!
Participantes
!" L2!'UI#4)!*'!4()J'.&)!
!
L%&-!&-('-W!4('4-(-&)(#-!*'2!4().'%)!/<!?-$82#%#%!*'!(#'%6)%CW!'%&-12'.'!2-!%'2'..#5$!*'!2)%!.(#&'(#)%!J!&;.$#.-%!UI'!%'!,-$&'$*(8$!-!2)!2-(6)!*'!&)*)!'2!4().'%)D!L$!'O'.&)W! 2-!6'%$!*'!2)%!(#'%6)%!*'2!4().'%)!/>!'%&-(8!.)$*#.#)$-*-!4)(!'2! )!*'!-$82#%#%!('-2#Q-*)!'$!'2!4().'%)!/<[!%#!%'!V-$!'2'6#*)!I$!)!*'!.(#&'(#)%!J!&;.$#.-%!4-(-!':-2I-(! 2)%!(#'%6)%W!'%!('.),'$*-12'!-42#.-(!2-%!,#%g,-%! &;.$#.-%!4-(-!':-2I-(! 2-! ('*I..#5$!*'! (#'%6)%!-2! #,42-$&-(! 2-%!%-2:-6I-(*-%!4()4I'%&-%D!T-!'2'..#5$!*'!'%&)%!.(#&'(#)%!J!&;.$#.-%!'$!OI$.#5$!*'[!
!" 2)%!)1F'&#:)%!*'2!4()J'.&)!?`@D<D@C!
!" '2!*),#$#)!*'2!4()J'.&)!?`@D<D<C!
]'!('.),#'$*-!-&'$'(%'!-!2)!4()4I'%&)!'$!'2!2#1()!j3-&82)6)!*'!L2','$&)%k!-$'F)!-!'%&-!6IR-D!
"-6'(#&!:'(%#5$!<! ! L%&(I.&I(-.#5$!*'2!4()J'.&)!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!A<!?*'!@ABC!
P1: Planificación A1.4: Lanzamiento del proyecto T1.4.3: Recursos necesarios
Objetivos
!" +%#6$-(!2)%!('.I(%)%!$'.'%-(#)%!?VI,-$)%W!*'!)(6-$#Q-.#5$W!&;.$#.)%W!'&.DC!4-(-!2-!('-2#Q-g.#5$!*'2!4()J'.&)!+^Z!
Productos de entrada
!" Z'%I2&-*)%!*'!2-!-.&#:#*-*!+@D>W!/2-$#O#.-.#5$!*'2!4()J'.&)!
Productos de salida
!" 3),I$#.-.#)$'%!-2!4'(%)$-2!4-(&#.#4-$&'!*'!%I!-%#6$-.#5$!-2!4()J'.&)!
!" \#%4)$#1#2#*-*!*'!2)%!,'*#)%!,-&'(#-2'%!$'.'%-(#)%!
Técnicas, prácticas y pautas
!" /2-$#O#.-.#5$!*'!4()J'.&)%!?:'(!m^IR-!*'!`;.$#.-%m!>DAC!
Participantes
!" L2!.),#&;!*'!%'6I#,#'$&)!
!
"-6'(#&!:'(%#5$!<! ! L%&(I.&I(-.#5$!*'2!4()J'.&)!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!A>!?*'!@ABC!
P1: Planificación A1.4: Lanzamiento del proyecto T1.4.4: Sensibilización
Objetivos
!" H$O)(,-(!-!2-%!I$#*-*'%!-O'.&-*-%!
!" 3('-(!I$!-,1#'$&'!*'!.)$).#,#'$&)!6'$'(-2!*'!2)%!)1F'&#:)%W!('%4)$%-12'%!J!42-Q)%!
Productos de entrada
!" Z'%I2&-*)%!*'!2-!-.&#:#*-*!+@D>W!/2-$#O#.-.#5$!*'2!4()J'.&)!
Productos de salida
!" 7)&-!#$O)(,-&#:-!*'!2-!*#('..#5$!
!" "-&'(#-2!'!#$O)(,'!*'!4('%'$&-.#5$!*'2!4()J'.&)!
Técnicas, prácticas y pautas
!" /('%'$&-.#)$'%!?:'(!m^IR-!*'!`;.$#.-%m!>DGD>C!
Participantes
!" L2!*#('.&)(!*'2!4()J'.&)!
!" L2!.),#&;!*'!%'6I#,#'$&)!
!" L2!'$2-.'!)4'(-.#)$-2!
!" L2!'UI#4)!*'!4()J'.&)!
L%&-!&-('-!#$O)(,-!-!2-%!I$#*-*'%!-O'.&-*-%!*'2!2-$Q-,#'$&)!*'2!4()J'.&)!+^ZW!4)(!*#:'(%)%!,'g*#)%W!J!.),)!,R$#,)[!
!" 9$-! $)&-! #$O)(,-&#:-! *'! 2-! \#('..#5$W! *#(#6#*-! -! 2-%! I$#*-*'%! #,42#.-*-%! J! *'.2-(-$*)! %I!-4)J)!-!2-!('-2#Q-.#5$!*'2!4()J'.&)D!
!" T-! 4('%'$&-.#5$! *'2! 4()J'.&)W! %I%! )1F'&#:)%! J! 2-!,'&)*)2)6R-! -! ',42'-(W! ('-2#Q-*-! '$! 2-%!I$#*-*'%!#,42#.-*-%!4)(!4-(&'!*'2!'UI#4)!*'!4()J'.&)D!
"-6'(#&!:'(%#5$!<! ! L%&(I.&I(-.#5$!*'2!4()J'.&)!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!AB!?*'!@ABC!
3.3.5. Síntesis del proceso P1
3.3.5.1. Hitos de control
Hito de control H1.1:
T-!\#('..#5$!4().'*'(8!-!2-!-4()1-.#5$!)!$)!*'!2-!('-2#Q-.#5$!*'2!4()J'.&)!+^ZW!1-%8$*)%'!'$!'2!'%&I*#)!*'!)4)(&I$#*-*!('-2#Q-*)!4)(!'2!4(),)&)(D!
Hito de control H1.2:
L2!.),#&;!*#('.&)(!*'2!4()J'.&)!:-2#*-(8!'2!#$O)(,'!*'!m/2-$#O#.-.#5$!*'2!/()J'.&)!*'!+$82#%#%!J!^'%$!*'!Z#'%6)%m!UI'!.)$&'$*(8!I$-!%R$&'%#%!*'!2)%!4()*I.&)%!)1&'$#*)%!'$!2-%!-.&#:#g*-*'%!('-2#Q-*-%!'$!'2!4().'%)!/@D!
3.3.5.2. Resultados
Documentación intermedia
!" Z'%I2&-*)%!*'!2-%!'$&(':#%&-%D!
!" \).I,'$&-.#5$!*'!)&(-%! OI'$&'%[!'%&-*R%&#.-%W!)1%'(:-.#)$'%!*'!'M4'(&)%!J!)1%'(:-.#)$'%!*'!2)%!-$-2#%&-%D!
!" \).I,'$&-.#5$!-IM#2#-([!42-$)%W!)(6-$#6(-,-%W! ('UI#%#&)%W!'%4'.#O#.-.#)$'%W!-$82#%#%! OI$.#)g$-2'%W! .I-*'($)%!*'!.-(6-W!,-$I-2'%!*'!I%I-(#)W!,-$I-2'%!*'!'M42)&-.#5$W!*#-6(-,-%!*'!O2IF)!*'!#$O)(,-.#5$!J!*'!4().'%)%W!,)*'2)%!*'!*-&)%W!'&.D!
!" +$82#%#%!*'!2)%!('%I2&-*)%W!.)$!2-!*'&'..#5$!*'!2-%!8('-%!.(R&#.-%!.2-:'%D!
!" H$O)(,-.#5$!'M#%&'$&'!I#Q-12'!4)(!'2!4()J'.&)!?4)(!'F',42)!#$:'$&-(#)!*'!-.&#:)%C!
!" Z'%I2&-*)%!*'!4)%#12'%!-42#.-.#)$'%!*'!,;&)*)%!*'!-$82#%#%!J!6'%$!*'!(#'%6)%!('-2#Q-*-%!-$&'(#)(,'$&'! ?4)(! 'F',42)! .-&-2)6-.#5$W! -6(I4-.#5$! J! :-2)(-.#5$! *'! -.&#:)%W! -,'$-Q-%W!:I2$'(-1#2#*-*'%W!#,4-.&)%W!(#'%6)W!,'.-$#%,)%!*'!%-2:-6I-(*-W!'&.DCD!
Documentación final
!" `#4)2)6R-!*'!-.&#:)%!
!" \#,'$%#)$'%!*'!%'6I(#*-*!('2':-$&'%!
!" 3(#&'(#)%!*'!':-2I-.#5$!
!" H$O)(,'!*'!m/2-$#O#.-.#5$!*'2!/()J'.&)!*'!+$82#%#%!J!^'%$!*'!(#'%6)%m!UI'!.)$&'$*(8!I$-!%R$&'%#%!*'!2)%!4()*I.&)%!)1&'$#*)%!'$!2-%!-.&#:#*-*'%!('-2#Q-*-%!'$!'2!4().'%)!/@D!
3.3.6. Lista de control34 del proceso P1
Organización del proyecto:
#" +4()1-.#5$!*'!2-!\#('..#5$!?/@C!
#" 3),4(),#%)!'M42R.#&)!*'!2-!\#('..#5$!?/@C!
#" +4)J)!*'!2-!\#('..#5$!?/@C!
#" 3),#&;!*'!%'6I#,#'$&)!?`@D>D<C!
#" LUI#4)!*'!4()J'.&)!?`@D>D<C!
#" \#('.&)(!*'!4()J'.&)!?`@D<D<C!
#" L$2-.'!)4'(-.#)$-2!?`@D>D<C!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
>B!L%&-!2#%&-!4'(,#&'!.),4()1-(!UI'!%'!V-$!-2.-$Q-*)!&)*)%!2)%!)1F'&#:)%W!%I1)1F'&#:)%!J!4()*I.&)%!*'!%-2#g*-!*'&-22-*)%!'$!2-%!*#O'('$&'%!&-('-%D!
"-6'(#&!:'(%#5$!<! ! L%&(I.&I(-.#5$!*'2!4()J'.&)!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!AA!?*'!@ABC!
#" ^(I4)%!*'!#$&'(2).I&)('%!?`@D>D@C!
#" eI$.#)$'%!J!,;&)*)!*'!&(-1-F)!?`@D>D<C!
#" 3(#&'(#)%!*'!.2-%#O#.-.#5$!*'!2-!*).I,'$&-.#5$!J!4().'*#,#'$&)%!4-(-!&(-&-(2-!?`@D>D<C!
Planificación del proyecto:
#" H$O)(,'!4('2#,#$-(!('.),'$*-$*)!J!FI%&#O#.-$*)!2-!)4)(&I$#*-*!*'!2-$Q-(!I$!4()J'.&)!+^Z!?`@D@D@C!
#" E1F'&#:)%!'M4('%)%!J!$)!-,1#6I)%!?`@D<D@C!
#" L%&#,-.#5$!*'!*#,'$%#)$'%!J!.)%&'!?`@D<DBC!
#" /2-$!*'!'$&(':#%&-%[!4'(%)$-%!J!O'.V-%!?`@DBD>C!
#" /2-$!*'!&(-1-F)[!V#&)%!?`@D>D>C!
#" +%#6$-.#5$!*'!('.I(%)%!?`@DBD>C!
#" ]'$%#1#2#Q-.#5$!*'!2-!E(6-$#Q-.#5$!?`@DBDBC!
#" /2-$!*'!/()J'.&)!*'!+$82#%#%!J!^'%$!*'!Z#'%6)%!?/@C!
Aspectos técnicos:
#" T#,#&-.#)$'%!6'$'(-2'%!*'2!4()J'.&)!?`@D<D@C!
#" \),#$#)!*'2!4()J'.&)[!I$#*-*'%!#$.2I#*-%!'$!'2!-$82#%#%!?`@D<D<C!
#" L$&)($)!*'2!4()J'.&)[!)&(-%!I$#*-*'%!('2-.#)$-*-%!*'!-26I$-!O)(,-!?`@D<D>C!
#" 3I'%&#)$-(#)%!-*-4&-*)%!?`@DBD@C!
#" 3-&82)6)!*'!)%!*'!-.&#:)%!?`@DBD<C!
#" Z'2-.#5$!*'!*#,'$%#)$'%!*'!%'6I(#*-*!('2':-$&'%!?`@DBD<C!
#" 3(#&'(#)%!*'!':-2I-.#5$!?`@DBD<C!
"-6'(#&!:'(%#5$!<! ! L%&(I.&I(-.#5$!*'2!4()J'.&)!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!AG!?*'!@ABC!
3.4. Proceso P2: Análisis de riesgos L%&'!4().'%)!'%!'2!$0.2')!.'$&(-2!*'!"-6'(#&!J!%I!.)(('.&-!-42#.-.#5$!.)$*#.#)$-!2-!:-2#*'Q!J!I#g*-*!*'!&)*)!'2!4()J'.&)D!T-!#*'$&#O#.-.#5$!J!'%&#,-.#5$!*'!2)%!-.&#:)%!J!*'!2-%!4)%#12'%!-,'$-Q-%!UI'!2'%!-.'.V-$!('4('%'$&-!I$-!&-('-!.),42'F-D!
L%&'!4().'%)!&#'$'!2)%!%#6I#'$&'%!)1F'&#:)%[!
!" T':-$&-(!I$!,)*'2)!*'2!:-2)(!*'2!%#%&',-W!#*'$&#O#.-$*)!J!:-2)(-$*)!2)%!-.&#:)%!('2':-$&'%D!
!" T':-$&-(! I$!,-4-! *'! (#'%6)%! *'2! %#%&',-W! #*'$&#O#.-$*)! J! :-2)(-$*)! 2-%! -,'$-Q-%! %)1('!-UI'22)%!-.&#:)%D!
!" T':-$&-(!I$!.)$).#,#'$&)!*'!2-!%#&I-.#5$!-.&I-2!*'!%-2:-6I-(*-%D!
!" L:-2I-(!'2!#,4-.&)!4)%#12'!%)1('!'2!%#%&',-!'$!'%&I*#)W!&-$&)!'2!#,4-.&)!4)&'$.#-2!?%#$!%-2:-g6I-(*-%CW!.),)!'2! #,4-.&)! ('%#*I-2! ?#$.2IJ'$*)!'2!'O'.&)!*'! 2-%!%-2:-6I-(*-%! #,42','$&-g*-%!%#!%'!&(-&-!*'!I$!%#%&',-!-.&I-2W!$)!*'!I$!%#%&',-!4(':#%&)CD!
!" L:-2I-(!'2!(#'%6)!*'2!%#%&',-!'$!'%&I*#)W!&-$&)!'2!(#'%6)!4)&'$.#-2!?%#$!%-2:-6I-(*-%CW!.),)!'2!(#'%6)!('%#*I-2!?#$.2IJ'$*)!'2!'O'.&)!*'!2-%!%-2:-6I-(*-%!#,42','$&-*-%!%#!%'!&(-&-!*'!I$!%#%&',-!-.&I-2W!$)!*'!I$!%#%&',-!4(':#%&)CD!
!" ")%&(-(!-2!.),#&;!*#('.&)(!2-%!8('-%!*'2!%#%&',-!.)$!,-J)(!#,4-.&)!Jd)!(#'%6)D!
L2!4I$&)!*'!4-(&#*-!*'!'%&'!4().'%)!'%!2-!*).I,'$&-.#5$!*'2!-$&'(#)(!('O'('$&'!-!2)%!)1F'&#:)%!*'2!4()J'.&)W!2)%!42-$'%!*'!'$&(':#%&-%W!2-!':-2I-.#5$!*'!.-(6-%W!2-!.),4)%#.#5$!J!('62-%!*'!-.&I-.#5$!*'2!'UI#4)!*'!4-(&#.#4-$&'%W!'2!42-$!*'!&(-1-F)!J!'2!#$O)(,'!*'!4('%'$&-.#5$!*'2!4()J'.&)D!
L%&'!4().'%)!%'!*'%-(()22-!4)(!,'*#)!*'!2-%!%#6I#'$&'%!-.&#:#*-*'%!J!&-('-%[!
Actividad 2.1: Caracterización de los activos
L%&-!-.&#:#*-*!1I%.-!#*'$&#O#.-(!2)%!-.&#:)%!('2':-$&'%!*'$&()!*'2!%#%&',-!-!-$-2#Q-(W!.-(-.&'g(#Q8$*)2)%!4)(!'2!)!*'!-.&#:)W!#*'$&#O#.-$*)!2-%!('2-.#)$'%!'$&('!2)%!*#O'('$&'%!-.&#:)%W!*'g&'(,#$-$*)!'$!UI;!*#,'$%#)$'%!*'!%'6I(#*-*!%)$!#,4)(&-$&'%!J!:-2)(-$*)!'%&-!#,4)(&-$.#-D!
L2!('%I2&-*)!*'!'%&-!-.&#:#*-*!'%!'2!#$O)(,'!*'$),#$-*)!j,)*'2)!*'!:-2)(kD!
`-('-%[!
Tarea T2.1.1: H*'$&#O#.-.#5$!*'!2)%!-.&#:)%!
Tarea T2.2.2:!\'4'$*'$.#-%!'$&('!-.&#:)%!
Tarea T2.3.3: _-2)(-.#5$!*'!2)%!-.&#:)%!
Actividad 2.2: Caracterización de las amenazas
L%&-!-.&#:#*-*!1I%.-!#*'$&#O#.-(!2-%!-,'$-Q-%!('2':-$&'%!%)1('!'2!%#%&',-!-!-$-2#Q-(W!.-(-.g&'(#Q8$*)2-%!4)(!2-!O('.I'$.#-!'%&#,-*-!*'!).I(('$.#-!J!2-!'%&#,-.#5$!*'!*-c)!?*'6(-*-.#5$C!UI'!.-I%-(R-$!%)1('!2)%!-.&#:)%D!
L2!('%I2&-*)!*'!'%&-!-.&#:#*-*!'%!'2!#$O)(,'!*'$),#$-*)!j,-4-!*'!(#'%6)%kD!
`-('-%[!
Tarea T2.2.1: H*'$&#O#.-.#5$!*'!2-%!-,'$-Q-%!
Tarea T2.2.2: _-2)(-.#5$!*'!2-%!-,'$-Q-%!
Actividad 2.3: Caracterización de las salvaguardas
L%&-!-.&#:#*-*!1I%.-!#*'$&#O#.-(!2-%!%-2:-6I-(*-%!*'%42'6-*-%!'$!'2!%#%&',-!-!-$-2#Q-(W!.-2#gO#.8$*)2-%!4)(!%I!'O#.-.#-!O('$&'!-!2-%!-,'$-Q-%!UI'!4('&'$*'$!,#-(D!
L2!('%I2&-*)!*'!'%&-!-.&#:#*-*!'%!'2!#$O)(,'!*'$),#$-*)!j':-2I-.#5$!*'!%-2:-6I-(*-%kD!
`-('-%[!
"-6'(#&!:'(%#5$!<! ! L%&(I.&I(-.#5$!*'2!4()J'.&)!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!AK!?*'!@ABC!
Tarea T2.3.1:!H*'$&#O#.-.#5$!*'!2-%!%-2:-6I-(*-%!'M#%&'$&'%!
Tarea T2.3.2: _-2)(-.#5$!*'!2-%!%-2:-6I-(*-%!'M#%&'$&'%!
Actividad 2.4: Estimación del estado de riesgo
L%&-!-.&#:#*-*!4().'%-!&)*)%!2)%!*-&)%!('.)4#2-*)%!'$!2-%!-.&#:#*-*'%!-$&'(#)('%!4-(-!
!" ('-2#Q-(!I$!#$O)(,'!*'2!'%&-*)!*'!(#'%6)[!'%&#,-.#5$!*'!#,4-.&)!J!(#'%6)!
!" ('-2#Q-(!I$!#$O)(,'!*'!#$%IO#.#'$.#-%[!*'O#.#'$.#-%!)!*'1#2#*-*'%!'$!'2!%#%&',-!*'!%-2g:-6I-(*-%!
`-('-%[!
Tarea T2.4.1:!L%&#,-.#5$!*'2!#,4-.&)!
Tarea T2.4.2: L%&#,-.#5$!*'2!(#'%6)!
Tarea T2.4.3: H$&'(4('&-.#5$!*'!2)%!('%I2&-*)%!
"-6'(#&!:'(%#5$!<! ! L%&(I.&I(-.#5$!*'2!4()J'.&)!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!AN!?*'!@ABC!
3.4.1. Actividad A2.1: Caracterización de los activos
L%&-!-.&#:#*-*!.)$%&-!*'!&('%!&-('-%[!
`<D@D@[!H*'$&#O#.-.#5$!*'!2)%!-.&#:)%!
`<D@D<[!\'4'$*'$.#-%!'$&('!-.&#:)%!
`<D@D>[!_-2)(-.#5$!*'!2)%!-.&#:)%!
L2!)1F'&#:)!*'!'%&-%!&-('-%!'%!('.)$).'(!2)%!-.&#:)%!UI'!.),4)$'$!2)%!4().'%)%W!J!*'O#$#(!2-%!*'g4'$*'$.#-%!'$&('!'22)%D!+%R!J!-!4-(&#(!*'!2-!#$O)(,-.#5$!('.)4#2-*-!'$!2-!-.&#:#*-*!-$&'(#)(W!'%&-!-.g&#:#*-*!4()OI$*#Q-!'2!'%&I*#)!*'!2-%!-.&#:)%!.)$!:#%&-%!-!)1&'$'(!2-!#$O)(,-.#5$!$'.'%-(#-!4-(-!('-g2#Q-(!2-%!'%&#,-.#)$'%!*'!(#'%6)D!
L%!O('.I'$&'!UI'!2-%!&-('-%!('2-.#)$-*-%!.)$!2)%!-.&#:)%!%'!('-2#.'$!.)$.I(('$&','$&'!.)$!2-%!&-g('-%!('2-.#)$-*-%!.)$!2-%!-,'$-Q-%!%)1('!*#.V)%!-.&#:)%!?+<D<C!'!#*'$&#O#.-.#5$!*'!2-%!%-2:-6I-(g*-%!-.&I-2'%!?+<D>CW!%#,42','$&'!4)(UI'!%I'2'$!.)#$.#*#(!2-%!4'(%)$-%!J!'%!*#OR.#2!UI'!'2!#$&'(2).Ig&)(!$)!&#'$*-!*'!O)(,-!$-&I(-2!-!&(-&-(!.-*-!-.&#:)!j:'(&#.-2,'$&'kW!:#'$*)!&)*)!2)!UI'!2'!-O'.&-!-$g&'%!*'!4-%-(!-2!%#6I#'$&'D!
!
"-6'(#&!:'(%#5$!<! ! L%&(I.&I(-.#5$!*'2!4()J'.&)!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!AP!?*'!@ABC!
P2: Análisis de riesgos A2.1: Caracterización de los activos T2.1.1: Identificación de los activos
Objetivos
!" H*'$&#O#.-(!2)%!-.&#:)%!UI'!.),4)$'$!'2!*),#$#)W!*'&'(,#$-$*)!%I%!.-(-.&'(R%&#.-%W!-&(#1I&)%!J!.2-%#O#.-.#5$!'$!2)%!)%!*'&'(,#$-*)%!
Productos de entrada
!" H$:'$&-(#)%!*'!*-&)%!,-$'F-*)%!4)(!2-!E(6-$#Q-.#5$!
!" /().'%)%!*'!$'6).#)!
!" \#-6(-,-%!*'!I%)!
!" \#-6(-,-%!*'!O2IF)!*'!*-&)%!
!" H$:'$&-(#)%!*'!'UI#4-,#'$&)!256#.)!
!" H$:'$&-(#)%!*'!'UI#4-,#'$&)!OR%#.)!
!" 3-(-.&'(#Q-.#5$!OI$.#)$-2!*'!2)%!4I'%&)%!*'!&(-1-F)!
!" T).-2'%!J!%'*'%!*'!2-!E(6-$#Q-.#5$!
Productos de salida
!" Z'2-.#5$!*'!-.&#:)%!-!.)$%#*'(-(!
!" 3-(-.&'(#Q-.#5$!*'!2)%!-.&#:)%!
Técnicas, prácticas y pautas
!" \#-6(-,-%!*'!O2IF)!*'!*-&)%!?:'(!m^IR-!*'!`;.$#.-%m!>D<C!
!" \#-6(-,-%!*'!4().'%)%!?:'(!m^IR-!*'!`;.$#.-%m!>D>C!
!" L$&(':#%&-%!?:'(!m^IR-!*'!`;.$#.-%m!>DGD@C!
!" Z'I$#)$'%!?:'(!m^IR-!*'!`;.$#.-%m!>DGD<C!
!" _'(!&-,1#;$!2-!%'..#5$!<D@D@D!
Participantes
!" L2!'UI#4)!*'!4()J'.&)!
!" T)%!6(I4)%!*'!#$&'(2).I&)('%!
!
L%&-!&-('-!'%!.(R&#.-D!9$-!1I'$-!#*'$&#O#.-.#5$!'%!#,4)(&-$&'!*'%*'!:-(#)%!4I$&)%!*'!:#%&-[!
!" ,-&'(#-2#Q-!.)$!4('.#%#5$!'2!-2.-$.'!*'2!4()J'.&)!
!" 4'(,#&'!2-%!#$&'(2).I.#5$!.)$!2)%!6(I4)%!*'!I%I-(#)%[!&)*)%!V-12-$!'2!,#%,)!2'$6I-F'!
!" 4'(,#&'!*'&'(,#$-(!2-%!*'4'$*'$.#-%!4('.#%-%!'$&('!-.&#:)%!
!" 4'(,#&'!:-2)(-(!2)%!-.&#:)%!.)$!4('.#%#5$!
!" 4'(,#&'!#*'$&#O#.-(!J!:-2)(-(!2-%!-,'$-Q-%!.)$!4('.#%#5$!
Caracterización de los activos
/-(-!.-*-!-.&#:)!V-J!UI'!*'&'(,#$-(!I$-!%'(#'!*'!.-(-.&'(R%&#.-%!UI'!2)!*'O#$'$[!
!" .5*#6)W!&R4#.-,'$&'!4().'*'$&'!*'2!#$:'$&-(#)!
!" $),1('!?.)(&)C!
!" *'%.(#4.#5$!?2-(6-C!
!" )!?)!)%C!UI'!.-(-.&'(#Q-$!'2!-.&#:)!
"-6'(#&!:'(%#5$!<! ! L%&(I.&I(-.#5$!*'2!4()J'.&)!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!GS!?*'!@ABC!
!" I$#*-*!('%4)$%-12'D!+!:'.'%!V-J!,8%!*'!I$-!I$#*-*D!/)(!'F',42)W!'$!'2!.-%)!*'!-42#.-.#)g$'%!.-1'!*#O'('$.#-(!'$&('!2-!I$#*-*!UI'!2-!,-$&#'$'!J!2-!UI'!2-!'M42)&-D!
!" 4'(%)$-!('%4)$%-12'D!L%4'.#-2,'$&'!('2':-$&'!'$!'2!.-%)!*'!*-&)%D!+!:'.'%!V-J!,8%!*'!I$!('%4)$%-12'D!/)(!'F',42)!'$!.-%)!*'!*-&)%!*'!.-(8.&'(!4'(%)$-2!.-1'!*#O'('$.#-(!'$&('!'2!('%4)$%-12'!*'2!*-&)!J!'2!)4'(-*)(!I!)4'(-*)('%!UI'!2)!,-$'F-$D!
!" I1#.-.#5$W!&;.$#.-!?'$!-.&#:)%!#$&-$6#12'%C!)!6')6(8O#.-!?'$!-.&#:)%!,-&'(#-2'%C!
!" .-$&#*-*W!%#!4().'*'!.),)!4I'*'!%'(!'$!'2!.-%)!*'!2-!#$O)(,8&#.-!4'(%)$-2!?4)(!'F',42)!>AS!'UI#4)%!*'!%)1(','%-C!
!" )&(-%!.-(-.&'(R%&#.-%!'%4'.RO#.-%!*'2!)!*'!-.&#:)!
"-6'(#&!:'(%#5$!<! ! L%&(I.&I(-.#5$!*'2!4()J'.&)!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!G@!?*'!@ABC!
P2: Análisis de riesgos A2.1: Caracterización de los activos T2.1.2: Dependencias entre activos
Objetivos
!" H*'$&#O#.-(!J!:-2)(-(!2-%!*'4'$*'$.#-%!'$&('!-.&#:)%W!'%!*'.#(!2-!,'*#*-!'$!UI'!I$!-.&#:)!*'!)(*'$!%I4'(#)(!%'!4I'*'!:'(!4'(FI*#.-*)!4)(!I$-!-,'$-Q-!,-&'(#-2#Q-*-!%)1('!I$!-.&#:)!*'!)(*'$!#$O'(#)(!
Productos de entrada
!" Z'%I2&-*)%!*'!2-!&-('-!`@D<D@W!H*'$&#O#.-.#5$!
!" /().'%)%!*'!$'6).#)!
!" \#-6(-,-%!*'!O2IF)!*'!*-&)%!
!" \#-6(-,-%!*'!I%)!
Productos de salida
!" \#-6(-,-!*'!*'4'$*'$.#-%!'$&('!-.&#:)%!
Técnicas, prácticas y pautas
!" \#-6(-,-%!*'!O2IF)!*'!*-&)%!?:'(!m^IR-!*'!`;.$#.-%m!>D<C!
!" \#-6(-,-%!*'!4().'%)%!?:'(!m^IR-!*'!`;.$#.-%m!>D>C!
!" L$&(':#%&-%!?:'(!m^IR-!*'!`;.$#.-%m!>DGD@C!
!" Z'I$#)$'%!?:'(!m^IR-!*'!`;.$#.-%m!>DGD<C!
!" _-2)(-.#5$!\'24V#!?:'(!m^IR-!*'!`;.$#.-%m!>DKC!
!" _'(!&-,1#;$!2-!%'..#5$!<D@D@D!
Participantes
!" L2!'UI#4)!*'!4()J'.&)!
!" T)%!6(I4)%!*'!#$&'(2).I&)('%!
!
/-(-!.-*-!*'4'$*'$.#-!.)$:#'$'!('6#%&(-(!2-!%#6I#'$&'!#$O)(,-.#5$[!
!" '%&#,-.#5$!*'2!6(-*)!*'!*'4'$*'$.#-[!V-%&-!I$!@SSt!
!" 'M42#.-.#5$!*'!2-!:-2)(-.#5$!*'!2-!*'4'$*'$.#-!
!" '$&(':#%&-%!('-2#Q-*-%!*'!2-%!UI'!%'!V-!*'*I.#*)!2-!-$&'(#)(!'%&#,-.#5$!
"-6'(#&!:'(%#5$!<! ! L%&(I.&I(-.#5$!*'2!4()J'.&)!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!G<!?*'!@ABC!
P2: Análisis de riesgos A2.1: Caracterización de los activos T2.1.3: Valoración de los activos
Objetivos
!" H*'$&#O#.-(!'$!UI;!*#,'$%#5$!'%!:-2#)%)!'2!-.&#:)!
!" _-2)(-(!'2!.)%&'!UI'!4-(-!2-!E(6-$#Q-.#5$!%I4)$*(R-!2-!*'%&(I..#5$!*'2!-.&#:)!
Productos de entrada
!" Z'%I2&-*)%!*'!2-!&-('-!`@DBD<W!3(#&'(#)%!*'!':-2I-.#5$!
!" Z'%I2&-*)%!*'!2-!&-('-!`<D@D@W!H*'$&#O#.-.#5$!*'!2)%!-.&#:)%!
!" Z'%I2&-*)%!*'!2-!&-('-!`<D@D<W!\'4'$*'$.#-%!'$&('!-.&#:)%!
Productos de salida
!" Modelo de valor[!#$O)(,'!*'!:-2)(!*'!2)%!-.&#:)%!
Técnicas, prácticas y pautas
!" L$&(':#%&-%!?:'(!m^IR-!*'!`;.$#.-%m!>DGD@C!
!" Z'I$#)$'%!?:'(!m^IR-!*'!`;.$#.-%m!>DGD<C!
!" _-2)(-.#5$!\'24V#!?:'(!m^IR-!*'!`;.$#.-%m!>DKC!
!" _'(!&-,1#;$!2-!%'..#5$!<D@D@D!
Participantes
!" L2!'UI#4)!*'!4()J'.&)!
!" T)%!6(I4)%!*'!#$&'(2).I&)('%!
!" L2!.),#&;!*'!%'6I#,#'$&)!
!" T-!*#('..#5$!
!
/-(-! 2-!-*UI#%#.#5$!*'!'%&'!.)$).#,#'$&)!4I'*'!%'(!$'.'%-(#)!'$&(':#%&-(!-!*#O'('$&'%!.)2'.&#:)%!*'$&()!*'!2-!E(6-$#Q-.#5$[!
!" *#('..#5$!)!6'('$.#-W!UI'!.)$).'$!2-%!.)$%'.I'$.#-%!4-(-!2-!,#%#5$!*'!2-!E(6-$#Q-.#5$!
!" ('%4)$%-12'%!*'!2)%!%'(:#.#)%W!UI'!.)$).'$!2-%!.)$%'.I'$.#-%!*'!2-!$)!4('%&-.#5$!*'2!%'(:#g.#)!)!*'!%I!4('%&-.#5$!*'6(-*-*-!
!" ('%4)$%-12'%!*'!2)%!*-&)%W!UI'!.)$).'$!2-%!.)$%'.I'$.#-%!*'!2-!*'6(-*-.#5$!*'!2)%!*-&)%!
!" ('%4)$%-12'%! *'! %#%&',-%! *'! #$O)(,-.#5$! J! ('%4)$%-12'%! *'! )4'(-.#5$W! UI'! .)$).'$! 2-%!.)$%'.I'$.#-%!*'!I$!#$.#*'$&'!
/-(-!.-*-!:-2)(-.#5$!.)$:#'$'!('6#%&(-(!2-!%#6I#'$&'!#$O)(,-.#5$[!
!" *#,'$%#)$'%!'$!2-%!UI'!'2!-.&#:)!'%!('2':-$&'!
!" '%&#,-.#5$!*'!2-!:-2)(-.#5$!'$!.-*-!*#,'$%#5$!
!" 'M42#.-.#5$!*'!2-!:-2)(-.#5$!!
!" '$&(':#%&-%!('-2#Q-*-%!*'!2-%!UI'!%'!V-$!*'*I.#*)!2-%!-$&'(#)('%!'%&#,-.#)$'%!
"-6'(#&!:'(%#5$!<! ! L%&(I.&I(-.#5$!*'2!4()J'.&)!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!G>!?*'!@ABC!
3.4.2. Actividad A2.2: Caracterización de las amenazas
L%&-!-.&#:#*-*!%I'2'!*#%.I((#(!*'!O)(,-!.)$.I(('$&'!.)$!2-%!-.&#:#*-*'%!+<D@!J!+D<D>!*-*)!UI'!2)%!('%4)$%-12'%!-!'$&(':#%&-(!%)$!2)%!,#%,)%D!
L%&-!-.&#:#*-*!.)$%&-!*'!*)%!&-('-%[!
`<D<D@[!H*'$&#O#.-.#5$!*'!2-%!-,'$-Q-%!
`<D<D<[!_-2)(-.#5$!*'!2-%!-,'$-Q-%!
P2: Análisis de riesgos A2.2: Caracterización de las amenazas T2.2.1: Identificación de las amenazas
Objetivos
!" H*'$&#O#.-(!2-%!-,'$-Q-%!('2':-$&'%!%)1('!.-*-!-.&#:)!
Productos de entrada
!" Z'%I2&-*)%!*'!2-!&-('-!`@DBD<W!3(#&'(#)%!*'!':-2I-.#5$!
!" Z'%I2&-*)%!*'!2-!-.&#:#*-*!+<D@W!3-(-.&'(#Q-.#5$!*'!2)%!-.&#:)%!
Productos de salida
!" Z'2-.#5$!*'!-,'$-Q-%!4)%#12'%!
Técnicas, prácticas y pautas
!" 3-&82)6)%!*'!-,'$-Q-%!?:'(!m3-&82)6)!*'!L2','$&)%mW!.-4R&I2)!AC!
!" w(1)2'%!*'!-&-UI'!?:'(!m^IR-!*'!`;.$#.-%m!<D>C!
!" L$&(':#%&-%!?:'(!m^IR-!*'!`;.$#.-%m!>DGD@C!
!" Z'I$#)$'%!?:'(!m^IR-!*'!`;.$#.-%m!>DGD<C!
!" _-2)(-.#5$!\'24V#!?:'(!m^IR-!*'!`;.$#.-%m!>DKC!
!" _'(!&-,1#;$!2-!%'..#5$!<D@D<D!
Participantes
!" L2!'UI#4)!*'!4()J'.&)!
!" 2)%!6(I4)%!*'!#$&'(2).I&)('%!
!
L$!'%&-! &-('-!%'! #*'$&#O#.-$! 2-%!-,'$-Q-%!%#6$#O#.-&#:-%!%)1('! 2)%!-.&#:)%! #*'$&#O#.-*)%W! &),-$*)!'$!.)$%#*'(-.#5$[!
!" '2!)!*'!-.&#:)!
!" 2-%!*#,'$%#)$'%!'$!UI'!'2!-.&#:)!'%!:-2#)%)!
!" 2-!'M4'(#'$.#-!*'!2-!E(6-$#Q-.#5$!
/-(-!.-*-!-,'$-Q-!%)1('!.-*-!-.&#:)!.)$:#'$'!('6#%&(-(!2-!%#6I#'$&'!#$O)(,-.#5$[!
!" 'M42#.-.#5$!*'2!'O'.&)!*'!2-!-,'$-Q-!
!" '$&(':#%&-%!('-2#Q-*-%!*'!2-%!UI'!%'!V-!*'*I.#*)!2-!-$&'(#)(!'%&#,-.#5$!
!" -$&'.'*'$&'%W!%#! 2)%!VI1#'(-W!1#'$!'$! 2-!4()4#-!E(6-$#Q-.#5$W!1#'$!'$!)&(-%!)(6-$#Q-.#)$'%!UI'!%'!V-J-!.)$%#*'(-*)!('2':-$&'%!
"-6'(#&!:'(%#5$!<! ! L%&(I.&I(-.#5$!*'2!4()J'.&)!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!GB!?*'!@ABC!
P2: Análisis de riesgos A2.2: Caracterización de las amenazas T2.2.2: Valoración de las amenazas
Objetivos
!" L%&#,-(!2-!O('.I'$.#-!*'!).I(('$.#-!*'!.-*-!-,'$-Q-!%)1('!.-*-!-.&#:)!
!" L%&#,-(!2-!*'6(-*-.#5$!UI'!.-I%-(R-!2-!-,'$-Q-!'$!.-*-!*#,'$%#5$!*'2!-.&#:)!%#!22'6-(-!-!,-&'(#-2#Q-(%'!
Productos de entrada
!" Z'%I2&-*)%!*'!2-!&-('-!`@DBD<W!3(#&'(#)%!*'!':-2I-.#5$!
!" Z'%I2&-*)%!*'!2-!&-('-!`<D<D@W!H*'$&#O#.-.#5$!*'!2-%!-,'$-Q-%!
!" ]'(#'%!V#%&5(#.-%!*'!#$.#*'$&'%!
!" +$&'.'*'$&'%[!#$.#*'$&'%!'$!2-!E(6-$#Q-.#5$!
Productos de salida
!" Mapa de riesgos[!#$O)(,'!*'!-,'$-Q-%!4)%#12'%W!.-(-.&'(#Q-*-%!4)(!%I!O('.I'$.#-!*'!).Ig(('$.#-!J!2-!*'6(-*-.#5$!UI'!.-I%-(R-$!'$!2)%!-.&#:)%!
Técnicas, prácticas y pautas
!" w(1)2'%!*'!-&-UI'!?:'(!m^IR-!*'!`;.$#.-%m!<D>C!
!" L$&(':#%&-%!?:'(!m^IR-!*'!`;.$#.-%m!>DGD@C!
!" Z'I$#)$'%!?:'(!m^IR-!*'!`;.$#.-%m!>DGD<C!
!" _-2)(-.#5$!\'24V#!?:'(!m^IR-!*'!`;.$#.-%m!>DKC!
!" _'(!&-,1#;$!2-!%'..#5$!<D@D<D!
Participantes
!" L2!'UI#4)!*'!4()J'.&)!
!" T)%!6(I4)%!*'!#$&'(2).I&)('%!
!
L$!'%&-!&-('-!%'!:-2)(-$!2-%!-,'$-Q-%!#*'$&#O#.-*-%!'$!2-!&-('-!-$&'(#)(W!&),-$*)!'$!.)$%#*'(-g.#5$[!
!" 2-!'M4'(#'$.#-!?V#%&)(#-C!I$#:'(%-2!
!" 2-!'M4'(#'$.#-!?V#%&)(#-C!*'2!%'.&)(!*'!-.&#:#*-*!
!" 2-!'M4'(#'$.#-!?V#%&)(#-C!*'2!'$&)($)!'$!UI'!%'!I1#.-$!2)%!%#%&',-%!
!" 2-!'M4'(#'$.#-!?V#%&)(#-C!*'!2-!4()4#-!E(6-$#Q-.#5$!
]-1#'$*)!UI'!'M#%&'$!I$-!%'(#'!*'!4)%#12'%!-6(-:-$&'%W!.),)!%'!*'%.(#1'!'$!2-!%'..#5$!nD!
/-(-!.-*-!-,'$-Q-!%)1('!.-*-!-.&#:)!.)$:#'$'!('6#%&(-(!2-!%#6I#'$&'!#$O)(,-.#5$[!
!" '%&#,-.#5$!*'!2-!O('.I'$.#-!*'!2-!-,'$-Q-!
!" '%&#,-.#5$!*'2!*-c)!?*'6(-*-.#5$C!UI'!.-I%-(R-!%I!,-&'(#-2#Q-.#5$!
!" 'M42#.-.#5$!*'!2-%!'%&#,-.#)$'%!*'!O('.I'$.#-!J!*'6(-*-.#5$!
!" '$&(':#%&-%!('-2#Q-*-%!*'!2-%!UI'!%'!V-$!*'*I.#*)!2-%!-$&'(#)('%!'%&#,-.#)$'%!
"-6'(#&!:'(%#5$!<! ! L%&(I.&I(-.#5$!*'2!4()J'.&)!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!GA!?*'!@ABC!
3.4.3. Actividad A2.3: Caracterización de las salvaguardas
L%&-!-.&#:#*-*!%I'2'!*#%.I((#(!*'!O)(,-!.)$.I(('$&'!.)$!2-%!-.&#:#*-*'%!+<D@!J!+<D<!*-*)!UI'!2)%!('%4)$%-12'%!-!'$&(':#%&-(!%)$!2)%!,#%,)%D!
L%&-!-.&#:#*-*!.)$%&-!*'!*)%!&-('-%[!
`<D>D@[!H*'$&#O#.-.#5$!*'!2-%!%-2:-6I-(*-%!'M#%&'$&'%!
`<D>D<[!_-2)(-.#5$!*'!2-%!%-2:-6I-(*-%!'M#%&'$&'%!
P2: Análisis de riesgos A2.3: Caracterización de las salvaguardas T2.3.1: Identificación de las salvaguardas existentes
Objetivos
!" H*'$&#O#.-(!2-%!%-2:-6I-(*-%W!*'!.I-2UI#'(!)W!UI'!%'!V-$!4(':#%&)!J!*'%42'6-*)!-!O'.V-!*'!('-2#Q-.#5$!*'2!'%&I*#)!
Productos de entrada
!" H$:'$&-(#)!*'!4().'*#,#'$&)%!)4'(-&#:)%!
!" H$:'$&-(#)!*'!4()*I.&)%!Jd)!*'%-(()22)%!hardware!)!software *'!%)4)(&'!-!2-!%'6I(#*-*!*'!2)%!%#%&',-%!
!" /2-$!*'!O)(,-.#5$!
!" \'O#$#.#5$!*'!2)%!4I'%&)%!2-1)(-2'%!
!" 3)$&(-&)%!
!" +.I'(*)%!*'!'M&'($-2#Q-.#5$!*'!%'(:#.#)%!
Productos de salida
!" Z'2-.#5$!*'!%-2:-6I-(*-%!*'%42'6-*-%!
Técnicas, prácticas y pautas
!" 3-&82)6)%!*'!%-2:-6I-(*-%!?:'(!m3-&82)6)!*'!L2','$&)%m!.-4R&I2)!GC!
!" w(1)2'%!*'!-&-UI'!?:'(!m^IR-!*'!`;.$#.-%m!<D>C!
!" L$&(':#%&-%!?:'(!m^IR-!*'!`;.$#.-%m!>DGD@C!
!" Z'I$#)$'%!?:'(!m^IR-!*'!`;.$#.-%m!>DGD<C!
!" _'(!&-,1#;$!2-!%'..#5$!<D@DAD!
Participantes
!" L2!'UI#4)!*'!4()J'.&)!
!" T)%!6(I4)%!*'!#$&'(2).I&)('%!
!
/-(-!.-*-!%-2:-6I-(*-!.)$:#'$'!('6#%&(-(!2-!%#6I#'$&'!#$O)(,-.#5$[!
!" *'%.(#4.#5$!*'!2-!%-2:-6I-(*-!J!%I!'%&-*)!*'!#,42-$&-.#5$!
!" *'%.(#4.#5$!*'!2-%!-,'$-Q-%!-!2-%!UI'!4('&'$*'!V-.'(!O('$&'!
!" '$&(':#%&-%!('-2#Q-*-%!*'!2-%!UI'!%'!V-!*'*I.#*)!2-!-$&'(#)(!#$O)(,-.#5$!
"-6'(#&!:'(%#5$!<! ! L%&(I.&I(-.#5$!*'2!4()J'.&)!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!GG!?*'!@ABC!
P2: Análisis de riesgos A2.3: Caracterización de las salvaguardas T2.3.2: Valoración de las salvaguardas existentes
Objetivos
!" \'&'(,#$-(!2-!'O#.-.#-!*'!2-%!%-2:-6I-(*-%!*'%42'6-*-%!
Productos de entrada
!" H$:'$&-(#)!*'!%-2:-6I-(*-%!?3-&82)6)!*'!L2','$&)%C!
Productos de salida
!" Evaluación de salvaguardas[! #$O)(,'!*'! %-2:-6I-(*-%!*'%42'6-*-%W! .-(-.&'(#Q-*-%!4)(!%I!6(-*)!*'!'O'.&#:#*-*!
Técnicas, prácticas y pautas
!" L$&(':#%&-%!?:'(!m^IR-!*'!`;.$#.-%m!>DGD@C!
!" Z'I$#)$'%!?:'(!m^IR-!*'!`;.$#.-%m!>DGD<C!
!" _-2)(-.#5$!\'24V#!?:'(!m^IR-!*'!`;.$#.-%m!>DKC!
!" _'(!&-,1#;$!2-!%'..#5$!<D@DAD!
Participantes
!" L2!'UI#4)!*'!4()J'.&)!
!" T)%!6(I4)%!*'!#$&'(2).I&)('%!
!" L%4'.#-2#%&-%!'$!%-2:-6I-(*-%!.)$.('&-%!
!
L$!'%&-! &-('-!%'!:-2)(-! 2-!'O'.&#:#*-*!*'! 2-%! %-2:-6I-(*-%! #*'$&#O#.-*-%!'$! 2-! &-('-!-$&'(#)(W! &)g,-$*)!'$!.)$%#*'(-.#5$[!
!" 2-!#*)$'#*-*!*'!2-!%-2:-6I-(*-!4-(-!'2!O#$!4'(%'6I#*)!
!" 2-!.-2#*-*!*'!2-!#,42-$&-.#5$!
!" 2-!O)(,-.#5$!*'!2)%!('%4)$%-12'%!*'!%I!.)$O#6I(-.#5$!J!)4'(-.#5$!
!" 2-!O)(,-.#5$!*'!2)%!I%I-(#)%W!%#!&#'$'$!I$!4-4'2!-.&#:)!
!" 2-!'M#%&'$.#-!*'!.)$&()2'%!*'!,'*#*-!*'!%I!'O'.&#:#*-*!
!" 2-!'M#%&'$.#-!*'!4().'*#,#'$&)%!*'!(':#%#5$!('6I2-(!
/-(-!.-*-!%-2:-6I-(*-!.)$:#'$'!('6#%&(-(!2-!%#6I#'$&'!#$O)(,-.#5$[!
!" '%&#,-.#5$!*'!%I!'O#.-.#-!4-(-!-O()$&-(!-UI'22-%!-,'$-Q-%!!
!" 'M42#.-.#5$!*'!2-!'%&#,-.#5$!*'!'O#.-.#-!
!" '$&(':#%&-%!('-2#Q-*-%!*'!2-%!UI'!%'!V-!*'*I.#*)!2-!-$&'(#)(!'%&#,-.#5$!
"-6'(#&!:'(%#5$!<! ! L%&(I.&I(-.#5$!*'2!4()J'.&)!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!GK!?*'!@ABC!
3.4.4. Actividad A2.4: Estimación del estado de riesgo
L$! '%&-! -.&#:#*-*! %'! .),1#$-$! 2)%! *'%.I1(#,#'$&)%! *'! 2-%! -.&#:#*-*'%! -$&'(#)('%! ?+<D@W! +<D<! J!+<D>C!4-(-!*'(#:-(!'%&#,-.#)$'%!*'2!'%&-*)!*'!(#'%6)!*'!2-!E(6-$#Q-.#5$D!
L%&-!-.&#:#*-*!.)$%&-!*'!&('%!&-('-%[!
`<DBD@[!L%&#,-.#5$!*'2!#,4-.&)!
`<DBD<[!L%&#,-.#5$!*'2!(#'%6)!
`<DBD>[!H$&'(4('&-.#5$!*'!2)%!('%I2&-*)%!
P2: Análisis de riesgos A2.4: Estimación del estado de riesgo T2.4.1: Estimación del impacto
Objetivos
!" \'&'(,#$-(!'2!#,4-.&)!4)&'$.#-2!-2!UI'!'%&8!%),'&#*)!'2!%#%&',-!
!" \'&'(,#$-(!'2!#,4-.&)!('%#*I-2!-2!UI'!'%&8!%),'&#*)!'2!%#%&',-!
Productos de entrada
!" Z'%I2&-*)%!*'!2-!-.&#:#*-*!+<D@W!3-(-.&'(#Q-.#5$!*'!2)%!-.&#:)%!
!" Z'%I2&-*)%!*'!2-!-.&#:#*-*!+<D<W!3-(-.&'(#Q-.#5$!*'!2-%!-,'$-Q-%!
!" Z'%I2&-*)%!*'!2-!-.&#:#*-*!+<D>W!3-(-.&'(#Q-.#5$!*'!2-%!%-2:-6I-(*-%!
Productos de salida
!" H$O)(,'!*'!#,4-.&)!?4)&'$.#-2C!4)(!-.&#:)!
!" H$O)(,'!*'!#,4-.&)!('%#*I-2!4)(!-.&#:)!
Técnicas, prácticas y pautas
!" +$82#%#%!,'*#-$&'!&-12-%!?:'(!m^IR-!*'!`;.$#.-%m!<D@C!
!" +$82#%#%!-26)(R&,#.)!?:'(!m^IR-!*'!`;.$#.-%m!<D<C!
!" _'(!&-,1#;$!2-!%'..#5$!<D@D>!J!<D@DGD!
Participantes
!" L2!'UI#4)!*'!4()J'.&)!
!
L$!'%&-!&-('-!%'!'%&#,-!'2!#,4-.&)!-2!UI'!'%&8$!'M4I'%&)%!2)%!-.&#:)%!*'2!%#%&',-[!
!" '2!#,4-.&)!4)&'$.#-2W!-2!UI'!'%&8!'M4I'%&)!'2!%#%&',-!&'$#'$*)!'$!.I'$&-!'2!:-2)(!*'!2)%!-.&#g:)%!J!2-!:-2)(-.#5$!*'!2-%!-,'$-Q-%h!4'()!$)!2-%!%-2:-6I-(*-%!-.&I-2,'$&'!*'%42'6-*-%!
!" '2!#,4-.&)!('%#*I-2W!-2!UI'!'%&8!'M4I'%&)!'2!%#%&',-!&'$#'$*)!'$!.I'$&-!'2!:-2)(!*'!2)%!-.&#g:)%!J!2-!:-2)(-.#5$!*'!2-%!-,'$-Q-%W!-%R!.),)!2-!'O#.-.#-!*'!2-%!%-2:-6I-(*-%!-.&I-2,'$&'!*'%42'6-*-%!
"-6'(#&!:'(%#5$!<! ! L%&(I.&I(-.#5$!*'2!4()J'.&)!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!GN!?*'!@ABC!
P2: Análisis de riesgos A2.4: Estimación del estado de riesgo T2.4.2: Estimación del riesgo
Objetivos
!" \'&'(,#$-(!'2!(#'%6)!4)&'$.#-2!-2!UI'!'%&8!%),'&#*)!'2!%#%&',-!
!" \'&'(,#$-(!'2!(#'%6)!('%#*I-2!-2!UI'!'%&8!%),'&#*)!'2!%#%&',-!
Productos de entrada
!" Z'%I2&-*)%!*'!2-!-.&#:#*-*!+<D@W!3-(-.&'(#Q-.#5$!*'!2)%!-.&#:)%!
!" Z'%I2&-*)%!*'!2-!-.&#:#*-*!+<D<W!3-(-.&'(#Q-.#5$!*'!2-%!-,'$-Q-%!
!" Z'%I2&-*)%!*'!2-!-.&#:#*-*!+<D>W!3-(-.&'(#Q-.#5$!*'!2-%!%-2:-6I-(*-%!
Productos de salida
!" H$O)(,'!*'!(#'%6)!?4)&'$.#-2C!4)(!-.&#:)!
!" H$O)(,'!*'!(#'%6)!('%#*I-2!4)(!-.&#:)!
Técnicas, prácticas y pautas
!" +$82#%#%!,'*#-$&'!&-12-%!?:'(!m^IR-!*'!`;.$#.-%m!<D@C!
!" +$82#%#%!-26)(R&,#.)!?:'(!m^IR-!*'!`;.$#.-%m!<D<C!
!" _'(!&-,1#;$!2-!%'..#5$!<D@DB!J!<D@DKD!
Participantes
!" L2!'UI#4)!*'!4()J'.&)!
!
L$!'%&-!&-('-!%'!'%&#,-!'2!(#'%6)!-2!UI'!'%&8$!%),'&#*)%!2)%!-.&#:)%!*'2!%#%&',-[!
!" '2!(#'%6)!4)&'$.#-2W!-2!UI'!'%&8!%),'&#*)!'2!%#%&',-!&'$#'$*)!'$!.I'$&-!'2!:-2)(!*'!2)%!-.&#g:)%!J!2-!:-2)(-.#5$!*'!2-%!-,'$-Q-%h!4'()!$)!2-%!%-2:-6I-(*-%!-.&I-2,'$&'!*'%42'6-*-%!
!" '2!(#'%6)!('%#*I-2W!-2!UI'!'%&8!%),'&#*)!'2!%#%&',-!&'$#'$*)!'$!.I'$&-!'2!:-2)(!*'!2)%!-.&#:)%!J!2-!:-2)(-.#5$!*'!2-%!-,'$-Q-%W!-%R!.),)!2-!'O#.-.#-!*'!2-%!%-2:-6I-(*-%!-.&I-2,'$&'!*'%g42'6-*-%!
"-6'(#&!:'(%#5$!<! ! L%&(I.&I(-.#5$!*'2!4()J'.&)!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!GP!?*'!@ABC!
P2: Análisis de riesgos A2.4: Estimación del estado de riesgo T2.4.3: Interpretación de los resultados
Objetivos
!" H$&'(4('&-(!2)%!('%I2&-*)%!-$&'(#)('%!*'!#,4-.&)!J!(#'%6)!
!" L%&-12'.'(! ('2-.#)$'%!*'!4(#)(#*-*!4)(!-.&#:)%!)!6(I4)%!*'!-.&#:)%W!1#'$!4)(!)(*'$!*'! #,g4-.&)!)!4)(!)(*'$!*'!(#'%6)!
Productos de entrada
!" Z'%I2&-*)%!*'!2-!-.&#:#*-*!+<D@W!3-(-.&'(#Q-.#5$!*'!2)%!-.&#:)%!
!" Z'%I2&-*)%!*'!2-!-.&#:#*-*!+<D<W!3-(-.&'(#Q-.#5$!*'!2-%!-,'$-Q-%!
!" Z'%I2&-*)%!*'!2-!-.&#:#*-*!+<D>W!3-(-.&'(#Q-.#5$!*'!2-%!%-2:-6I-(*-%!
!" Z'%I2&-*)%!*'!2-!&-('-!`<DBD@W!L%&#,-.#5$!*'2!#,4-.&)!
!" Z'%I2&-*)%!*'!2-!&-('-!`<DBD<W!L%&#,-.#5$!*'2!(#'%6)!
Productos de salida
!" H$O)(,'!4(#)(#Q-*)!*'!-.&#:)%!%),'&#*)%!-!,-J)(!#,4-.&)!
!" H$O)(,'!4(#)(#Q-*)!*'!-.&#:)%!%),'&#*)%!-!,-J)(!(#'%6)!
!" Estado de riesgo: #$O)(,'! ('%I,'$!*'2! #,4-.&)!J! (#'%6)!4)&'$.#-2!J! ('%#*I-2!-!UI'!'%&8!%),'&#*)!.-*-!-.&#:)!*'2!*),#$#)!
!" Informe de insuficiencias[! #$O)(,'!UI'!*'%&-.-!2-%!#$.)V'('$.#-%!'$&('!2-%!%-2:-6I-(*-%!UI'!%'!$'.'%#&-$!J!2-%!UI'!'M#%&'$!J!2-%!*#:'(6'$.#-%!'$&('!2-!,-6$#&I*!*'2!(#'%6)!J!2-!'O#g.-.#-!-.&I-2!*'!2-%!%-2:-6I-(*-%!
Técnicas, prácticas y pautas
!" `;.$#.-%!6(8O#.-%!?:'(!m^IR-!*'!`;.$#.-%m!>DBC!
!" Z'I$#)$'%!?:'(!m^IR-!*'!`;.$#.-%m!>DGD<C!
!" /('%'$&-.#)$'%!?:'(!m^IR-!*'!`;.$#.-%m!>DGD>C!
!" _'(!&-,1#;$!2-!%'..#5$!<D<D@D!
Participantes
!" L2!'UI#4)!*'!4()J'.&)!
!" L2!.),#&;!*'!%'6I#,#'$&)!
"-6'(#&!:'(%#5$!<! ! L%&(I.&I(-.#5$!*'2!4()J'.&)!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!KS!?*'!@ABC!
3.4.5. Síntesis del proceso P2
3.4.5.1. Hitos de control
Hito de control H2.1:
+.'4&-.#5$!*'2!#$O)(,'!j")*'2)!*'!_-2)(kD!
Hito de control H2.2:
+.'4&-.#5$!*'2!#$O)(,'!j"-4-!*'!Z#'%6)%kD!
Hito de control H2.3:
+.'4&-.#5$!*'2!#$O)(,'!jL:-2I-.#5$!*'!]-2:-6I-(*-%kD!
Hito de control H2.4:
+.'4&-.#5$!*'2!#$O)(,'!jL%&-*)!*'!Z#'%6)kD!
Hito de control H2.5:
+.'4&-.#5$!*'2!#$O)(,'!jH$O)(,'!*'!H$%IO#.#'$.#-%kD!
3.4.5.2. Resultados
Documentación intermedia
!" Z'%I2&-*)%!*'!2-%!'$&(':#%&-%D!
!" \).I,'$&-.#5$!*'!)&(-%! OI'$&'%[!'%&-*R%&#.-%W!)1%'(:-.#)$'%!*'!'M4'(&)%!J!)1%'(:-.#)$'%!*'!2)%!-$-2#%&-%D!
!" H$O)(,-.#5$!'M#%&'$&'!I#Q-12'!4)(!'2!4()J'.&)!?4)(!'F',42)!#$:'$&-(#)!*'!-.&#:)%C!
!" \).I,'$&-.#5$!-IM#2#-([!42-$)%W!)(6-$#6(-,-%W! ('UI#%#&)%W!'%4'.#O#.-.#)$'%W!-$82#%#%! OI$.#)g$-2'%W! .I-*'($)%!*'!.-(6-W!,-$I-2'%!*'!I%I-(#)W!,-$I-2'%!*'!'M42)&-.#5$W!*#-6(-,-%!*'!O2IF)!*'!#$O)(,-.#5$!J!*'!4().'%)%W!,)*'2)%!*'!*-&)%W!'&.D!
Documentación final
!" Modelo de valor
H$O)(,'!UI'!*'&-22-!2)%!-.&#:)%W!%I%!*'4'$*'$.#-%W!2-%!*#,'$%#)$'%!'$!2-%!UI'!%)$!:-2#)%)%!J!2-!'%&#,-.#5$!*'!%I!:-2)(!'$!.-*-!*#,'$%#5$D!
!" Mapa de riesgos[!
H$O)(,'!UI'!*'&-22-!2-%!-,'$-Q-%!%#6$#O#.-&#:-%!%)1('!.-*-!-.&#:)W!.-(-.&'(#Q8$*)2-%!4)(!%I!O('.I'$.#-!*'!).I(('$.#-!J!4)(!2-!*'6(-*-.#5$!UI'!.-I%-(R-!%I!,-&'(#-2#Q-.#5$!%)1('!'2!-.&#g:)D!
!" Evaluación de salvaguardas:
H$O)(,'!UI'!*'&-22-!2-%!%-2:-6I-(*-%!'M#%&'$&'%!.-2#O#.8$*)2-%!'$!%I!'O#.-.#-!4-(-!('*I.#(!'2!(#'%6)!UI'!-O()$&-$D!
!" Estado de riesgo:
H$O)(,'!UI'!*'&-22-!4-(-!.-*-!-.&#:)!'2!#,4-.&)!J!'2!(#'%6)!('%#*I-2'%!O('$&'!-!.-*-!-,'$-gQ-D!
!" Informe de insuficiencias:
H$O)(,'!UI'!*'&-22-!2-%!%-2:-6I-(*-%!$'.'%-(#-%!4'()!-I%'$&'%!)!#$%IO#.#'$&','$&'!'O#.-.'%D!
L%&-!*).I,'$&-.#5$!'%!I$!O#'2!('O2'F)!*'2!'%&-*)!*'!(#'%6)!J!*'!2-%!(-Q)$'%!4)(!2-!UI'!'%&'!(#'%6)!$)!'%!*'%4('.#-12'D!L%!OI$*-,'$&-2!'$&'$*'(!2-%!(-Q)$'%!UI'!22':-$!-!I$-!:-2)(-.#5$!*'&'(,#$-g
"-6'(#&!:'(%#5$!<! ! L%&(I.&I(-.#5$!*'2!4()J'.&)!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!K@!?*'!@ABC!
*-!*'!(#'%6)!.),)!4-%)!4(':#)!-2!4().'%)!%#6I#'$&'W!/>W!UI'!1I%.-(8!-&-F-(!'2!(#'%6)!)!('*I.#(2)!-!$#:'2'%!-.'4&-12'%D!
3.4.6. Lista de control del proceso P2
#" H*'$&#O#.-.#5$!*'!-.&#:)%!?`<D@D@C!
#" 3-(-.&'(#Q-.#5$!*'!2)%!-.&#:)%!?`<D@D@C!
#" \'4'$*'$.#-%!'$&('!-.&#:)%!?`<D@D<C!
#" \#,'$%#)$'%!('2':-$&'%!*'!%'6I(#*-*!4)(!-.&#:)!?`<D@D>C!
#" _-2)(-.#5$!*'!2)%!-.&#:)%!?`<D@D>C!
#" ")*'2)!*'!:-2)(!?+<D@C!
#" H*'$&#O#.-.#5$!*'!2-%!-,'$-Q-%!('2':-$&'%!?`<D<D@C!
#" L%&#,-.#5$!*'!2-!O('.I'$.#-!*'!).I(('$.#-!?`<D<D<C!
#" L%&#,-.#5$!*'2!*-c)!?*'6(-*-.#5$C!*'(#:-*)!*'!2-!,-&'(#-2#Q-.#5$!*'!I$-!-,'$-Q-!?`<D<D<C!
#" "-4-!*'!(#'%6)%!?+<D<C!
#" H*'$&#O#.-.#5$!*'!2-%!%-2:-6I-(*-%!'M#%&'$&'%!?`<D>D@C!
#" L%&#,-.#5$!*'!2-!'O#.-.#-!*'!2-%!%-2:-6I-(*-%!'M#%&'$&'%!?`<D>D<C!
#" L:-2I-.#5$!*'!%-2:-6I-(*-%!?+<D>C!
#" L%&#,-.#5$!*'2!#,4-.&)!'!#,4-.&)!('%#*I-2!?`<DBD@C!
#" L%&#,-.#5$!*'2!(#'%6)!J!(#'%6)!('%#*I-2!?`<DBD<C!
#" L%&-*)!*'!(#'%6)!?/<C!
#" H$O)(,'!*'!#$%IO#.#'$.#-%!?/<C!
"-6'(#&!:'(%#5$!<! ! L%&(I.&I(-.#5$!*'2!4()J'.&)!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!K<!?*'!@ABC!
3.5. Proceso P3: Gestión de riesgos ]'!4().'%-$!2)%!#,4-.&)%!J!(#'%6)%!#*'$&#O#.-*)%!'$!'2!4().'%)!-$&'(#)(W!1#'$!-%I,#;$*)2)%W!1#'$!-O()$&8$*)2)%D!/-(-!-O()$&-(!2)%!(#'%6)%!UI'!%'!.)$%#*'('$!#$-.'4&-12'%!%'!22':-(8!-!.-1)!I$!42-$!*'!%'6I(#*-*!UI'!.)((#F-!2-!%#&I-.#5$!-.&I-2D!9$!42-$!*'!%'6I(#*-*!%'!,-&'(#-2#Q-!'$!I$-!.)2'..#5$!*'!4()6(-,-%!*'!%'6I(#*-*D!+26I$)%!4()6(-,-%!%'(8$!%'$.#22)%W!,#'$&(-%!UI'!)&()%!-2.-$Q-(8$!%IO#.#'$&'!$#:'2!*'!.),42'F#*-*!J!.)%&'!.),)!4-(-!UI'!%I!'F'.I.#5$!%'!.)$:#'(&-!'$!I$!4()J'.&)!4()4#-,'$&'!*#.V)D!T-!%'(#'!*'!4()6(-,-%!?JW!'$!%I!.-%)W!4()J'.&)%C!%'!42-$#O#.-!'$!'2!&#',4)!4)(!,'*#)!*'2!*'$),#$-*)!/2-$!*'!]'6I(#*-*!UI'!)(*'$-!J!)(6-$#Q-!2-%!-.&I-.#)$'%!'$.-,#$-*-%!-!22':-(!'2!'%&-*)!*'!(#'%6)!-!I$!4I$&)!-.'4&-12'!J!-.'4&-*)!4)(!2-!\#('..#5$D!
L%&'!4().'%)!%'!*'%-(()22-!4)(!,'*#)!*'!2-%!%#6I#'$&'%!-.&#:#*-*'%!J!&-('-%[!
Actividad A3.1: Toma de decisiones
L$!'%&-!-.&#:#*-*!%'!&(-*I.'$!2-%!.)$.2I%#)$'%!&;.$#.-%!*'2!4().'%)!/<!'$!*'.#%#)$'%!*'!-.g&I-.#5$D!
`-('-%[!
Tarea T3.1.1: 3-2#O#.-.#5$!*'!2)%!(#'%6)%!
Actividad A3.2: Plan de seguridad
L$!'%&-!-.&#:#*-*!%'!&(-*I.'$!2-%!*'.#%#)$'%!*'!-.&I-.#5$!'$!-..#)$'%!.)$.('&-%[!4()J'.&)%!*'!,'F)(-!*'!2-!%'6I(#*-*!42-$#O#.-*)%!'$!'2!&#',4)D!
`-('-%[!
Tarea T3.2.1: /()6(-,-%!*'!%'6I(#*-*!
Tarea T3.2.2: /2-$!*'!'F'.I.#5$!
Actividad A3.3: Ejecución del plan
L%&-!-.&#:#*-*!('.)6'!2-!%'(#'!*'!4()J'.&)%!UI'!,-&'(#-2#Q-$!'2!42-$!*'!%'6I(#*-*!J!UI'!%'!:-$!('-2#Q-$*)!%'60$!*#.V)!42-$D!
`-('-%[!
Tarea T3.3.*: LF'.I.#5$!*'!.-*-!4()6(-,-!*'!%'6I(#*-*!
"-6'(#&!:'(%#5$!<! ! L%&(I.&I(-.#5$!*'2!4()J'.&)!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!K>!?*'!@ABC!
3.5.1. Actividad A3.1: Toma de decisiones
L%&-!-.&#:#*-*!.)$%&-!*'!I$-!%)2-!&-('-[!
`>D@D@[!3-2#O#.-.#5$!*'!2)%!(#'%6)%!
P3: Gestión de riesgos A3.1: Toma de decisiones T3.1.1: Calificación de los riesgos
Objetivos
!" 3-2#O#.-(!2)%!(#'%6)%!'$!I$-!'%.-2-[!.(R&#.)W!6(-:'W!-4('.#-12'!)!-%I,#12'!
Productos de entrada
!" Z'%I2&-*)%!*'2!4().'%)!/<W!+$82#%#%!*'!(#'%6)%!
!" T'6#%2-.#5$!-42#.-12'W!2'J'%!J!FI(#%4(I*'$.#-!
!" Z'62-,'$&-.#5$!%'.&)(#-2!
!" +.I'(*)%!J!.)$&(-&)%!
!" H$O)(,'%!,'*#)!-,1#'$&-2'%!
!" L%&I*#)%!*'!,'(.-*)!
Productos de salida
!" H$O)(,'!*'! .-2#O#.-.#5$! *'! #,4-.&)%! J! (#'%6)%W! #$.2IJ'$*)!*#('.&(#.'%!-.'(.-!*'2! 42-Q)!*'!&#',4)!'$!UI'!*'1'$!'%&-(!('%I'2&)%!
Técnicas, prácticas y pautas
!" Z'I$#)$'%!?:'(!m^IR-!*'!`;.$#.-%m!>DGD<C!
!" _-2)(-.#5$!\'24V#!?:'(!m^IR-!*'!`;.$#.-%m!>DKC!
!" _'(!&-,1#;$!2-!%'..#5$!<D<D@D!
Participantes
!" L2!'UI#4)!*'!4()J'.&)!
!" L2!.),#&;!*'!%'6I#,#'$&)!
!" L2!.),#&;!*'!*#('..#5$!
!
+!2-!:#%&-!*'!2)%!#,4-.&)%!J!(#'%6)%!-!UI'!'%&8!'M4I'%&)!'2!%#%&',-W!V-J!UI'!&),-(!I$-!%'(#'!*'!*'.#%#)$'%!*'!)!6'('$.#-2W!$)!&;.$#.)W!.)$*#.#)$-*-%!4)(!*#:'(%)%!O-.&)('%[!
!" 2-!6(-:'*-*!*'2!#,4-.&)!Jd)!*'2!(#'%6)!
!" 2-%!)12#6-.#)$'%!-!2-%!UI'!4)(!2'J!'%&;!%),'&#*-!2-!E(6-$#Q-.#5$!
!" 2-%!)12#6-.#)$'%!-!2-%!UI'!4)(!('62-,'$&)%!%'.&)(#-2'%!'%&;!%),'&#*-!2-!E(6-$#Q-.#5$!
!" 2-%!)12#6-.#)$'%!-!2-%!UI'!4)(!.)$&(-&)!'%&;!%),'&#*-!2-!E(6-$#Q-.#5$!
\'$&()!*'2!,-(6'$!*'!,-$#)1(-!UI'!4'(,#&-!'%&'!,-(.)W!4I'*'$!-4-('.'(!.)$%#*'(-.#)$'%!-*#g.#)$-2'%!%)1('!2-!.-4-.#*-*!*'!2-!E(6-$#Q-.#5$!4-(-!-.'4&-(!.#'(&)%!#,4-.&)%!*'!$-&I(-2'Q-!#$&-$g6#12'>A!&-2'%!.),)[!
!" #,-6'$!4012#.-!*'!.-(-!-!2-!]).#'*-*!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
>A!T-!,'&)*)2)6R-!*'!-$82#%#%!J!6'%$!*'!(#'%6)%W!-2!.'$&(-(%'!'$!2-!':-2I-.#5$!*'!*-c)%W!$)!.-4&I(-!42'g$-,'$&'!2)%!1'$'O#.#)%!*'!2-!-I%'$.#-!*'!*-c)%!UI'W!6'$'(-$*)!I$!-,1#'$&'!*'!.)$O#-$Q-W!4'(,#&'!I$!,'F)(!*'%',4'c)!*'!2-%!OI$.#)$'%!*'!2-!E(6-$#Q-.#5$!'$!%I!'$&)($)!*'!)4'(-.#5$D!
"-6'(#&!:'(%#5$!<! ! L%&(I.&I(-.#5$!*'2!4()J'.&)!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!KB!?*'!@ABC!
!" 4)2R&#.-!#$&'($-[!('2-.#)$'%!.)$!2)%!4()4#)%!',42'-*)%W!&-2'%!.),)!.-4-.#*-*!*'!.)$&(-&-(!-2!4'(%)$-2! #*5$')W!.-4-.#*-*!*'!('&'$'(!-! 2)%!,'F)('%W!.-4-.#*-*!*'!%)4)(&-(!()&-.#)$'%!*'!4'(%)$-%W!.-4-.#*-*!*'!)O('.'(!I$-!.-(('(-!4()O'%#)$-2!-&(-.&#:-W!'&.D!
!" ('2-.#)$'%! .)$! 2)%! 4():''*)('%W! &-2'%! .),)! .-4-.#*-*! *'! 22'6-(! -! -.I'(*)%! :'$&-F)%)%! -!.)(&)W!,'*#)!)!2-(6)!42-Q)W!.-4-.#*-*!*'!)1&'$'(!&(-&)!4(#)(#&-(#)W!'&.D!
!" ('2-.#)$'%!.)$!2)%!.2#'$&'%!)!I%I-(#)%W!&-2'%!.),)!.-4-.#*-*!*'!('&'$.#5$W!.-4-.#*-*!*'!#$g.(','$&-(!2-!)O'(&-W!.-4-.#*-*!*'!*#O'('$.#-(%'!O('$&'!-!2-!.),4'&'$.#-W!DDD!
!" ('2-.#)$'%!.)$!)&(-%!)(6-$#Q-.#)$'%W!&-2'%!.),)!.-4-.#*-*!*'!-2.-$Q-(!-.I'(*)%!'%&(-&;6#g.)%W!-2#-$Q-%W!'&.D!
!" $I':-%!)4)(&I$#*-*'%!*'!$'6).#)W!&-2'%!.),)!O)(,-%!*'!('.I4'(-(!2-!#$:'(%#5$!'$!%'6I(#*-*!
!" -..'%)!-!%'22)%!)!.-2#O#.-.#)$'%!('.)$).#*-%!*'!%'6I(#*-*!
`)*-%!2-%!.)$%#*'(-.#)$'%!-$&'(#)('%!*'%',1).-$!'$!I$-!.-2#O#.-.#5$!*'!.-*-!(#'%6)!%#6$#O#.-&#:)W!*'&'(,#$8$*)%'!%#!DDD!
@D! '%!crítico!'$!'2!%'$&#*)!*'!UI'!('UI#'('!-&'$.#5$!I(6'$&'!
<D! '%!grave!'$!'2!%'$&#*)!*'!UI'!('UI#'('!-&'$.#5$!
>D! '%!apreciable!'$!'2!%'$&#*)!*'!UI'!4I'*-!%'(!)1F'&)!*'!'%&I*#)!4-(-!%I!&(-&-,#'$&)!
BD! '%!asumible!'$!'2!%'$&#*)!*'!UI'!$)!%'!:-$!-!&),-(!-..#)$'%!4-(-!-&-F-(2)!
T-!)4.#5$!BW!-.'4&-.#5$!*'2!(#'%6)W!%#',4('!'%!-((#'%6-*-!J!V-J!UI'!&),-(2-!.)$!4(I*'$.#-!J!FI%&#gO#.-.#5$D!T-%!(-Q)$'%!UI'!4I'*'$!22':-(!-!'%&-!-.'4&-.#5$!%)$[!
!" .I-$*)!'2!#,4-.&)!('%#*I-2!'%!*'%4('.#-12'!
!" .I-$*)!'2!(#'%6)!('%#*I-2!'%!*'%4('.#-12'!
!" .I-$*)!'2!.)%&'!*'!2-%!%-2:-6I-(*-%!)4)(&I$-%!'%!*'%4()4)(.#)$-*)!'$!.),4-(-.#5$!-2!#,g4-.&)!J!(#'%6)!('%#*I-2'%!
`)*-%!2-%!*'.#%#)$'%!%)$!4()4I'%&-%!4)(!'2!.),#&;!*'!%'6I#,#'$&)W!)R*-!2-!)4#$#5$!*'2!*#('.&)(!*'2!4()J'.&)D!`)*-%!2-%!*'.#%#)$'%!%)$!-*)4&-*-%!4)(!'2!.),#&;!*'!*#('..#5$D!
L%&-!.-2#O#.-.#5$!&'$*(8!.)$%'.I'$.#-%!'$!2-%!&-('-%!%I1%#6I#'$&'%W!%#'$*)!I$!O-.&)(!18%#.)!4-(-!'%&-12'.'(!2-!4(#)(#*-*!('2-&#:-!*'!2-%!*#O'('$&'%!-.&I-.#)$'%D!
"-6'(#&!:'(%#5$!<! ! L%&(I.&I(-.#5$!*'2!4()J'.&)!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!KA!?*'!@ABC!
3.5.2. Actividad A3.2: Elaboración del plan seguridad de la información
]'!&(-*I.'$!2-%!*'.#%#)$'%!*'!-.&I-.#5$!'$!-..#)$'%!.)$.('&-%D!
L%&-!-.&#:#*-*!.)$%&-!*'!*)%!&-('-%[!
`>D<D@[!/()6(-,-%!*'!%'6I(#*-*!
`>D<D<[!/2-$!*'!'F'.I.#5$!
P3: Gestión de riesgos A3.2: Elaboración del plan de seguridad de la información T3.2.1: Programas de seguridad
Objetivos
!" L2-1)(-(!I$!.)$FI$&)!*'!4()6(-,-%!*'!%'6I(#*-*!
Productos de entrada
!" Z'%I2&-*)%!*'!2-!&-('-!`>D@D@W!3-2#O#.-.#5$!*'!2)%!(#'%6)%!
!" 3)$).#,#'$&)%!*'!&;.$#.-%!J!4()*I.&)%!*'!%'6I(#*-*!
!" 3-&82)6)%!*'!4()*I.&)%!J!%'(:#.#)%!*'!%'6I(#*-*!
Productos de salida
!" Z'2-.#5$!*'!4()6(-,-%!*'!%'6I(#*-*!
Técnicas, prácticas y pautas
!" +$82#%#%!*'!(#'%6)%!?:'(!4().'%)!/<C!
!" +$82#%#%!.)%&'g1'$'O#.#)!?:'(!m^IR-!*'!`;.$#.-%m!>D@C!
!" /2-$#O#.-.#5$!*'!4()J'.&)%!?:'(!m^IR-!*'!`;.$#.-%m!>DAC!
!" _'(!&-,1#;$!2-!%'..#5$!<D<D<!J!<D<D>D!
Participantes
!" L2!'UI#4)!*'!4()J'.&)!
!" L%4'.#-2#%&-%!'$!%'6I(#*-*!
!" L%4'.#-2#%&-%!'$!8('-%!'%4'.RO#.-%!*'!%'6I(#*-*!
!
f8%#.-,'$&'W!%'!22':-$!-!.-1)!*)%!4-%)%[!
@D! ]'! &),-(8$!'$!.)$%#*'(-.#5$! &)*)%! 2)%!'%.'$-(#)%!*'! #,4-.&)!J! (#'%6)!UI'!%'!.)$%#*'('$!.(R&#.)%!)!6(-:'%!.),)!('%I2&-*)!*'!2-!&-('-!-$&'(#)(D!
<D! ]'!'2-1)(-(8!I$!.)$FI$&)!*'!4()6(-,-%!*'!%'6I(#*-*!UI'!*'$!('%4I'%&-!-!&)*)%!J!.-*-!I$)!*'! 2)%! '%.'$-(#)%! -$&'(#)('%W! %-1#'$*)!UI'!I$!,#%,)!4()6(-,-!4I'*'!-O()$&-(! *#O'('$&'%!'%.'$-(#)%!J!UI'!I$!'%.'$-(#)!4I'*'!%'(!-1)(*-*)!4)(!*#O'('$&'%!4()6(-,-%D!
L$!02&#,-!#$%&-$.#-!%'!&(-&-!*'!#,42-$&-(!)!,'F)(-(!2-!#,42-$&-.#5$!*'!I$-!%'(#'!*'!%-2:-6I-(*-%!UI'!22':'$!#,4-.&)!J!(#'%6)!-!$#:'2'%!('%#*I-2'%!-%I,#*)%!4)(!2-!\#('..#5$D!L%&'!&(-&-,#'$&)!*'!2-%!%-2:-6I-(*-%!%'!,-&'(#-2#Q-!'$!I$-!%'(#'!*'!&-('-%!-!22':-(!-!.-1)D!
9$!4()6(-,-!*'!%'6I(#*-*!'%!I$-!-6(I4-.#5$!*'!&-('-%D!T-!-6(I4-.#5$!%'!('-2#Q-!4)(!.)$:'$#'$g.#-W!1#'$!4)(UI'!%'!&(-&-!*'!&-('-%!UI'!'$!%#$6I2-(!.-('.'(R-$!*'!'O#.-.#-W!1#'$!4)(UI'!%'!&(-&-!*'!&-('-%!.)$!I$!)1F'&#:)!.),0$W!1#'$!4)(UI'!%'!&(-&-!*'!&-('-%!UI'!.),4'&'$!-!I$-!0$#.-!I$#*-*!*'!-..#5$D!
3-*-!4()6(-,-!*'!%'6I(#*-*!*'1'!*'&-22-([!
!" ]I!)1F'&#:)!6'$;(#.)D!
"-6'(#&!:'(%#5$!<! ! L%&(I.&I(-.#5$!*'2!4()J'.&)!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!KG!?*'!@ABC!
!" T-%!%-2:-6I-(*-%!.)$.('&-%!-!#,42-$&-(!)!,'F)(-(W!*'&-22-$*)!%I%!)1F'&#:)%!*'!.-2#*-*W!'O#g.-.#-!J!'O#.#'$.#-!
!" T-!('2-.#5$!*'!'%.'$-(#)%!*'!#,4-.&)!Jd)!(#'%6)!UI'!-O()$&-[!-.&#:)%!-O'.&-*)%W!)%!*'!-.&#g:)%W!-,'$-Q-%!-O()$&-*-%W!:-2)(-.#5$!*'!-.&#:)%!J!-,'$-Q-%!J!$#:'2'%!*'!#,4-.&)!J!(#'%6)!
!" T-!I$#*-*!('%4)$%-12'!*'!%I!'F'.I.#5$D!
!" 9$-!'%&#,-.#5$!*'!.)%&'%W!&-$&)!'.)$5,#.)%!.),)!*'!'%OI'(Q)!*'!('-2#Q-.#5$W!&'$#'$*)!'$!.I'$&-[!
!" .)%&'%!*'!-*UI#%#.#5$!?*'!4()*I.&)%CW!)!*'!.)$&(-&-.#5$!?*'!%'(:#.#)%CW!)!*'!*'%-(()22)!?*'!%)2I.#)$'%!22-:'!'$!,-$)CW!4I*#'$*)!%'(!$'.'%-(#)!':-2I-(!*#O'('$&'%!-2&'($-&#:-%!
!" .)%&'%!*'!#,42-$&-.#5$!#$#.#-2!J!,-$&'$#,#'$&)!'$!'2!&#',4)!
!" .)%&'%!*'!O)(,-.#5$W! &-$&)!*'! 2)%!)4'(-*)('%!.),)!*'! 2)%!I%I-(#)%W!%'60$!.)$:'$6-!-2!.-%)!
!" .)%&'%!*'!'M42)&-.#5$!
!" #,4-.&)!'$!2-!4()*I.&#:#*-*!*'!2-!E(6-$#Q-.#5$!
!" 9$-!('2-.#5$!*'!%I1&-('-%!-!-O()$&-(W!&'$#'$*)!'$!.I'$&-!
!" .-,1#)%!'$!2-!$)(,-&#:-!J!*'%-(()22)!*'!4().'*#,#'$&)%!
!" %)2I.#5$!&;.$#.-[!4()6(-,-%W!'UI#4)%W!.),I$#.-.#)$'%!'!#$%&-2-.#)$'%W!
!" 42-$!*'!*'%42#'6I'!
!" 42-$!*'!O)(,-.#5$!
!" 9$-!'%&#,-.#5$!*'2!&#',4)!*'!'F'.I.#5$!*'%*'!%I!-((-$UI'!V-%&-!%I!4I'%&-!'$!)4'(-.#5$D!
!" 9$-!'%&#,-.#5$!*'2!'%&-*)!*'!(#'%6)!?#,4-.&)!J!(#'%6)!('%#*I-2!-!%I!.),42'.#5$CD!
!" 9$!%#%&',-!*'!#$*#.-*)('%!*'!'O#.-.#-!J!'O#.#'$.#-!UI'!4'(,#&-$!.)$).'(!'$!.-*-!,),'$&)!2-!.-2#*-*!*'2!*'%',4'c)!*'!2-!OI$.#5$!*'!%'6I(#*-*!UI'!%'!*'%'-!J!%I!':)2I.#5$!&',4)(-2D!
T-%!'%&#,-.#)$'%!-$&'(#)('%!4I'*'$!%'(!,IJ!4('.#%-%!'$! 2)%!4()6(-,-%!%'$.#22)%h! 4'()!4I'*'$!%'(!%#,42','$&'!)(#'$&-&#:-%!'$!2)%!4()6(-,-%!.),42'F)%!UI'!.)$22':'$!2-!('-2#Q-.#5$!*'!I$!4()gJ'.&)!'%4'.RO#.)!*'!%'6I(#*-*D!L$!'%&'!02&#,)!.-%)W!.-*-!4()J'.&)!*'%-(()22-(8!2)%!*'&-22'%!02&#,)%!4)(!,'*#)!*'!I$-!%'(#'!*'!&-('-%!4()4#-%!*'!.-*-!4()J'.&)!UI'W!'$!2R$'-%!6'$'(-2'%!('%4)$*'(8$!-!2)%!%#6I#'$&'%!4I$&)%[!
!" L%&I*#)!*'!2-!)O'(&-!*'2!,'(.-*)[!4()*I.&)%!J!%'(:#.#)%D!
!" 3)%&'!*'!I$!*'%-(()22)!'%4'.RO#.)W!4()4#)!)!%I1.)$&(-&-*)D!
!" ]#!%'!'%&#,-!-*'.I-*)!I$!*'%-(()22)!'%4'.RO#.)!V-J!UI'!*'&'(,#$-([!
!" 2-!'%4'.#O#.-.#5$!OI$.#)$-2!J!$)gOI$.#)$-2!*'2!*'%-(()22)!
!" '2!,;&)*)!*'!*'%-(()22)!UI'!6-(-$&#.'!2-!%'6I(#*-*!*'2!$I':)!.),4)$'$&'!
!" 2)%!,'.-$#%,)%!*'!,'*#*-!?.)$&()2'%C!UI'!*'1'!22':-(!',4)&(-*)%!
!" 2)%!.(#&'(#)%!*'!-.'4&-.#5$!
!" '2!42-$!*'!,-$&'$#,#'$&)[!#$.#*'$.#-%!J!':)2I.#5$!
"-6'(#&!:'(%#5$!<! ! L%&(I.&I(-.#5$!*'2!4()J'.&)!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!KK!?*'!@ABC!
P3: Gestión de riesgos A3.2: Elaboración del plan de seguridad de la información T3.2.2: Plan de ejecución
Objetivos
!" E(*'$-(!&',4)(-2,'$&'!2)%!4()6(-,-%!*'!%'6I(#*-*!
Productos de entrada
!" Z'%I2&-*)%!*'!2-!&-('-!`>D@D@W!3-2#O#.-.#5$!*'!2)%!(#'%6)%!
!" Z'%I2&-*)%!*'!2-!&-('-!`>D<D@W!/()6(-,-%!*'!%'6I(#*-*!
Productos de salida
!" 3()$)6(-,-!*'!'F'.I.#5$!*'2!42-$!
!" Plan de Seguridad
Técnicas, prácticas y pautas
!" +$82#%#%!*'!(#'%6)%!?:'(!4().'%)!/<C!
!" /2-$#O#.-.#5$!*'!4()J'.&)%!?:'(!m^IR-!*'!`;.$#.-%m!>DAC!
Participantes
!" \'4-(&-,'$&)!*'!*'%-(()22)!
!" \'4-(&-,'$&)!*'!.),4(-%!
!
i-J!UI'!)(*'$-(!'$!'2!&#',4)!2)%!4()6(-,-%!*'!%'6I(#*-*!&'$#'$*)!'$!.I'$&-!2)%!%#6I#'$&'%!O-.&)g('%[!
!" 2-!.(#&#.#*-*W!6(-:'*-*!)!.)$:'$#'$.#-!*'!2)%!#,4-.&)%!Jd)!(#'%6)%!UI'!%'!-O()$&-$W!&'$#'$*)!,8M#,-!4(#)(#*-*!2)%!4()6(-,-%!UI'!-O()$&'$!%#&I-.#)$'%!.(R&#.-%!
!" '2!.)%&'!*'2!4()6(-,-!
!" 2-!*#%4)$#1#2#*-*!*'2!4'(%)$-2!4()4#)!4-(-! ('%4)$%-1#2#Q-(%'!*'! 2-!*#('..#5$! ?JW!'$!%I!.-%)W!'F'.I.#5$C!*'!2-%!&-('-%!4()6(-,-*-%!
!" )&()%!O-.&)('%!.),)!4I'*'!%'(!2-!'2-1)(-.#5$!*'2!4('%I4I'%&)!-$I-2!*'!2-!E(6-$#Q-.#5$W!2-%!('2-.#)$'%!.)$!)&(-%!)(6-$#Q-.#)$'%W! 2-!':)2I.#5$!*'2!,-(.)!2'6-2W!('62-,'$&-(#)!)!.)$&(-.g&I-2W!'&.D!
`R4#.-,'$&'!I$!42-$!*'!%'6I(#*-*!%'!42-$#O#.-!'$!&('%!$#:'2'%!*'!*'&-22'[!
Plan director (uno).
+!,'$I*)!*'$),#$-*)!j42-$!*'!-.&I-.#5$kW!&(-1-F-!%)1('!I$!4'(#)*)!2-(6)!?&R4#.-,'$&'!'$g&('!>!J!A!-c)%CW!'%&-12'.#'$*)!2-%!*#('.&(#.'%!*'!-.&I-.#5$D!
Plan anual (una serie de planes anuales).
`(-1-F-!%)1('!I$!4'(#)*)!.)(&)!?&R4#.-,'$&'!'$&('!@!J!<!-c)%CW!'%&-12'.#'$*)!2-!42-$#O#.-.#5$!*'!2)%!4()6(-,-%!*'!%'6I(#*-*D!
Plan de proyecto (un conjunto de proyectos con su planificación).
`(-1-F-!'$!'2!.)(&)!42-Q)!?&R4#.-,'$&'!,'$)%!*'!@!-c)CW!'%&-12'.#'$*)!'2!42-$!*'&-22-*)!*'!'F'.I.#5$!*'!.-*-!4()6(-,-!*'!%'6I(#*-*D!
]'!*'1'!*'%-(()22-(!I$!?@C!42-$!*#('.&)(!0$#.)W!UI'!'%!'2!UI'!*-!4'(%4'.&#:-!J!I$#*-*!*'!)1F'&#:)%!-! 2-%!-.&I-.#)$'%!4I$&I-2'%D!L%&'!42-$!*#('.&)(!4'(,#&'! #(!*'%-(()22-$*)!42-$'%!-$I-2'%!UI'W!*'g$&()!*'2!,-(.)!'%&(-&;6#.)W!:-$!'%&(I.&I(-$*)!2-!-%#6$-.#5$!*'!('.I(%)%!4-(-!2-!'F'.I.#5$!*'!2-%!&-('-%W!'$!4-(&#.I2-(!4-(&#*-%!4('%I4I'%&-(#-%D!oW!4)(!02&#,)W!V-1(8!I$-!%'(#'!*'!4()J'.&)%!UI'!,-g&'(#-2#Q-$!2)%!4()6(-,-%!*'!%'6I(#*-*D!
"-6'(#&!:'(%#5$!<! ! L%&(I.&I(-.#5$!*'2!4()J'.&)!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!KN!?*'!@ABC!
3.5.3. Actividad A3.3: Ejecución del plan
L%&-!-.&#:#*-*!.)$%&-!*'!I$!$0,'()!*'!&-('-%!UI'!*'4'$*'!*'2!42-$!*'!%'6I(#*-*!*'&'(,#$-*)!'$!2-!-.&#:#*-*!+>D<W!4I'%!%'!&(-&-!*'!#(!'F'.I&-$*)!2)%!4()6(-,-%!-22R!42-$#O#.-*)%D!
L%&-!-.&#:#*-*!.)$%&-!*'!7!&-('-%W!&-$&-%!.),)!%'!V-J-!4(':#%&)!'$!'2!42-$!*'!%'6I(#*-*[!
`>D>Dv[!LF'.I.#5$!*'!.-*-!4()6(-,-!*'!%'6I(#*-*>G
P3: Gestión de riesgos A3.3: Ejecución del plan T3.3.*: Ejecución de cada programa de seguridad
Objetivos
!" +2.-$Q-(!2)%!)1F'&#:)%!4(':#%&)%!'$!'2!42-$!*'!%'6I(#*-*!4-(-!.-*-!4()6(-,-!42-$#O#.-*)!
Productos de entrada
!" Z'%I2&-*)%!*'!2-!-.&#:#*-*!+>D<W!/2-$!*'!%'6I(#*-*!
!" /()6(-,-!*'!%'6I(#*-*!UI'!$)%!).I4-!
!" +$82#%#%!*'!(#'%6)%!-$&'%!*'!2-!'F'.I.#5$!*'2!42-$!
Productos de salida
!" ]-2:-6I-(*-!#,42-$&-*-!
!" 7)(,-%!*'!I%)!J!)4'(-.#5$!
!" ]#%&',-!*'!#$*#.-*)('%!*'!'O#.-.#-!J!'O#.#'$.#-!*'2!*'%',4'c)!*'!2)%!)1F'&#:)%!*'!%'6I(#g*-*!4'(%'6I#*)%!
!" ")*'2)!*'!:-2)(!-.&I-2#Q-*)!
!" "-4-!*'!(#'%6)%!-.&I-2#Q-*)!
!" L%&-*)!*'!(#'%6)!-.&I-2#Q-*)!?#,4-.&)!J!(#'%6)!('%#*I-2'%CD!
Técnicas, prácticas y pautas
!" +$82#%#%!*'!(#'%6)%!?:'(!4().'%)!/<C!
!" /2-$#O#.-.#5$!*'!4()J'.&)%!?:'(!m^IR-!*'!`;.$#.-%m!>DAC!
Participantes
!" L2!'UI#4)!*'!4()J'.&)[!':)2I.#5$!*'2!-$82#%#%!*'!(#'%6)%!
!" /'(%)$-2!'%4'.#-2#Q-*)!'$!2-!%-2:-6I-(*-!'$!.I'%$!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
>G!L%&-!-.&#:#*-*!.)$%&-!*'!I$!$0,'()!#$*'&'(,#$-*)!*'!&-('-%!-!*'&'(,#$-(!'$!.-*-!4()J'.&)D!\'!-VR!'2!I$)!*'!2-!$)&-.#5$!.)$!vD!
"-6'(#&!:'(%#5$!<! ! L%&(I.&I(-.#5$!*'2!4()J'.&)!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!KP!?*'!@ABC!
3.5.4. Síntesis del proceso P3
3.5.4.1. Hitos de control
Hito de control H3.1:
T-!\#('..#5$!4().'*'(8!-!2-!-4()1-.#5$!)!$)!*'2!/2-$!*'!]'6I(#*-*W! #$.2IJ'$*)!2-!('2-.#5$!*'!4()6(-,-%!*'!%'6I(#*-*!J!'2!.()$)6(-,-!4()4I'%&)!4-(-!%I!'F'.I.#5$D!
Hito de control H3.*:
Compleción!*'!.-*-!4()6(-,-!*'!%'6I(#*-*W!%-&#%O-.#'$*)! 2)%!.(#&'(#)%!*'!-.'4&-.#5$! #,g4I'%&)%!'$!'2!/2-$!*'!]'6I(#*-*D!
3.5.4.2. Resultados
Documentación intermedia
!" \'.#%#)$'%!*'!.-2#O#.-.#5$!*'!2)%!'%.'$-(#)%!*'!#,4-.&)!J!(#'%6)!
Documentación final
!" /2-$!*'!]'6I(#*-*!
3.5.5. Lista de control del proceso P3
#" 3-2#O#.-.#5$!*'!2)%!(#'%6)%!?`>D@D@C!
#" H*'$&#O#.-.#5$!*'!2)%!4()6(-,-%!*'!%'6I(#*-*!$'.'%-(#)%!?`>D<D@C!
#" /()6(-,-%!*'!%'6I(#*-*!
#" )1F'&#:)%!
#" '%&#,-.#5$!*'!'%OI'(Q)!
#" '%&#,-.#5$!*'!.)%&'!
#" 42-$!*'!-.'4&-.#5$!
#" 42-$!*'!)4'(-.#5$!
#" 42-$!*'!,-$&'$#,#'$&)!
#" 42-$!*'!O)(,-.#5$!
#" %#%&',-!*'!.)$&()2'%!*'!'O#.-.#-!
#" %#%&',-!*'!.)$&()2'%!*'!'O#.#'$.#-!
#" '%&#,-.#5$!*'!#,4-.&)!J!(#'%6)!('%#*I-2'%!
#" 3-2'$*-(#)!*'!'F'.I.#5$!?`>D<D<C!
#" /2-$!*'!%'6I(#*-*!'%&(-&;6#.)[!2-(6)!42-Q)!?+>D<C!
#" /2-$!*'!%'6I(#*-*!&8.&#.)[!,'*#)!42-Q)!?+>D<C!
#" /2-$'%!)4'(-&#:)%[!4()J'.&)%!%#$6I2-('%!?+>D<C!
"-6'(#&!:'(%#5$!<! ! \'%-(()22)!*'!%#%&',-%!*'!#$O)(,-.#5$!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!NS!?*'!@ABC!
4. Desarrollo de sistemas de información T-%!-42#.-.#)$'%!(software)!.)$%&#&IJ'$!I$!)!*'!-.&#:)%!O('.I'$&'!J!$I.2'-(!4-(-!'2!&(-&-,#'$&)!*'!2-!#$O)(,-.#5$!'$!6'$'(-2!J!4-(-!2-!4('%&-.#5$!*'!%'(:#.#)%!1-%-*)%!'$!-UI'22-!#$O)(,-.#5$D!T-!4('%'$.#-!*'!-42#.-.#)$'%!'$!I$!%#%&',-!*'! #$O)(,-.#5$!'%!%#',4('!I$-! OI'$&'!*'! (#'%6)!'$!'2!%'$&#*)!*'!UI'!.)$%&#&IJ'$!I$!4I$&)!*)$*'!%'!4I'*'$!,-&'(#-2#Q-(!-,'$-Q-%D!+!:'.'%W!-*',8%W!2-%!-42#.-.#)$'%!%)$!4-(&'!*'!2-!%)2I.#5$!'$!'2!%'$&#*)!*'!UI'!.)$%&#&IJ'$!I$-!%-2:-6I-(*-!O('$&'!-!(#'%6)%!4)&'$.#-2'%D!L$!.I-2UI#'(!.-%)!'%!$'.'%-(#)!UI'!'2!(#'%6)!*'(#:-*)!*'!2-!4('%'$.#-!*'!-42#.-.#)$'%!'%&;!1-F)!.)$&()2D!
L2!-$82#%#%!*'!2)%!(#'%6)%!.)$%&#&IJ'!I$-!4#'Q-!OI$*-,'$&-2!'$!'2!*#%'c)!J!*'%-(()22)!*'!%#%&',-%!*'!#$O)(,-.#5$!%'6I()%D!L%!4)%#12'W!'!#,4'(-&#:)W!!#$.)(4)(-(!*I(-$&'!2-!O-%'!*'!*'%-(()22)!2-%!OI$g.#)$'%!J!,'.-$#%,)%!UI'!('OI'(Q-$!2-!%'6I(#*-*!*'2!$I':)!%#%&',-!J!*'2!4()4#)!4().'%)!*'!*'%-g(()22)W!-%'6I(-$*)!%I!.)$%#%&'$.#-!J!%'6I(#*-*W! .),42'&-$*)!'2!42-$!*'!%'6I(#*-*!:#6'$&'!'$! 2-!E(6-$#Q-.#5$D!L%!I$!V'.V)!('.)$).#*)!UI'!&),-(!'$!.)$%#*'(-.#5$!2-!%'6I(#*-*!*'2!%#%&',-!-$&'%!J!*I(-$&'!%I!*'%-(()22)!'%!,8%!'O'.&#:)!J!'.)$5,#.)!UI'!&),-(2-!'$!.)$%#*'(-.#5$!-!4)%&'(#)(#D!T-!%'6I(#*-*!*'1'!'%&-(!',1'1#*-!'$!'2!%#%&',-!*'%*'!%I!4(#,'(-!.)$.'4.#5$D!
]'!4I'*'$!#*'$&#O#.-(!*)%!)%!*'!-.&#:#*-*'%!*#O'('$.#-*-%[!
!" SSI[!-.&#:#*-*'%!('2-.#)$-*-%!.)$!2-!4()4#-!%'6I(#*-*!*'2!%#%&',-!*'!#$O)(,-.#5$D!
!" SPD[!-.&#:#*-*'%!UI'!:'2-$!4)(!2-!%'6I(#*-*!*'2!4().'%)!*'!*'%-(()22)!*'2!%#%&',-!*'!#$O)(g,-.#5$D!
`(-%!I$-!4(#,'(-!'M4)%#.#5$!%)1('!'2!*'%-(()22)!*'!-42#.-.#)$'%!'$!6'$'(-2W!2-!%'..#5$!BDA!4()OI$g*#Q-!'$!%I!-42#.-.#5$!-!";&(#.-!:'(%#5$!>D!";&(#.-!V-!%#*)!*'%-(()22-*-!4)(!'2!3]+L!.),)!2-!j"'g&)*)2)6R-!*'!/2-$#O#.-.#5$W!\'%-(()22)!J!"-$&'$#,#'$&)!*'!%#%&',-%!*'!#$O)(,-.#5$kD!
4.1. Inicialización de los procesos i-J!:-(#-%!(-Q)$'%!UI'!4I'*'$!22':-(!-!42-$&'-(!'2!*'%-(()22)!*'!I$-!$I':-!-42#.-.#5$!)!2-!,)*#O#g.-.#5$!*'!I$-!'M#%&'$&'[!
Nuevos servicios y/o datos.
!" Z'UI#'('!'2!*'%-(()22)!*'!$I':-%!-42#.-.#)$'%!)!2-!,)*#O#.-.#5$!*'!-42#.-.#)$'%!)4'(-&#g:-%D!/I'*'!#,42#.-(!2-!*'%-4-(#.#5$!*'!-42#.-.#)$'%!)4'(-&#:-%D!
!" T-!#$#.#-&#:-!2-!22':-!'2!('%4)$%-12'!*'!*'%-(()22)W!-.&I-$*)!'2!('%4)$%-12'!*'!%'6I(#*-*!.),)!%I1%#*#-(#)D!
Evolución tecnológica. T-%! &'.$)2)6R-%!`H3!%'!'$.I'$&(-$!'$!':)2I.#5$!.)$&#$I-W!4I*#'$*)!4('%'$&-(%'!.-,1#)%!'$!2-%!&;.$#.-%!*'!*'%-(()22)!*'!%#%&',-%W!'$!2)%!2'$6I-F'%!)!2-%!42-&-gO)(,-%!*'!*'%-(()22)W!'$!2-%!42-&-O)(,-%!*'!'M42)&-.#5$W!'$!2)%!%'(:#.#)%!*'!'M42)&-.#5$W!'$!2)%!%'(:#.#)%!*'!.),I$#.-.#)$'%W!'&.D!
!" Z'UI#'('!'2!*'%-(()22)!*'!$I':-%!-42#.-.#)$'%!)!2-!,)*#O#.-.#5$!*'!-42#.-.#)$'%!)4'(-&#g:-%D!/I'*'!#,42#.-(!2-!*'%-4-(#.#5$!*'!-42#.-.#)$'%!)4'(-&#:-%D!
!" T-!#$#.#-&#:-!2-!22':-!'2!('%4)$%-12'!*'!*'%-(()22)W!-.&I-$*)!'2!('%4)$%-12'!*'!%'6I(#*-*!.),)!%I1%#*#-(#)D!
Modificación de la calificación de seguridad de servicios o datos.
!" `R4#.-,'$&'! ('UI#'('! 2-!,)*#O#.-.#5$! *'! -42#.-.#)$'%! )4'(-&#:-%D! Z-(-,'$&'! #,42#.-! '2!*'%-(()22)!*'!$I':-%!-42#.-.#)$'%!)!2-!*'%-4-(#.#5$!*'!-42#.-.#)$'%!)4'(-&#:-%D!
!" T-! #$#.#-&#:-! 2-! 22':-!'2! ('%4)$%-12'!*'!%'6I(#*-*W!-.&I-$*)!'2! ('%4)$%-12'!*'!%#%&',-%!.),)!%I1%#*#-(#)D!
Consideración de nuevas amenazas. T-!':)2I.#5$!*'! 2-%!&'.$)2)6R-%!J! 2)%!%'(:#.#)%!*'!.)g,I$#.-.#)$'%!4I'*'$!V-1#2#&-(!$I':-%!-,'$-Q-%!)!.)$:'(&#(!-,'$-Q-%!UI'!'(-$!*'%4('.#-g12'%!'$!'2!4-%-*)!'$!-,'$-Q-%!('2':-$&'%!'$!'2!OI&I()D!
"-6'(#&!:'(%#5$!<! ! \'%-(()22)!*'!%#%&',-%!*'!#$O)(,-.#5$!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!N@!?*'!@ABC!
!" `R4#.-,'$&'!('UI#'('!2-!,)*#O#.-.#5$!*'!-42#.-.#)$'%!)4'(-&#:-%W!1#'$!'$!%I!.)*#O#.-.#5$!)W! ,8%! O('.I'$&','$&'W! '$! %I%! .)$*#.#)$'%! *'! 'M42)&-.#5$D! Z-(-,'$&'! #,42#.-! '2!*'%-(()22)!*'!$I':-%!-42#.-.#)$'%!)!2-!*'%-4-(#.#5$!*'!-42#.-.#)$'%!)4'(-&#:-%D!
!" T-! #$#.#-&#:-! 2-! 22':-!'2! ('%4)$%-12'!*'!%'6I(#*-*W!-.&I-$*)!'2! ('%4)$%-12'!*'!%#%&',-%!.),)!%I1%#*#-(#)D!
Modificación de los criterios de calificación de riesgos. /I'*'!:'$#(! #$*I.#*)!4)(!.(#&'(#)%!*'!.-2#*-*!)4'(-&#:-W!4)(!$):'*-*'%!'$!2-!2'6#%2-.#5$!-42#.-12'W!'$!2-!('62-,'$&-.#5$!%'.&)g(#-2!)!4)(!-.I'(*)%!)!.)$&(-&)%!.)$!&'(.'()%D!!
!" `R4#.-,'$&'! ('UI#'('! 2-!,)*#O#.-.#5$! *'! -42#.-.#)$'%! )4'(-&#:-%D! Z-(-,'$&'! #,42#.-! '2!*'%-(()22)!*'!$I':-%!-42#.-.#)$'%!)!2-!*'%-4-(#.#5$!*'!-42#.-.#)$'%!)4'(-&#:-%D!
!" T-! #$#.#-&#:-! 2-! 22':-!'2! ('%4)$%-12'!*'!%'6I(#*-*W!-.&I-$*)!'2! ('%4)$%-12'!*'!%#%&',-%!.),)!%I1%#*#-(#)D!
4.2. Ciclo de vida de las aplicaciones `R4#.-,'$&'W!I$-!-42#.-.#5$!%#6I'!I$!.#.2)!*'!:#*-!-!&(-:;%!*'!:-(#-%!O-%'%[!
!
'%4'.#O#.-.#5$
-*UI#%#.#5$?'%&8$*-(C
*'%-(()22)%I1.)$&(-&-*)
*'%-(()22)4()4#)
-.'4&-.#5$
*'%42#'6I'
)4'(-.#5$ ,-$&'$#,#'$&)!
!
Especificación. L$!'%&-!O-%'!%'!*'&'(,#$-$!2)%!('UI#%#&)%!UI'!*'1'!%-&#%O-.'(!2-!-42#.-.#5$!J!%'!'2-1)(-!I$!42-$!4-(-!2-%!%#6I#'$&'%!O-%'%D!
Adquisición o desarrollo. /-(-!&(-*I.#(!I$-!'%4'.#O#.-.#5$!'$!I$-!('-2#*-*W!%'!4I'*'!-*UI#(#(!I$!4()*I.&)W!)!%'!4I'*'!*'%-(()22-(W!1#'$!'$!.-%-W!1#'$!4)(!%I1.)$&(-&-.#5$!'M&'($-D!
Aceptación. `-$&)!%#!'%!I$-!-42#.-.#5$!$I':-!.),)!%#!'%!,)*#O#.-.#5$!*'!I$-!-42#.-.#5$!-$&'g(#)(W!$I$.-!I$-!-42#.-.#5$!*'1'!'$&(-(!'$!)4'(-.#5$!%#$!V-1'(!%#*)!O)(,-2,'$&'!-.'4&-*-D!
Despliegue. 3)$%#%&'$&'!'$! #$%&-2-(!'2!.5*#6)!'$!'2!%#%&',-!J!.)$O#6I(-(2)!4-(-!UI'!'$&('!'$!)4'(-.#5$D!
Operación. T-!-42#.-.#5$!%'!I%-!4)(!4-(&'!*'!2)%!I%I-(#)%W!%#'$*)!-&'$*#*)%!2)%!#$.#*'$&'%!4)(!4-(&'!*'!I%I-(#)%!Jd)!2)%!)4'(-*)('%D!
Mantenimiento. f#'$!4)(UI'!-4-('.'$!$I':)%!('UI#%#&)%W!1#'$!4)(UI'!%'!V-!*'&'.&-*)!I$!O-g22)W!2-!-42#.-.#5$!4I'*'!('UI'(#(!I$!,-$&'$#,#'$&)!UI'!)12#6I'!-!('6('%-(!-!.I-2UI#'(-!*'!2-%!'&-4-%!-$&'(#)('%W!'$!02&#,-!#$%&-$.#-!-!2-!'%4'.#O#.-.#5$!18%#.-D!
4.2.1. Plan de sistemas
T-%!-42#.-.#)$'%!#$O)(,8&#.-%!%)$!I$!.),4)$'$&'!*'!2)%!%#%&',-%!*'!#$O)(,-.#5$D!L%!'$!'2!,-(.)!*'!I$!%#%&',-!*'!#$O)(,-.#5$!*)$*'!2-%!*#O'('$&'%!-42#.-.#)$'%!%'!',4)&(-$!4-(-!V-.'(%'!.-(6)!
"-6'(#&!:'(%#5$!<! ! \'%-(()22)!*'!%#%&',-%!*'!#$O)(,-.#5$!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!N<!?*'!@ABC!
*'!I$-!O(-..#5$!*'!2)%!%'(:#.#)%!('UI'(#*)%D!9$!42-$!*'!%#%&',-%!*'&'(,#$-!'2!,-(.)!*'!*'%-(()22)!J!'M42)&-.#5$!*'!2-%!-42#.-.#)$'%!#$O)(,8&#.-%W!.)$.('&-,'$&'[!
Los servicios requeridos, &-$&)!4-(-! 2)%!I%I-(#)%! #$&'($)%W!.),)! 2)%!%'(:#.#)%!*'!%)4)(&'!-!I%I-(#)%!)!-42#.-.#)$'%!#$&'($-%D!
Los datos funcionales UI'!%'!I#Q-$D!
Las aplicaciones UI'!6'%&#)$-$!*#.V)%!*-&)%D!
El equipamiento: )(*'$-*)('%!J!%'(:#.#)%!*'!.),I$#.-.#)$'%D!
\'%*'!'2!4I$&)!*'!:#%&-!*'!%'6I(#*-*W!I$!42-$!*'!%#%&',-%!4'(,#&'!
!" #*'$&#O#.-(!J!:-2)(-(!2)%!%'(:#.#)%!'%'$.#-2'%!
!" #*'$&#O#.-(W!.2-%#O#.-(!J!:-2)(-(!2)%!*-&)%!'%'$.#-2'%!
!" *'&'(,#$-(!2-!4)2R&#.-!*'!%'6I(#*-*!*'!2-!E(6-$#Q-.#5$h!'%!*'.#([!
!" '2!.)$&'M&)!2'6-2!'$!'2!UI'!)4'(-!2-!E(6-$#Q-.#5$!
!" 2)%!.(#&'(#)%!*'!'M.'2'$.#-!'$!2-!4('%&-.#5$!*'!2)%!%'(:#.#)%!
!" 2)%!()2'%!*'2!4'(%)$-2!('2-.#)$-*)!.)$!2)%!%#%&',-%!*'!#$O)(,-.#5$!
L2!42-$!*'!%#%&',-%!4'(,#&'!'%&-12'.'(!'2!,)*'2)!*'!:-2)(h!'%!*'.#(W! 2)%!6(-$*'%!'4R6(-O'%!?-.&#g:)%C!J!2-%!4(#,'(-%!:-2)(-.#)$'%!*'!2)!UI'!-.-1-(8!%#'$*)!I$!-$82#%#%!*'!(#'%6)%!*'&-22-*)D!
4.3. Análisis de riesgos 3),)!4-(&'!*'!I$!%#%&',-!*'!#$O)(,-.#5$W!2)%!(#'%6)%!-%).#-*)%!-!I$-!-42#.-.#5$!*'1'$!%'(!.)g$).#*)%!J!'%&-(!6'%&#)$-*)%D!`-$&)!%#!%)$!(#'%6)%!%)4)(&-*)%!4)(!2-!-42#.-.#5$W!)!%)$!(#'%6)%!('g4'(.I&#*)%!%)1('!-.&#:)%!%I4'(#)('%W!)!%)$!(#'%6)%!-.I,I2-*)%!%)1('!-.&#:)%!#$O'(#)('%D!
"-6'(#&!4'(,#&'!,)*'2-(!*#('.&-,'$&'!2-!-42#.-.#5$!.),)!I$!-.&#:)W!'%&-12'.#'$*)!%I%!*'4'$*'$g.#-%W!1#'$!*'!-.&#:)%!%I4'(#)('%!UI'!*'4'$*'$!*'!'22-W!1#'$!*'!-.&#:)%!#$O'(#)('%!UI'!2-!%)4)(&-$D!L2!,;&)*)!4'(,#&'!#*'$&#O#.-(!J!:-2)(-(!-,'$-Q-%!J!%-2:-6I-(*-%W!*'(#:-$*)!#$O)(,-.#5$!*'!#,4-.g&)!J!(#'%6)!%)1('!2-!4()4#-!-42#.-.#5$!J!2)%!-.&#:)%!('2-.#)$-*)%!.)$!'22-D!
AGR autocontenido. ]#!2-!E(6-$#Q-.#5$!$)!V-!('-2#Q-*)!I$!4()J'.&)!+^ZW!%'(8!4('.#%)!22':-(g2)! -! .-1)! #$.)(4)(-$*)! -2!,'$)%! 2)%! -.&#:)%! *#('.&-! )! #$*#('.&-,'$&'! ('2-.#)$-*)%! .)$! 2-!-42#.-.#5$D!
AGR marginal. ]#!2-!E(6-$#Q-.#5$!J-!V-!('-2#Q-*)!I$!4()J'.&)!+^ZW!1-%&-!(':#%-(!2)%!('%I2&-g*)%!*'!*#.V)!4()J'.&)! #$.)(4)(-$*)! 2)%!$I':)%!-.&#:)%D!T-!-4-(#.#5$!*'!I$-!$I':-!-42#.-g.#5$!4I'*'!#,42#.-(!$I':)%!%'(:#.#)%W!$I':)%!*-&)%W!$I':)!'UI#4-,#'$&)W!$I':)%!2).-2'%!J!$I':)!4'(%)$-2D!`-,1#;$!4I'*'!#,42#.-(!2-!*'%-4-(#.#5$!*'!-$I)%!-.&#:)%!UI'!%'!:'$!%Ig4'(-*)%!4)(!2-!$I':-!-42#.-.#5$!J!%I%!4)%#1#2#*-*'%D!L$!.-*-!.-%)!.)$.('&)!V-J!UI'!*'&'(g,#$-(!2)!UI'!V-J!UI'!-c-*#(!J!2)!UI'!V-J!UI'!'2#,#$-(W!%#6I#'$*)!2-%!-.&#:#*-*'%!+<D@W!+<D<!J!+<D>!*'2!4().'%)!/<W!+$82#%#%!*'!(#'%6)%D!
`-$&)!%#!%'!V-!%'6I#*)!I$-!I!)&(-!-4()M#,-.#5$W!-2!O#$-2!%'!*#%4)$'!*'!I$-!('2-.#5$!*'!#,4-.&)%!J!(#'%6)%W!&-$&)!%)1('!2-!-42#.-.#5$!.),)!%)1('!%I!'$&)($)D!/-(-!*'(#:-(!'%&)%!*-&)%!%'!%#6I'$!2)%!4-%)%!*'! 2-!-.&#:#*-*!+<DB!*'2!4().'%)!/<D!/-(-! #$&'(4('&-(! 2)%! ('%I2&-*)%!%'! ('.I(('!-! 2-! &-('-!+<DBD>!*'2!4().'%)!/<W!#$&'(4('&-.#5$!*'!2)%!('%I2&-*)%D!
4.4. Gestión de riesgos L2! 4().'%)!/>!*'!6'%$! *'! (#'%6)%! ('.),#'$*-! %-2:-6I-(*-%! J! ':-20-!'2! 'O'.&)!*'! 2-%! %-2:-g6I-(*-%!*'%42'6-*-%!%)1('!'2!#,4-.&)!J!'2!(#'%6)D!T-%!*'.#%#)$'%!UI'!%'!-*)4&'$!*'4'$*'(8$!*'!2)%!.(#&'(#)%!'%&-12'.#*)%!'$!2-!4)2R&#.-!*'!%'6I(#*-*!*'!2-!E(6-$#Q-.#5$!J!*'!)&(-%!.)$%#*'(-.#)$'%!'%4'.RO#.-%!*'!.-*-!.-%)D!]#!1#'$!2-!4)2R&#.-!*'!%'6I(#*-*!'%&-12'.'!I$!,-(.)!*'!('O'('$.#-!UI'!$)! 4I'*'! :#)2'$&-(%'W! '%! V-1#&I-2! UI'! $)! 4(':'-! &)*)%! 2)%! *'&-22'%! &;.$#.)%! J! .)JI$&I(-2'%! *'2!%'(:#.#)!4-(-!&),-(!*'.#%#)$'%!4('.#%-%D!
"-6'(#&!:'(%#5$!<! ! \'%-(()22)!*'!%#%&',-%!*'!#$O)(,-.#5$!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!N>!?*'!@ABC!
\'1#*)!-!2-!#$&'(('2-.#5$!'$&('!2)%!'2','$&)%!UI'!.)$%&#&IJ'$!I$!%#%&',-W!$)!'%!%IO#.#'$&'!4()&'6'(!I$!.#'(&)!)!*'!-.&#:)%!4-(-!4()&'6'(!'2!.)$FI$&)D!7)!)1%&-$&'W!'%&'!.-4R&I2)!%'!.'$&(-!'$!2-%!,'g*#*-%!UI'!*'1'$!-42#.-(%'!-!2-%!-42#.-.#)$'%!4-(-!UI'!'%&-%!$)!,'$)%.-1'$!2-!%'6I(#*-*!*'2!%#%g&',-D!
]#',4('!*#(#6#*)%!4)(! 2-! #$#.#-&#:-!J! 2-!.)(()1)(-.#5$!*'2!4().'%)!*'!6'%$!*'!(#'%6)%W!V-J!UI'!&'$'(!'$!.I'$&-!2)%!%#6I#'$&'%!-%4'.&)%[!
Durante la especificación:
!" \#,'$%#)$-*)!
!" /'(O#2'%!*'!I%I-(#)!
!" Z'UI#%#&)%!*'!#*'$&#O#.-.#5$!J!-I&'$&#.-.#5$!*'!I%I-(#)%!
!" Z'UI#%#&)%!*'!.#O(-*)!
!" Z'UI#%#&)%!*'!,)$#&)(#Q-.#5$!?.)$&()2C!J!('6#%&()!(log)[!
!" *'!*-&)%!*'!'$&(-*-!
!" *'!*-&)%!*'!%-2#*-!
!" *'!*-&)%!#$&'(,'*#)%!
!" *'!-..'%)!-!2-!-42#.-.#5$!
!" *'!-.&#:#*-*!?I%)C!
Si se adquiere software estándar ...
!" 3)$&(-&)%!*'!-*UI#%#.#5$!J!,-$&'$#,#'$&)!
Si se subcontrata el desarrollo de software ...
!" 3)$&(-&)%!*'!-*UI#%#.#5$!J!,-$&'$#,#'$&)!
!" L$&)($)!*'!*'%-(()22)[!2).-2'%W!4'(%)$-%W!42-&-O)(,-!J!V'((-,#'$&-%!
!" `;.$#.-%!*'!4()6(-,-.#5$!%'6I(-!
!" ^'%$!*'!.5*#6)!OI'$&'!
!" .)$&()2!*'!-..'%)!
!" .)$&()2!*'!:'(%#)$'%!
Si se desarrolla software en casa ...
!" 3)$*#.#)$'%!*'!,-$&'$#,#'$&)!
!" L$&)($)!*'!*'%-(()22)[!2).-2'%W!4'(%)$-%W!42-&-O)(,-!J!V'((-,#'$&-%!
!" `;.$#.-%!*'!4()6(-,-.#5$!%'6I(-!
!" ^'%$!*'!.5*#6)!OI'$&'!
!" .)$&()2!*'!-..'%)!
!" .)$&()2!*'!:'(%#)$'%!
Para realizar la aceptación:
!" /(I'1-%!*'!-.'4&-.#5$!
!" *-&)%!*'!4(I'1-!
!" %#!$)!%)$!('-2'%W!*'1'$!%'(!('-2#%&-%!
!" %#!$)!%'!4I'*'!':#&-(!UI'!%'-$!('-2'%W!V-J!UI'!.)$&()2-(!.)4#-%!J!-..'%)!
!" 4(I'1-%!OI$.#)$-2'%!?*'!2)%!%'(:#.#)%!*'!%'6I(#*-*C!
!" %#,I2-.#5$!*'!-&-UI'%!
"-6'(#&!:'(%#5$!<! ! \'%-(()22)!*'!%#%&',-%!*'!#$O)(,-.#5$!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!NB!?*'!@ABC!
!" 4(I'1-%!'$!.-(6-!
!" #$&(I%#5$!.)$&()2-*-!?hacking!;&#.)C!
!" #$%4'..#5$!*'!%'(:#.#)%!d!#$%4'..#5$!*'!.5*#6)!
!" OI6-%!*'!#$O)(,-.#5$[!.-$-2'%!'$.I1#'(&)%W!-!&(-:;%!*'!2)%!('6#%&()%W!'&.D!
!" 4I'(&-%!&(-%'(-%!*'!-..'%)!
!" '%.-2-*)!*'!4(#:#2'6#)%!
!" 4()12',-%!*'!*'%1)(*-,#'$&)!*'!('6#%&()%!(buffer overflow)
!" -.('*#&-.#)$'%!
Para realizar el despliegue:
!" H$:'$&-(#)!*'!-42#.-.#)$'%!'$!)4'(-.#5$!
!" ^'%$!*'!.-,1#)%[!$)(,-&#:-!J!4().'*#,#'$&)%!
!" L%&-12'.#,#'$&)!*'!.2-:'%!
Durante la operación:
!" 7)(,-&#:-!J!4().'*#,#'$&)%!*'!DDD!
!" 6'%$!*'!I%I-(#)%!
!" 6'%$!*'!.2-:'%!
!" 6'%$!*'!('6#%&()%!(log)
!" 6'%$!*'!#$.#*'$.#-%[!('6#%&()!*'!':#*'$.#-%W!'%.-2-*)W!42-$!*'!','(6'$.#-!J!*'!('g.I4'(-.#5$!
!" +$82#%#%!*'!('6#%&()%!(log)[!V'((-,#'$&-%W!.(#&'(#)%W!4().'*#,#'$&)%W!DDD!
!" "-$I-2'%!*'!I%)[!-*,#$#%&(-*)('%W!)4'(-*)('%!J!I%I-(#)%!
!" e)(,-.#5$[!#$#.#-2!J!.)$&#$I-[!-*,#$#%&(-*)('%W!)4'(-*)('%!J!I%I-(#)%!
En los ciclos de mantenimiento:
!" 7)(,-&#:-!J!4().'*#,#'$&)%!*'!DDD!
!" %)2#.#&I*!
!" -4()1-.#5$W! #$.2IJ'$*)!'2!-$82#%#%!*#O'('$.#-2!*'!(#'%6)%!JW!-4()1-.#5$!'$!%I!.-%)!*'!2-%!$I':-%!,'*#*-%!
Terminación
!" \'%&(I..#5$!*'!*-&)%!)4'(-.#)$-2'%!
!" 3)4#-!J!.I%&)*#-!*'!*-&)%W!.I-$*)!4().'*-!4)(!2'J!)!4)2R&#.-!#$&'($-!
!" L2#,#$-.#5$!*'2!.5*#6)!)4'(-&#:)[!'F'.I&-12'W!*-&)%!*'!.)$O#6I(-.#5$!J!.I'$&-%!*'!I%I-(#)!
!" Z':#%#5$!*'!2-%!.)4#-%!*'!%'6I(#*-*!
4.5. MÉTRICA versión 3 T-!,'&)*)2)6R-!"a`ZH3+!_'(%#5$!>!)O('.'!-!2-%!E(6-$#Q-.#)$'%!I$!#$%&(I,'$&)!0!4-(-!2-!%#%&'g,-&#Q-.#5$!*'!2-%!-.&#:#*-*'%!UI'!*-$!%)4)(&'!-2!.#.2)!*'!:#*-!*'2!software!*'$&()!*'2!,-(.)!UI'!4'(,#&'!-2.-$Q-(!2)%!%#6I#'$&'%!)1F'&#:)%[!
!" /()4)(.#)$-(!)!*'O#$#(!%#%&',-%!*'!#$O)(,-.#5$!UI'!-JI*'$!-!.)$%'6I#(!2)%!O#$'%!*'!2-!E(6-g$#Q-.#5$!,'*#-$&'!2-!*'O#$#.#5$!*'!I$!,-(.)!'%&(-&;6#.)!4-(-!'2!*'%-(()22)!*'!2)%!,#%,)%D!
!" \)&-(!-!2-!E(6-$#Q-.#5$!*'!4()*I.&)%!software!UI'!%-&#%O-6-$!2-%!$'.'%#*-*'%!*'!2)%!I%I-g(#)%!*-$*)!I$-!,-J)(!#,4)(&-$.#-!-2!-$82#%#%!*'!('UI#%#&)%D!
"-6'(#&!:'(%#5$!<! ! \'%-(()22)!*'!%#%&',-%!*'!#$O)(,-.#5$!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!NA!?*'!@ABC!
!" "'F)(-(!2-!4()*I.&#:#*-*!*'!2)%!*'4-(&-,'$&)%!*'!%#%&',-%!J!&'.$)2)6R-%!*'!2-!#$O)(,-.#5$!J!2-%! .),I$#.-.#)$'%W! 4'(,#&#'$*)!I$-!,-J)(! .-4-.#*-*!*'!-*-4&-.#5$! -! 2)%! .-,1#)%! J! &'g$#'$*)!'$!.I'$&-!2-!('I#Q-.#5$!'$!2-!,'*#*-!*'!2)!4)%#12'D!
!" e-.#2#&-(! 2-!.),I$#.-.#5$!J!'$&'$*#,#'$&)!'$&('! 2)%!*#%&#$&)%!4-(&#.#4-$&'%!'$! 2-!4()*I..#5$!*'!software!-!2)!2-(6)!*'2!.#.2)!*'!:#*-!*'2!4()J'.&)W!&'$#'$*)!'$!.I'$&-!%I!4-4'2!J!('%4)$g%-1#2#*-*W!-%R!.),)!2-%!$'.'%#*-*'%!*'!&)*)%!J!.-*-!I$)!*'!'22)%D!
!" e-.#2#&-(!2-!)4'(-.#5$W!,-$&'$#,#'$&)!J!I%)!*'!2)%!4()*I.&)%!software!)1&'$#*)%D!
3I-$*)!'2!*'%-(()22)!*'!2-!-42#.-.#5$!%'!-&'$6-!-!2-!,'&)*)2)6R-!"a`ZH3+!:'(%#5$!>W!2)%!-%4'.g&)%!-$&'(#)(,'$&'!&(-&-*)%!4-(-!-%'6I(-(!UI'! 2-!$I':-!-42#.-.#5$!$)!-2&'('! #$.)$&()2-*-,'$&'!'2!'%&-*)!*'!(#'%6)!*'!2-!E(6-$#Q-.#5$!*'1'(8$!&'$'(%'!'$!.I'$&-!-!2)!2-(6)!*'2!4().'%)!*'!*'%-(()g22)D!
"a`ZH3+!:'(%#5$!>!#*'$&#O#.-!>!4().'%)%W!A!%I14().'%)%!J!B!#$&'(O-.'%[!
!
gestión de
configuración
aseguramiento
de la calidad
gestión de
proyectos
seguridad
planificación
PSI
desarrollo
EVS ASI DSI CSI IAS
mantenimiento
MSI
planificación
PSI
desarrollo
EVS ASI DSI CSI IAS
desarrollo
EVS ASI DSI CSI IASEVS ASI DSI CSI IAS
mantenimiento
MSI!
PSI!b!/2-$#O#.-.#5$!*'2!%#%&',-!*'!#$O)(,-.#5$!
EVS!b!L%&I*#)!*'!:#-1#2#*-*!*'2!%#%&',-!
ASI!b!+$82#%#%!*'2!%#%&',-!*'!#$O)(,-.#5$!
DSI!b!\#%'c)!*'2!%#%&',-!*'!#$O)(,-.#5$D!
CSI!b!3)$%&(I..#5$!*'2!%#%&',-!*'!#$O)(,-.#5$!
IAS!b!H,42-$&-.#5$!J!-.'4&-.#5$!*'2!%#%&',-!
MSI!b!"-$&'$#,#'$&)!*'2!%#%&',-!*'!#$O)(,-.#5$!
T-! #$&'(O-Q!*'!%'6I(#*-*!4'(,#&'! 2-! .),I$#.-.#5$!'$&('! 2-%! &-('-%!*'!*'%-(()22)! J! 2-%! &-('-%!*'!-$82#%#%!J!6'%$!*'!(#'%6)%D!
!" T-!*#('..#5$!-4)(&-!2)%!%'(:#.#)%!$'.'%-(#)%!J!2-!.-2#*-*!*'!2-!%'6I(#*-*!*'%'-*-D!
!" L2!'UI#4)!*'!*'%-(()22)!-4)(&-!2)%!'2','$&)%!&;.$#.)%!UI'!,-&'(#-2#Q-$!2-!-42#.-.#5$D!
!" L2!'UI#4)!*'!-$82#%#%!*'!(#'%6)%!-4)(&-!I$!FI#.#)!.(R&#.)!%)1('!2-!%'6I(#*-*!*'2!%#%&',-D!
L%!*'.#(!UI'!%'!,-$'F-$!%#,I2&8$'-,'$&'!*#O'('$&'%!('UI#%#&)%[!
!" *'!%'(:#.#)W!4().'*'$&'%!*'!2-!*#('..#5$!
!" &;.$#.)%W!4().'*'$&'%!*'2!'UI#4)!*'!*'%-(()22)!
!" *'!%'6I(#*-*W!4().'*'$&'%!*'2!'UI#4)!*'!-$82#%#%!*'!(#'%6)%!
L%&)!*-!4#'!-!I$-! #$&'(('2-.#5$!.)$&#$I-!'$&('!'2! 'UI#4)!*'!*'%-(()22)! J!'2!'UI#4)!*'!%'6I(#*-*!UI'W!-!&(-:;%!*'!2-!#$&'(O-Q!*'!%'6I(#*-*W!:-$!.'((-$*)!.-*-!'&-4-!*'!";&(#.-D!L%!#,4)(&-$&'!*'%g&-.-(!UI'!'2!-2.-$.'!*'!I$!$#:'2!*'!%'6I(#*-*!4I'*'!('UI'(#(!,)*#O#.-.#)$'%!'$!2)%!.),4)$'$&'%!&;.$#.)%!*'2!%#%&',-h!-2!&#',4)!UI'!2)%!*'&-22'%!&;.$#.)%!4I'*'$!-2&'(-(!'2!-$82#%#%!*'!%'6I(#*-*D!
"-6'(#&!:'(%#5$!<! ! \'%-(()22)!*'!%#%&',-%!*'!#$O)(,-.#5$!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!NG!?*'!@ABC!
L$!.I-2UI#'(!.-%)W!'2!4I$&)!*'!-.I'(*)!'$&('!2)%!.),4)$'$&'%!?-.&#:)%C!J!'2!'%&-*)!*'!%'6I(#*-*!?#,4-.&)!J!(#'%6)C!*'1'!%'(!-4()1-*)!4)(!2-!*#('..#5$!*'!2-!E(6-$#Q-.#5$D!
3),)!%'! #$*#.-!,8%!-((#1-W!%'!4I'*'!*#%&#$6I#(!'$&('! 2-!%'6I(#*-*!*'2!4().'%)!*'!*'%-(()22)!?&-g('-%!]/\C!J!2-!%'6I(#*-*!*'2!%#%&',-!*'!#$O)(,-.#5$!?]]HCD!T-%!&-('-%!*'!2-!#$&'(O-Q!%'!)(6-$#Q-$!%'60$!%I!4'(&'$'$.#-!-!I$)!I!)&()!)1F'&#:)!*'!%'6I(#*-*D!
4.5.1. SPD – Seguridad del proceso de desarrollo
T)!UI'!%'!.),'$&-!'$!'%&-!%'..#5$!-O'.&-!-!&)*-%!J!.-*-!I$)!*'!2)%!4().'%)%!J!%I14().'%)%!*'!";&(#.-[!/]HW!L_]W!+]HW!\]HW!3]HW!H+]!J!"]HD!
T-!#$&'(O-Q!*'!%'6I(#*-*!*'!";&(#.-!#*'$&#O#.-!V-%&-!B!&-('-%!UI'!%'!('4#&'$!'$!.-*-!4().'%)D!+UIR!%'!&(-&-$!*'!O)(,-!.),4-.&-[!
!
Tareas afectadas en la Interfaz de Seguridad de Métrica v3
PSI: Planificación del sistema de información ]L^!@[!/2-$#O#.-.#5$!*'!2-!%'6I(#*-*!('UI'(#*-!'$!'2!4().'%)!/]H!/]Hg]L^!@D@[!L%&I*#)!*'!2-!%'6I(#*-*!('UI'(#*-!'$!'2!4().'%)!/]H!/]Hg]L^!@D<[!E(6-$#Q-.#5$!J!42-$#O#.-.#5$!
]L^!B[!3-&-2)6-.#5$!*'!2)%!4()*I.&)%!6'$'(-*)%!*I(-$&'!'2!4().'%)!/]H!/]Hg]L^!BD@[!32-%#O#.-.#5$!J!!.-&-2)6-.#5$!*'!2)%!4()*I.&)%!6'$'(-*)%!*I(-$&'!'2!4().'%)!/]H!
EVS: Estudio de viabilidad del sistema ]L^!@[!L%&I*#)!*'!2-!%'6I(#*-*!('UI'(#*-!'$!'2!4().'%)!L_]!L_]g]L^!@D@[!L%&I*#)!*'!2-!%'6I(#*-*!('UI'(#*-!'$!'2!4().'%)!L_]!
]L^!<[!]'2'..#5$!*'2!'UI#4)!*'!%'6I(#*-*!L_]g]L^!<D@[!]'2'..#5$!*'2!'UI#4)!*'!%'6I(#*-*!
]L^!G[!3-&-2)6-.#5$!*'!2)%!4()*I.&)%!6'$'(-*)%!*I(-$&'!'2!4().'%)!L_]!L_]g]L^!GD@[!32-%#O#.-.#5$!J!.-&-2)6-.#5$!*'!2)%!4()*I.&)%!6'$'(-*)%!*I(-$&'!'2!4().'%)!L_]!
ASI: Análisis del sistema de información ]L^!@[!L%&I*#)!*'!2-!%'6I(#*-*!('UI'(#*-!'$!'2!4().'%)!+]H!+]Hg]L^!@D@[!L%&I*#)!*'!2-!%'6I(#*-*!('UI'(#*-!'$!'2!4().'%)!+]H!
]L^!B[!3-&-2)6-.#5$!*'!2)%!4()*I.&)%!6'$'(-*)%!*I(-$&'!'2!4().'%)!+]H!+]Hg]L^!BD@[!32-%#O#.-.#5$!J!.-&-2)6-.#5$!*'!2)%!4()*I.&)%!6'$'(-*)%!*I(-$&'!'2!4().'%)!+]H!
DSI: Diseño del sistema de información ]L^!@[!L%&I*#)!*'!2-!%'6I(#*-*!('UI'(#*-!'$!'2!4().'%)!\]H!\]Hg]L^!@D@[!L%&I*#)!*'!2-!%'6I(#*-*!('UI'(#*-!'$!'2!4().'%)!\]H!
]L^!A[!3-&-2)6-.#5$!*'!2)%!4()*I.&)%!6'$'(-*)%!*I(-$&'!'2!4().'%)!\]H!\]Hg]L^!AD@[!32-%#O#.-.#5$!J!.-&-2)6-.#5$!*'!2)%!4()*I.&)%!6'$'(-*)%!*I(-$&'!'2!4().'%)!\]H!
CSI: Construcción del sistema de información ]L^!@[!L%&I*#)!*'!2-!%'6I(#*-*!('UI'(#*-!'$!'2!4().'%)!3]H!3]Hg]L^!@D@[!L%&I*#)!*'!2-!%'6I(#*-*!('UI'(#*-!'$!'2!4().'%)!3]H!
]L^!B[!32-%#O#.-.#5$!*'!2)%!4()*I.&)%!6'$'(-*)%!*I(-$&'!'2!4().'%)!3]H!3]Hg]L^!BD@[!32-%#O#.-.#5$!J!.-&-2)6-.#5$!*'!2)%!4()*I.&)%!6'$'(-*)%!*I(-$&'!'2!4().'%)!3]H!
"-6'(#&!:'(%#5$!<! ! \'%-(()22)!*'!%#%&',-%!*'!#$O)(,-.#5$!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!NK!?*'!@ABC!
Tareas afectadas en la Interfaz de Seguridad de Métrica v3
IAS: Implantación y aceptación del sistema ]L^!@[!L%&I*#)!*'!2-!%'6I(#*-*!('UI'(#*-!'$!'2!4().'%)!H+]!H+]g]L^!@D@[!L%&I*#)!*'!2-!%'6I(#*-*!('UI'(#*-!'$!'2!4().'%)!H+]!
]L^!B[!3-&-2)6-.#5$!*'!2)%!4()*I.&)%!6'$'(-*)%!*I(-$&'!'2!4().'%)!H+]!H+]g]L^!BD@[!32-%#O#.-.#5$!J!.-&-2)6-.#5$!*'!2)%!4()*I.&)%!6'$'(-*)%!*I(-$&'!'2!4().'%)!H+]!
MSI: Mantenimiento del sistema de información ]L^!@[!L%&I*#)!*'!2-!%'6I(#*-*!('UI'(#*-!'$!'2!4().'%)!"]H!"]Hg]L^!@D@[!L%&I*#)!*'!2-!%'6I(#*-*!('UI'(#*-!'$!'2!4().'%)!"]H!
]L^!>[!3-&-2)6-.#5$!*'!2)%!4()*I.&)%!6'$'(-*)%!*I(-$&'!'%&-!'&-4-!"]Hg]L^!>D@[!32-%#O#.-.#5$!J!.-&-2)6-.#5$!*'!2)%!4()*I.&)%!6'$'(-*)%!*I(-$&'!'%&-!'&-4-!
!
Activos a considerar
L$!.-*-!4().'%)!%'!('UI#'('!I$!-$82#%#%!*'!(#'%6)%!'%4'.RO#.)!UI'!.)$&',42'[!
!" 2)%!*-&)%!UI'!%'!,-$'F-$[!!
!" '%4'.#O#.-.#)$'%!J!*).I,'$&-.#5$!*'!2)%!%#%&',-%!
!" .5*#6)!OI'$&'!
!" ,-$I-2'%!*'2!)4'(-*)(!J!*'2!I%I-(#)!
!" *-&)%!*'!4(I'1-!
!" '2!'$&)($)!software!*'!*'%-(()22)[!!
!" V'((-,#'$&-%!*'!&(-&-,#'$&)!*'!2-!*).I,'$&-.#5$[!6'$'(-.#5$W!4I12#.-.#5$W!.)$&()2!*'!*)g.I,'$&-.#5$W!'&.D!
!" V'((-,#'$&-%! *'! &(-&-,#'$&)! *'2! .5*#6)[! 6'$'(-.#5$W! .),4#2-.#5$W! .)$&()2! *'! :'(%#)$'%W!'&.D!
!" '2!'$&)($)!hardware!*'!*'%-(()22)[!'UI#4)%!.'$&(-2'%W!4I'%&)%!*'!&(-1-F)W!'UI#4)%!*'!-(.V#g:)W!'&.D!
!" '2!'$&)($)!*'!.),I$#.-.#)$'%!*'!*'%-(()22)!
!" 2-%!#$%&-2-.#)$'%!
!" '2!4'(%)$-2!#$:)2I.(-*)[!*'%-(()22-*)('%W!4'(%)$-2!*'!,-$&'$#,#'$&)!J!I%I-(#)%!?*'!4(I'1-%C!
Actividades
]'!%#6I'$!2)%!%#6I#'$&'%!4-%)%!
@D! '2!'UI#4)!*'!*'%-(()22)!'M4)$'!-!&(-:;%!*'2!F'O'!*'!4()J'.&)!2)%!'2','$&)%!#$:)2I.(-*)%!
<D! '2!'UI#4)!*'!-$82#%#%!*'!(#'%6)%!('.#1'!-!&(-:;%!*'2!*#('.&)(!*'!%'6I(#*-*!2-!#$O)(,-.#5$!*'!2)%!-.&#:)%!#$:)2I.(-*)%!
>D! '2!'UI#4)!*'!-$82#%#%!*'!(#'%6)%!('-2#Q-!'2!-$82#%#%!
BD! '2!'UI#4)!*'!-$82#%#%!*'!(#'%6)%!'M4)$'!-!&(-:;%!*'!%I!*#('.&)(!'2!'%&-*)!*'!(#'%6)W!4()4)g$#'$*)!I$-!%'(#'!*'!,'*#*-%!-!&),-(!
AD! '2!'UI#4)!*'!*'%-(()22)!'2-1)(-!I$!#$O)(,'!*'2!.)%&'!UI'!%I4)$*(R-$!2-%!,'*#*-%!('.),'$g*-*-%W!#$.2IJ'$*)!.)%&'%!*'!*'%-(()22)!J!*'%:#-.#)$'%!'$!2)%!42-Q)%!*'!'$&('6-!
GD! 2-! *#('..#5$! .-2#O#.-! '2! (#'%6)! J! *'.#*'! 2-%! %-2:-6I-(*-%! -! #,42-$&-(! )J'$*)! '2! #$O)(,'!.)$FI$&)!*'!-$82#%#%!*'!(#'%6)%!J!.)%&'!*'!2-%!%)2I.#)$'%!4()4I'%&-%!
"-6'(#&!:'(%#5$!<! ! \'%-(()22)!*'!%#%&',-%!*'!#$O)(,-.#5$!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!NN!?*'!@ABC!
KD! '2! 'UI#4)! *'! -$82#%#%! *'! (#'%6)%! '2-1)(-! 2)%! #$O)(,'%! .)(('%4)$*#'$&'%! -! 2-%! %)2I.#)$'%!-*)4&-*-%!
ND! '2!'UI#4)!*'!%'6I(#*-*!'2-1)(-!2-!$)(,-&#:-!*'!%'6I(#*-*!4'(&#$'$&'!
PD! 2-!*#('..#5$!-4(I'1-!'2!42-$!4-(-!'F'.I&-(!'2!4().'%)!.)$!2-!%'6I(#*-*!('UI'(#*-!
Resultados del análisis y gestión de riesgos
L$!&)*)%!2)%!.-%)%!
!" %-2:-6I-(*-%!('.),'$*-*-%!
!" $)(,-%!J!4().'*#,#'$&)%!*'!&(-&-,#'$&)!*'!2-!#$O)(,-.#5$!
Otras consideraciones
+I$UI'!.-*-!4().'%)!('UI#'('!%I!-$82#%#%!*'!(#'%6)%!'%4'.RO#.)W!'%!.#'(&)!UI'!%'!&(-&-!*'!,)*'2)%!&(','$*-,'$&'!%#,#2-('%!4)(! 2)!UI'!'2!,-J)(!'%OI'(Q)!2)! 22':-(8!'2!4(#,'()!UI'!%'!V-6-W!%#'$*)!2)%!*',8%!-*-4&-.#)$'%!*'!-UI'2!4(#,'()D!
L$!2)%!4(#,'()%!4().'%)%W!$)&-12','$&'!'$!/]HW!4I'*'$!-4-('.'(!.)$&(#1I.#)$'%!*'!-2&)!$#:'2!UI'!-O'.&'$!-!2-!$)(,-&#:-!*'!%'6I(#*-*!*'!2-!E(6-$#Q-.#5$!'!#$.2I%)!-!2-!4()4#-!4)2R&#.-!*'!%'6I(#*-*!.)(4)(-&#:-D!
L$&('! 2-%!$)(,-%!J!4().'*#,#'$&)%!6'$'(-*)%!'%!*'!*'%&-.-(! 2-!$'.'%#*-*!*'!I$-!$)(,-&#:-!*'!.2-%#O#.-.#5$!*'!2-!*).I,'$&-.#5$!J!4().'*#,#'$&)%!4-(-!%I!&(-&-,#'$&)D!
L$!&)*)%!2)%!4().'%)%!V-J!UI'!4('%&-(!I$-!'%4'.#-2!-&'$.#5$!-2!4'(%)$-2!#$:)2I.(-*)D!3),)!('62-%!18%#.-%!.)$:#'$'[!
!" #*'$&#O#.-(!2)%!()2'%!J!2-%!4'(%)$-%!
!" *'&'(,#$-(!2)%!('UI#%#&)%!*'!%'6I(#*-*!*'!.-*-!4I'%&)!'!#$.)(4)(-(2)%!-!2)%!.(#&'(#)%!*'!%'g2'..#5$!J!.)$*#.#)$'%!*'!.)$&(-&-.#5$!
!" 2#,#&-(!'2!-..'%)!-!2-!#$O)(,-.#5$[!%52)!4)(!$'.'%#*-*!
!" %'6('6-(!&-('-%h!'$!4-(&#.I2-(!':#&-(!2-!.)$.'$&(-.#5$!'$!I$-!%)2-!4'(%)$-!*'!-UI'22-%!-42#g.-.#)$'%!)!4-(&'%!*'!I$-!-42#.-.#5$!UI'!%)4)(&'$!I$!-2&)!(#'%6)!
4.5.2. SSI – Seguridad del sistema de información
`)*)!2-!'M#%&'$.#-!*'!I$!%#%&',-!*'!#$O)(,-.#5$!4I'*'!:'(%'!.),)!'&-4-%!*'!.)$.('.#5$!.('.#'$g&'W!*'%*'!I$-!4'(%4'.&#:-!,IJ!62)1-2!*I(-$&'! 2)%!4().'%)%!*'!42-$#O#.-.#5$!V-%&-!I$-!:#%#5$!'$!*'&-22'!*I(-$&'!'2!*'%-(()22)!J!'M42)&-.#5$D!7)!)1%&-$&'W!'%&'!.#.2)!*'!:#*-!$)!'%!2#$'-2W!%#$)!UI'!O('.I'$&','$&'!V-1(8!UI'!&-$&'-(!)4.#)$'%!-2&'($-&#:-%!J!(':#%-(!*'.#%#)$'%!&),-*-%D!
L2!-$82#%#%!*'!(#'%6)%!*'1'!1-%-(!%I%!'%&#,-.#)$'%!*'!#,4-.&)!J!(#'%6)!'$!2-!('-2#*-*!*'!2)%!%#%g&',-%W!.)$.('&-*-!'$!%I%!-.&#:)%D!L$!.)$%'.I'$.#-W!%'!4I'*'!'$&'$*'(!'2!,)*'2)!*'!:-2)(!.),)!':)2I&#:)W!('.)6#'$*)!'$!.-*-!,),'$&)!'2!$#:'2!*'!*'&-22'!*'!UI'!%'!*#%4)$'D!"-6'(#&W!.),)!,'g&)*)2)6R-W!4'(,#&'!I$!&(-&-,#'$&)!%#%&',8&#.)!J!V),)6;$')!UI'!'%!'%'$.#-2!4-(-!4)*'(!.),4-(-(!)4.#)$'%!-2&'($-&#:-%!J!4-(-!6'%&#)$-(!2-!':)2I.#5$!*'!2)%!%#%&',-%D!
T-!I#Q-.#5$!*'!V'((-,#'$&-%!*'!%)4)(&'!*'1'!4'(,#&#(!!
@D! .-4&I(-(!I$!,)*'2)!#$#.#-2!?/]HCW!!
<D! '%&I*#-(!:-(#-.#)$'%!?L_]!J!+]HCW!!
>D! 4-%-(!*'! 2)!6'$'(-2!-! 2)!.)$.('&)W!4(':#$#'$*)!-,'$-Q-%!4)&'$.#-2'%!J!4('4-(-$*)!,'.-g$#%,)%!*'!*'&'..#5$!J!('-..#5$!?\]H!J!3]HC!
BD! *#(#6#(!%I!-.'4&-.#5$!J!'M42)&-.#5$!?H+]C!
AD! (':#%-(!4'(#5*#.-,'$&'!2)%!.-,1#)%!UI'!%'!4()4)$6-$!?"]HC!
"-6'(#&!:'(%#5$!<! ! \'%-(()22)!*'!%#%&',-%!*'!#$O)(,-.#5$!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!NP!?*'!@ABC!
Uso de las tareas de la metodología Magerit
Proceso P1: Planificación
Actividad A1.1: L%&I*#)!*'!)4)(&I$#*-*!
Tarea T1.1.1: \'&'(,#$-(!2-!)4)(&I$#*-*!
L%&-!&-('-!%'!('*I.'!-!2-!*'.#%#5$W!#$&'($-W!*'!*'%-(()22-(!'2!%#%&',-!*'!#$O)(,-.#5$!&'g$#'$*)!'$!.I'$&-!2-!%'6I(#*-*D!
Actividad A1.2: \'&'(,#$-.#5$!*'2!-2.-$.'!*'2!4()J'.&)!
Tarea T1.2.1: E1F'&#:)%!J!('%&(#..#)$'%!6'$'(-2'%!
T)%!*'2!%#%&',-!*'!#$O)(,-.#5$!1-F)!*'%-(()22)D!
Tarea T1.2.2: \'&'(,#$-.#5$!*'!*),#$#)!J!2R,#&'%!
T)%!*'2!%#%&',-!*'!#$O)(,-.#5$!1-F)!*'%-(()22)D!
Tarea T1.2.3: H*'$&#O#.-.#5$!*'2!'$&)($)!
T)%!*'2!%#%&',-!*'!#$O)(,-.#5$!1-F)!*'%-(()22)D!
Tarea T1.2.4: L%&#,-.#5$!*'!*#,'$%#)$'%!J!.)%&'!
/-(&'!*'!4()J'.&)!?)!4()J'.&)%C!*'!*'%-(()22)!*'2!%#%&',-!*'!#$O)(,-.#5$D!
Actividad A1.3: /2-$#O#.-.#5$!*'2!4()J'.&)!
Tarea T1.3.1: L:-2I-(!.-(6-%!J!42-$#O#.-(!'$&(':#%&-%!
L%&-!&-('-!%'!22':-!-!.-1)!.),)!'$!.I-2UI#'(!4()J'.&)!+^ZD!L%&-!&-('-!%'!*'1'!('-2#gQ-(!.)$!'2!4(#,'(!4().'%)W!/]HW!UI'*-$*)!'%&-12'.#*-!2-!('2-.#5$!*'!'$&(':#%&-%!4-(-!'2!('%&)!*'!2)%!4().'%)%W!%-2:)!-FI%&'%!4I$&I-2'%!UI'!%'!*'&'.&'$!$'.'%-(#)%D!
Tarea T1.3.2: E(6-$#Q-(!-!2)%!4-(&#.#4-$&'%!
L%&-!&-('-!%'!22':-!-!.-1)!.),)!'$!.I-2UI#'(!4()J'.&)!+^ZD!\I(-$&'!'2!4(#,'(!4().'g%)W!/]HW!*'1'!'%&-12'.'(%'!2-!('2-.#5$!*'!4-(&#.#4-$&'%!-!'$&(':#%&-(W!%#$!4('.#%-(!,8%!-228!'2!4-4'2!UI'!*'%',4'c-$D!]'60$!:-J-!-:-$Q-$*)!'2!*'%-(()22)!*'2!%#%&',-W!%'!#(8!#*'$&#O#.-$*)!-!2-%!4'(%)$-%!UI'!%-&#%O-.'$!2)%!()2'%!4(':#%&)%D!
Tarea T1.3.3: /2-$#O#.-(!'2!&(-1-F)!
/-(&'!*'!4()J'.&)!?)!4()J'.&)%C!*'!*'%-(()22)!*'2!%#%&',-!*'!#$O)(,-.#5$D!
Actividad A1.4: T-$Q-,#'$&)!*'2!4()J'.&)!
Tarea T1.4.1: +*-4&-(!2)%!.I'%&#)$-(#)%!
L%&-!&-('-!%'!22':-!-!.-1)!.),)!'$!.I-2UI#'(!4()J'.&)!+^ZD!L%&-!&-('-!%'!*'1'!('-2#gQ-(!.)$!'2!4(#,'(!4().'%)W!/]HW!UI'*-$*)!'%&-12'.#*)%!4-(-!'2!('%&)!*'!2)%!4().'%)%W!%-2:)!-FI%&'%!4I$&I-2'%D!
Tarea T1.4.2: 3(#&'(#)%!*'!':-2I-.#5$!
L%&-!&-('-!%'!22':-!-!.-1)!.),)!'$!.I-2UI#'(!4()J'.&)!+^ZD!L%&-!&-('-!%'!*'1'!('-2#gQ-(!.)$!'2!4(#,'(!4().'%)W!/]HW!UI'*-$*)!'%&-12'.#*)%!4-(-!'2!('%&)!*'!2)%!4().'%)%D!
Tarea T1.4.3: Z'.I(%)%!$'.'%-(#)%!
/-(&'!*'!4()J'.&)!?)!4()J'.&)%C!*'!*'%-(()22)!*'2!%#%&',-!*'!#$O)(,-.#5$D!
Tarea T1.4.4: ]'$%#1#2#Q-.#5$!
/-(&'!*'!4()J'.&)!?)!4()J'.&)%C!*'!*'%-(()22)!*'2!%#%&',-!*'!#$O)(,-.#5$D!
Proceso P2: Análisis de riesgos
Actividad A2.1: 3-(-.&'(#Q-.#5$!*'!2)%!-.&#:)%!
Tarea T2.1.1: H*'$&#O#.-.#5$!*'!2)%!-.&#:)%!
"-6'(#&!:'(%#5$!<! ! \'%-(()22)!*'!%#%&',-%!*'!#$O)(,-.#5$!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!PS!?*'!@ABC!
L$!2)%!4(#,'()%!4().'%)%W!/]HW!%'!#*'$&#O#.-$!-.&#:)%!6'$;(#.)%D!]'60$!%'!-:-$Q-!'$!'2!*'%-(()22)W!'%&-!#*'$&#O#.-.#5$!%'!:-!4('.#%-$*)!*'!O)(,-!UI'!2)%!-.&#:)%!6'$;(#.)%!%'!&(-*I.'$! '$! -.&#:)%! .)$.('&)%D! T-! .)$.('.#5$! *'1'! %'(!,8M#,-! -2! 22'6-(! -2! 4().'%)!3]HD!
Tarea T2.1.2: \'4'$*'$.#-%!'$&('!-.&#:)%!
L$!2)%!4(#,'()%!4().'%)%W!/]HW!-4-('.'$!('2-.#)$'%!*'!&(-Q)!6(I'%)D!]'60$!%'!-:-$Q-!'$!'2!*'%-(()22)W! 2-%!*'4'$*'$.#-%!%'!:-$!4('.#%-$*)!%'60$!2)%!-.&#:)%!6'$;(#.)%!%'!&(-*I.'$! '$! -.&#:)%! .)$.('&)%D! T-! .)$.('.#5$! *'1'! %'(!,8M#,-! -2! 22'6-(! -2! 4().'%)!3]HD!
Tarea T2.1.3: _-2)(-.#5$!*'!2)%!-.&#:)%!
T-!:-2)(-.#5$!*'!2)%!%'(:#.#)%!02&#,)%!J!*'!2)%!*-&)%!'%'$.#-2'%!%'!4I'*'!('-2#Q-(!4(8.g&#.-,'$&'! *'%*'! '2! 4(#,'(! 4().'%)! /]HW! %#! 1#'$! %'60$! -:-$.'! '2! *'%-(()22)! 4I'*'$!%'6,'$&-(%'!2)%!%'(:#.#)%!Jd)!2)%!*-&)%W!('UI#(#'$*)!I$-!:-2)(-.#5$!%#$6I2-(!UI'!$I$.-!*'1'(8!%I4)$'(!2-!%I4'(-.#5$!*'!2-!:-2)(-.#5$!*'!2)%!%'(:#.#)%!)!*-&)%!-6('6-*)%D!L%!*'.#(W!4I'*'$!*'%-6('6-(%'!2)%!%'(:#.#)%!Jd)!2)%!*-&)%!'$!O(-..#)$'%!*'!,'$)(!:-2)(D!
`R4#.-,'$&'!2-!:-2)(-.#5$!*'2!('%&)!*'!2)%!-.&#:)%!4I'*'!-$-2#Q-(%'!.),)!%#,42'!:-2)(!-.I,I2-*)!*'%*'!2)%!-.&#:)%!%I4'(#)('%W!'M42)&-$*)!2-%!('2-.#)$'%!*'!*'4'$*'$.#-D!
Actividad A2.2: 3-(-.&'(#Q-.#5$!*'!2-%!-,'$-Q-%!
Tarea T2.2.1: H*'$&#O#.-.#5$!*'!2-%!-,'$-Q-%!
T-%!-,'$-Q-%!%)1('!-.&#:)%!6'$;(#.)%!4I'*'$!#$.)(4)(-(%'!*'%*'!'2!4(#,'(!4().'%)!/]Hh!4'()!%'60$!%'!:-J-!.)$.('&-$*)!'2!.)$FI$&)!*'&-22-*)!*'!.),4)$'$&'%!V-1(8!UI'!#$.)(4)(-(!-,'$-Q-%!'%4'.RO#.-%!*'!2-!&'.$)2)6R-!UI'!%'!',42'-D!
Tarea T2.2.2: _-2)(-.#5$!*'!2-%!-,'$-Q-%!
L%&-!&-('-!%'!22':-!-!.-1)!.),)!'$!.I-2UI#'(!4()J'.&)!+^ZD!!
Actividad A2.3: 3-(-.&'(#Q-.#5$!*'!2-%!%-2:-6I-(*-%!
Tarea T2.3.1: H*'$&#O#.-.#5$!*'!2-%!%-2:-6I-(*-%!'M#%&'$&'%!
fI'$-!4-(&'!*'!2-%!%-2:-6I-(*-%!4I'*'$!#$.)(4)(-(%'!*'%*'!'2!4(#,'(!4().'%)!/]HD!
7)!)1%&-$&'W!2-%!%-2:-6I-(*-%!*'!.-(8.&'(!&;.$#.)W!*'1'(8$!#(%'!4('.#%-$*)!%'60$!%'!:-J-! .)$.('&-$*)!'2! .)$FI$&)!*'&-22-*)!*'! .),4)$'$&'%! J! 2-! &'.$)2)6R-!UI'!%'!',g42'-D!
Tarea T2.3.2: _-2)(-.#5$!*'!2-%!%-2:-6I-(*-%!'M#%&'$&'%!
L%&-!&-('-!%'!22':-!-!.-1)!.),)!'$!.I-2UI#'(!4()J'.&)!+^ZD!!
Actividad A2.4: L%&#,-.#5$!*'2!'%&-*)!*'!(#'%6)!
Tarea T2.4.1: L%&#,-.#5$!*'2!#,4-.&)!
L%&-!&-('-!%'!22':-!-!.-1)!.),)!'$!.I-2UI#'(!4()J'.&)!+^ZD!!
Tarea T2.4.2: L%&#,-.#5$!*'2!(#'%6)!
L%&-!&-('-!%'!22':-!-!.-1)!.),)!'$!.I-2UI#'(!4()J'.&)!+^ZD!!
Tarea T2.4.3: H$&'(4('&-.#5$!*'!2)%!('%I2&-*)%!
L%&-!&-('-!%'!22':-!-!.-1)!.),)!'$!.I-2UI#'(!4()J'.&)!+^ZD!!
Proceso P3: Gestión de riesgos
Actividad A3.1: `),-!*'!*'.#%#)$'%!
Tarea T3.1.1: 3-2#O#.-.#5$!*'!2)%!(#'%6)%!
L%&-!&-('-!%'!22':-!-!.-1)!.),)!'$!.I-2UI#'(!4()J'.&)!+^ZD!!
"-6'(#&!:'(%#5$!<! ! \'%-(()22)!*'!%#%&',-%!*'!#$O)(,-.#5$!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!P@!?*'!@ABC!
L$!2-!&),-!*'!*'.#%#)$'%!*'1'!4-(&#.#4-(!&-$&)!'2!'UI#4)!*'!*'%-(()22)!.),)!'2!'UI#4)!*'!-$82#%#%!*'!(#'%6)%D!
Actividad A3.2: L2-1)(-.#5$!*'2!42-$!*#('.&)(!*'!%'6I(#*-*!*'!2-!#$O)(,-.#5$!
Tarea T3.2.1: /()6(-,-%!*'!%'6I(#*-*!
L%&-!&-('-!UI'*-!%I1%I,#*-!'$!2-%!&-('-%!*'!*'%-(()22)D!
Tarea T3.2.2: /2-$!*'!'F'.I.#5$!
L%&-!&-('-!UI'*-!%I1%I,#*-!'$!2-%!&-('-%!*'!*'%-(()22)D!
Actividad A3.3: LF'.I.#5$!*'2!42-$!
Tarea T3.3.*: LF'.I.#5$!*'!.-*-!4()6(-,-!*'!%'6I(#*-*!
L%&-%!&-('-%!UI'*-$!%I1%I,#*-%!'$!2-%!&-('-%!*'!*'%-(()22)D!
Otras consideraciones
L%!#,4)(&-$&'!22':-(!-!.-1)!2)%!*#O'('$&'%!-$82#%#%!*'!(#'%6)%!*'!I$-!O)(,-!':)2I&#:-W!#$.)(4)(-$*)!,-J)(!*'&-22'!%'60$!-:-$Q-!'2!*'%-(()22)h!4'()!$I$.-!:)2:#'$*)!-!.),'$Q-(!*'%*'!.'()D!
L$!2)%!4(#,'()%!4().'%)%W!$)&-12','$&'!'$!/]HW!4I'*'$!-4-('.'(!.)$&(#1I.#)$'%!*'!-2&)!$#:'2!UI'!-O'.&'$!-!2-!$)(,-&#:-!*'!%'6I(#*-*!*'!2-!E(6-$#Q-.#5$!'!#$.2I%)!-!2-!4()4#-!4)2R&#.-!*'!%'6I(#*-*!.)(4)(-&#:-D!
T-%!$)(,-%!J!4().'*#,#'$&)%!UI'!%'!*'(#:-$!'$!.-*-!4().'%)!:-$!.)$%&#&IJ'$*)!'2!.)$FI$&)!*'!$)(,-%!J!4().'*#,#'$&)%!UI'!%'!',42'-(8$!*I(-$&'!2-!'M42)&-.#5$!*'2!%#%&',-D!!
!" `R4#.-,'$&'! 2-!$)(,-&#:-!*'1'!.'((-(%'!'$! 2)%!4(#,'()%!4().'%)%[!/]HW!L_]!J!+]HW!%#'$*)!#$O('.I'$&'!%I!,)*#O#.-.#5$!'$!2)%!4().'%)%!%#6I#'$&'%D!!
!" /)(!'2!.)$&(-(#)W! 2)%!4().'*#,#'$&)%!$)!%'!4I'*'$!*'(#:-(!V-%&-!.)$.('&-(!'2!*'&-22'!'$! 2)%!4().'%)%!\]HW!3]H!'!H+]D!7)!*'1'(R-$!,)*#O#.-(%'W!%-2:)!-FI%&'%!J!.)(('..#)$'%W!'$!2)%!4()g.'%)%!%#6I#'$&'%D!
!" L2!4().'%)!H+]!4-%-!$)(,-%!J!4().'*#,#'$&)%!-!'M42)&-.#5$D!
!" L2!4().'%)!"]H!4I'*'!%I4)$'(!2-!('4-(-.#5$!*'!$)(,-%!)!4().'*#,#'$&)%!'((5$')%W!)!2-!'Mg&'$%#5$!*'!$)(,-%!)!4().'*#,#'$&)%! #$.),42'&)%!UI'!$)!V-J-$!.)$&',42-*)!&)*-%! 2-%!.#(g.I$%&-$.#-%!4(8.&#.-%D!
T-!'%4'.#O#.-.#5$!*'!%-2:-6I-(*-%!*'1'!#$.)(4)(-(!&-$&)!2)%!,'.-$#%,)%!*'!-.&I-.#5$!.),)!2)%!,'.-$#%,)%!*'! .)$O#6I(-.#5$W!,)$#&)(#Q-.#5$! J! .)$&()2! *'! %I! 'O#.-.#-! J! 'O#.#'$.#-D!L%! O('.I'$&'!UI'!-4-('Q.-$!-26I$)%!*'%-(()22)%!'%4'.RO#.-,'$&'!*'%&#$-*)%!-!.)$O#6I(-(!'2!.)$FI$&)!*'!%-2:-g6I-(*-%!J!-!,)$#&)(#Q-(!%I!)4'(-.#5$D!
!
Tareas afectadas en la Interfaz de Seguridad de Métrica v3
PSI: Planificación del sistema de información ]L^!<[!L:-2I-.#5$!*'2!(#'%6)!4-(-!2-!-(UI#&'.&I(-!&'.$)256#.-!/]Hg]L^!<D@[!L%&I*#)!J!':-2I-.#5$!*'2!(#'%6)!*'!2-%!-2&'($-&#:-%!*'!-(UI#&'.&I(-!&'.$)256#.-/]Hg]L^!<D<[!Z':#%#5$!*'!2-!':-2I-.#5$!*'2!(#'%6)!*'!2-%!-2&'($-&#:-%!*'!-(UI#&'.&I(-!&'.$)g256#.-!
]L^!>[!\'&'(,#$-.#5$!*'!2-!%'6I(#*-*!'$!'2!42-$!*'!-..#5$!/]Hg]L^!>D@[!\'&'(,#$-.#5$!*'!2-!%'6I(#*-*!'$!'2!42-$!*'!-..#5$!
"-6'(#&!:'(%#5$!<! ! \'%-(()22)!*'!%#%&',-%!*'!#$O)(,-.#5$!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!P<!?*'!@ABC!
Tareas afectadas en la Interfaz de Seguridad de Métrica v3
EVS: Estudio de viabilidad del sistema ]L^!>[!Z'.),'$*-.#)$'%!-*#.#)$-2'%!*'!%'6I(#*-*!4-(-!'2!]H!L_]g]L^!>D@[!L2-1)(-.#5$!*'!('.),'$*-.#)$'%!*'!%'6I(#*-*!
]L^!B[!L:-2I-.#5$!*'!2-!%'6I(#*-*!*'!2-%!-2&'($-&#:-%!*'!%)2I.#5$!L_]g]L^!BD@[!!_-2)(-.#5$!J!':-2I-.#5$!*'!2-!%'6I(#*-*!*'!2-%!-2&'($-&#:-%!*'!%)2I.#5$!
]L^!A[!L:-2I-.#5$!*'&-22-*-!*'!2-!%'6I(#*-*!*'!2-!%)2I.#5$!4()4I'%&-!L_]g]L^!AD@[!\'%.(#4.#5$!*'&-22-*-!*'!2-!%'6I(#*-*!*'!2-!%)2I.#5$!4()4I'%&-!
ASI: Análisis del sistema de información ]L^!<[!\'%.(#4.#5$!*'!2-%!OI$.#)$'%!J!,'.-$#%,)%!*'!%'6I(#*-*!+]Hg]L^!<D@[!L%&I*#)!!*'!2-%!OI$.#)$'%!J!,'.-$#%,)%!*'!%'6I(#*-*!-!#,42-$&-(!
]L^!>[!\'O#$#.#5$!*'!2)%!.(#&'(#)%!*'!-.'4&-.#5$!*'!2-!%'6I(#*-*!+]Hg]L^!>D@[!+.&I-2#Q-.#5$!*'2!42-$!*'!4(I'1-%!
DSI: Diseño del sistema de información ]L^!<[!L%4'.#O#.-.#5$!*'!('UI#%#&)%!*'!%'6I(#*-*!*'2!'$&)($)!&'.$)256#.)!\]Hg]L^!<D@[!+$82#%#%!*'!2)%!(#'%6)%!*'2!'$&)($)!&'.$)256#.)!
]L^!>[!Z'UI#%#&)%!*'!%'6I(#*-*!*'2!'$&)($)!*'!.)$%&(I..#5$!\]Hg]L^!>D@[!H*'$&#O#.-.#5$!*'!2)%!('UI#%#&)%!*'!%'6I(#*-*!*'2!'$&)($)!*'!.)$%&(I..#5$!
]L^!B[!\#%'c)!*'!4(I'1-%!*'!%'6I(#*-*!\]Hg]L^!BD@[!\#%'c)!*'!2-%!4(I'1-%!*'!%'6I(#*-*!
CSI: Construcción del sistema de información ]L^!<[!L:-2I-.#5$!*'!2)%!('%I2&-*)%!*'!4(I'1-%!*'!%'6I(#*-*!3]Hg]L^!<D@[!L:-2I-.#5$!*'!2)%!('%I2&-*)%!*'!4(I'1-%!*'!%'6I(#*-*!
]L^!>[!L2-1)(-.#5$!*'2!42-$!*'!O)(,-.#5$!*'!%'6I(#*-*!3]Hg]L^!>D@[!L2-1)(-.#5$!*'2!42-$!*'!O)(,-.#5$!*'!%'6I(#*-*!
IAS: Implantación y aceptación del sistema ]L^!<[!Z':#%#5$!*'!,'*#*-%!*'!%'6I(#*-*!'$!'2!'$&)($)!*'!)4'(-.#5$!H+]g]L^!<D@[!Z':#%#5$!*'!,'*#*-%!*'!%'6I(#*-*!'$!'2!'$&)($)!*'!)4'(-.#5$!
]L^!>[!L:-2I-.#5$!*'!('%I2&-*)%!*'!4(I'1-%!*'!%'6I(#*-*!*'!#,42-$&-.#5$!*'2!%#%&',-!H+]g]L^!>D@[!L%&I*#)!*'! 2)%!('%I2&-*)%!*'!4(I'1-%!*'!%'6I(#*-*!*'!#,42-$&-.#5$!*'2!%#%g&',-!
]L^!A[!Z':#%#5$!*'!,'*#*-%!*'!%'6I(#*-*!'$!'2!'$&)($)!*'!4()*I..#5$!H+]g]L^!AD@[!Z':#%#5$!*'!,'*#*-%!*'!%'6I(#*-*!'$!'2!'$&)($)!*'!4()*I..#5$!
MSI: Mantenimiento del sistema de información ]L^!<[!L%4'.#O#.-.#5$!'!#*'$&#O#.-.#5$!*'!2-%!OI$.#)$'%!J!,'.-$#%,)%!*'!%'6I(#*-*!"]Hg]L^!<D@[!L%&I*#)!*'!2-!4'&#.#5$!"]Hg]L^!<D<[!+$82#%#%!*'!2-%!OI$.#)$'%!J!,'.-$#%,)%!*'!%'6I(#*-*!-O'.&-*)%!)!$I':)%!
!
4.6. Referencias !" 7H]`!]4'.#-2!/I12#.-&#)$!NSSgGBW!j]'.I(#&J!3)$%#*'(-&#)$%!#$!&V'!H$O)(,-&#)$!]J%&',!\':'2g)4,'$&!T#O'!3J.2'kW!Z':D@D!xI$'!<SSBD!
!" 7H]`!]4'.#-2!/I12#.-&#)$!NSSg<K!Z':D!+W!jL$6#$''(#$6!/(#$.#42'%!O)(!H$O)(,-&#)$!`'.V$)2)6J!]'.I(#&J!?+!f-%'2#$'!O)(!+.V#':#$6!]'.I(#&JCkW!Z':D!+W!xI$'!<SSBD!
!" j]'6I(#*-*!*'!2-%!`'.$)2)6R-%!*'!2-!H$O)(,-.#5$D!T-!.)$%&(I..#5$!*'!2-!.)$O#-$Q-!4-(-!I$-!%).#'*-*!.)$'.&-*-kW!LD!e'($8$*'Qg"'*#$-!J!ZD!")J-!?'*#&)('%CD!+L7EZW!<SS>D!
"-6'(#&!:'(%#5$!<! ! \'%-(()22)!*'!%#%&',-%!*'!#$O)(,-.#5$!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!P>!?*'!@ABC!
!" "'&)*)2)6R-!*'!/2-$#O#.-.#5$W!\'%-(()22)!J!"-$&'$#,#'$&)!*'!%#%&',-%!*'! #$O)(,-.#5$D!";g&(#.-!:>D!3)$%'F)!]I4'(#)(!*'!H$O)(,8&#.-!J!4-(-!'2!H,4I2%)!*'!2-!+*,#$#%&(-.#5$!L2'.&(5$#.-W!<SSSD!
"-6'(#&!:'(%#5$!<! ! 3)$%'F)%!4(8.&#.)%!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!PB!?*'!@ABC!
5. Consejos prácticos `)*)!'2!42-$&'-,#'$&)!-$&'(#)(!4I'*'!UI'*-(!I$!4).)!-1%&(-.&)!J!$)!4'(,#&#(!-2!-$-2#%&-!4()6('%-(!.)$!%)2:'$.#-!-!&(-:;%!*'!2)%!4-%)%!#$*#.-*)%D!/)(!'22)!%'!V-!.)$%#*'(-*)!.)$:'$#'$&'!#$.2I#(!-2g6I$)%!.),'$&-(#)%!UI'!4I'*-$!%'(:#(!*'!6IR-!4-(-!-:-$Q-(D!
]'!('.),#'$*-!&-,1#;$!2-!.)$%I2&-!*'2!m3-&82)6)!*'!L2','$&)%m!UI'!('.)4#2-!)%!*'!-.&#:)%W!*#g,'$%#)$'%!*'!:-2)(-.#5$W!6IR-%!*'!:-2)(-.#5$W!.-&82)6)%!*'!-,'$-Q-%!J!*'!%-2:-6I-(*-%D!
5.1. Para identificar activos 3)$:#'$'!('4'&#(!UI'!%52)!#$&'('%-$!2)%!('.I(%)%!*'!2)%!%#%&',-%!*'!#$O)(,-.#5$!UI'!&#'$'$!I$!:-g2)(!4-(-!2-!E(6-$#Q-.#5$W!1#'$!'$!%R!,#%,)%W!1#'$!4)(UI'!%)1('!%I%!V),1()%!*'%.-$%-$!-.&#:)%!*'!:-2)(D!
+! &R&I2)!*'!'F',42)W!I$!%'(:#*)(!*'!4('%'$&-.#5$!y'1!'%!I$!-.&#:)!*'!'%.-%)!:-2)(!4()4#)D!L%&)!4I'*'!-%'6I(-(%'!4)(UI'!$)!'%!$)(,-2!UI'!I$-!E(6-$#Q-.#5$!*'%42#'6I'!I$!%'(:#*)(!*'!4('%'$g&-.#5$!y'1!%-2:)!UI'!2)!$'.'%#&'!4-(-!4('%&-(!I$!%'(:#.#)D!`)*)!%I!:-2)(!'%!#,4I&-*)[!
!" 2-! #$*#%4)$#1#2#*-*!*'2!%'(:#*)(!%I4)$'! 2-! #$&'((I4.#5$!*'2!%'(:#.#)h!'2!.)%&'!UI'!%I4)$6-! 2-!#$&'((I4.#5$!*'2!%'(:#.#)!'%!'2!:-2)(!*'!*#%4)$#1#2#*-*!UI'!%'!2'!#,4I&-(8!-2!%'(:#*)(!
!" '2!-..'%)!$)!.)$&()2-*)!-2!%'(:#*)(!4)$'!'$!(#'%6)!'2!%'.('&)!*'!2)%!*-&)%!UI'!4('%'$&-h!'2!.)%&'!UI'!%I4)$6-!2-!4;(*#*-!*'!.)$O#*'$.#-2#*-*!*'!2)%!*-&)%!'%!'2!:-2)(!*'!.)$O#*'$.#-2#g*-*!UI'!%'!2'!#,4I&-(8!-2!%'(:#*)(!
!" DDD!J!-%R!.)$!2-%!*#O'('$&'%!*#,'$%#)$'%!'$!.)$%#*'(-.#5$!
Los intangibles
3#'(&)%!'2','$&)%!*'!:-2)(!*'!2-%!)(6-$#Q-.#)$'%!%)$!*'!$-&I(-2'Q-!#$&-$6#12'[!
!" .('*#1#2#*-*!)!1I'$-!#,-6'$!
!" .)$).#,#'$&)!-.I,I2-*)!
!" #$*'4'$*'$.#-!*'!.(#&'(#)!)!-.&I-.#5$!
!" #$&#,#*-*!*'!2-%!4'(%)$-%!
!" #$&'6(#*-*!OR%#.-!*'!2-%!4'(%)$-%!
L%&)%!'2','$&)%!4I'*'$!#$.)(4)(-(%'!-2!-$82#%#%!*'!(#'%6)%!.),)!-.&#:)%>K!)!.),)!'2','$&)%!*'!:-2)(-.#5$>ND!T-!.I-$&#O#.-.#5$!*'!'%&)%!.)$.'4&)%!'%!-!,'$I*)!*#OR.#2h!4'()!*'!I$-!I!)&(-!O)(,-!$I$.-!4I'*'!)2:#*-(%'!UI'!2)!UI'!V-J!UI'!4()&'6'(!'$!02&#,-!#$%&-$.#-!'%!2-!,#%#5$!*'!2-!E(6-$#gQ-.#5$! J! '2! :-2)(! *'! ;%&-! ('%#*'! '$! '%&)%! #$&-$6#12'%! .),)! J-! %'! ('.)$).R-! '$!"-6'(#&! :'(%#5$!@DS>PD!
Identificación de activos
sI#Q8%!2-!,'F)(!-4()M#,-.#5$!4-(-!#*'$&#O#.-(!2)%!-.&#:)%!%'-!4('6I$&-(!*#('.&-,'$&'[!
!" XsI;!-.&#:)%!%)$!OI$*-,'$&-2'%!4-(-!UI'!I%&'*!.)$%#6-!%I%!)1F'&#:)%Y!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
>K!7)!&)*)%!2)%!-I&)('%!%)$!I$8$#,'%!'$!UI'!%'-!I$-!1I'$-!#*'-!#*'$&#O#.-(!-.&#:)%!#$&-$6#12'%D!L%!.#'(&)!UI'!%)$!-.&#:)%!'$!'2!%'$&#*)! O#$-$.#'()h!4'()!'%!*#%.I'!UI'!%'-$!('.I(%)%!4()4#-,'$&'!*#.V)%!*'2!%#%&',-!*'!#$O)(,-.#5$D!E.I(('!UI'!%#!-!2)%!#$&'(2).I&)('%!%'!2'%!4('6I$&-!*I(-$&'!2-%!'$&(':#%&-%!'$!&;(g,#$)%!*'!:-2)('%! #$&-$6#12'%!*'! 2-!E(6-$#Q-.#5$W!%'!4#'(*'! 2-!4'(%4'.&#:-!*'2!*R-!-!*R-W!4I'%! 2-!,-J)(!4-(&'!*'! 2)%!,#',1()%!*'! 2-!E(6-$#Q-.#5$! &#'$'$!)1F'&#:)%!,8%!.)$.('&)%!J!.'(.-$)%!%)1('! 2)%!UI'!%R!4I'*'$!',#&#(!I$-!)4#$#5$!OI$*-*-D!
>N!_'(!j3-&82)6)!*'!L2','$&)%kW!.-4R&I2)!jBD!3(#&'(#)%!*'!:-2)(-.#5$kD!>P!_'(!"-6'(#&! :'(%#5$! @DSW! j^IR-! *'!/().'*#,#'$&)%k! d! j>D!]I1,)*'2)! *'!L2','$&)%k! d! j>DBD! H,4-.&)%k! d!k>DBD>D!`#4)%kD!
"-6'(#&!:'(%#5$!<! ! 3)$%'F)%!4(8.&#.)%!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!PA!?*'!@ABC!
!" Xi-J!,8%!-.&#:)%!UI'!&'$6-!UI'!4()&'6'(!4)(!)12#6-.#5$!2'6-2Y!
!" Xi-J!-.&#:)%!('2-.#)$-*)%!.)$!2)%!-$&'(#)('%Y!
7)!%#',4('!'%!':#*'$&'!UI;!'%!I$!-.&#:)!'$!%#$6I2-(D!]#!4)(!'F',42)!'$!%I!I$#*-*!&#'$'!>SS!4I'%g&)%!*'!&(-1-F)!/3W!&)*)%!#*;$&#.)%!-!'O'.&)%!*'!.)$O#6I(-.#5$!J!*-&)%!UI'!,-$'F-$W!$)!'%!.)$:'g$#'$&'!-$-2#Q-(!>SS!-.&#:)%!#*;$&#.)%D!f-%&'!-$-2#Q-(!I$!/3!6'$;(#.)!UI'!.IJ-!4()12',8&#.-!('4('g%'$&-!2-!*'!&)*)%D!+6(I4-(!%#,42#O#.-!'2!,)*'2)D!
E&(-%!:'.'%!%'!4('%'$&-!'2!.-%)!.)$&(-(#)W!I$!%'(:#*)(!.'$&(-2!UI'!%'!'$.-(6-!*'!,#2! OI$.#)$'%[!%'(:#*)(!*'!O#.V'()%W!*'!,'$%-F'(R-W!*'!2-!#$&(-$'&W!*'2!%#%&',-!*'!6'%$!*).I,'$&-2!J!DDD!L$!'%&'!.-%)! .)$:#'$'! %'6('6-(! 2)%! %'(:#.#)%! 4('%&-*)%! .),)! %'(:#.#)%! ?#$&'($)%C! #$*'4'$*#'$&'%D! ]52)!.I-$*)!%'!22'6I'!-2!$#:'2!*'!'UI#4-,#'$&)!OR%#.)!V-1(8!UI'!V-.'(!.)$O2I#(!'$!I$!0$#.)!'UI#4)!&)*)%!2)%!%'(:#.#)%D!]#!'$!'2!OI&I()!%'!.)$%#6I'!%'6('6-(!%'(:#.#)%!'$&('!:-(#)%!%'(:#*)('%W!'$&)$.'%!'%!O8.#2!(':#%-(!'2!,)*'2)!*'!:-2)(!J!*'4'$*'$.#-%D!
5.2. Para descubrir y modelar las dependencias entre activos +!:'.'%!'%!,8%!*#OR.#2!*'! 2)!'%4'(-*)!4)(UI'! 2)%! ('%4)$%-12'%!*'! 2)%!-.&#:)%!%I'2'$!'%&-(!,8%!4(').I4-*)%!4)(!'2!'$.-*'$-,#'$&)!OI$.#)$-2!'$&('!-.&#:)%!UI'!4)(!2-!*'4'$*'$.#-!'$!'2!%'$&#*)!*'!4()4-6-.#5$!*'!:-2)(D!
L%!$'.'%-(#)!&(-$%,#&#(!-2!#$&'(2).I&)(!UI'!$)!%'!1I%.-!UI;!'%!$'.'%-(#)!4-(-!UI'!'2!%#%&',-!OI$g.#)$'%W!%#$)!-2!(':;%W!%'!1I%.-!*5$*'!4I'*'!O-22-(!'2!%#%&',-!)W!,8%!4('.#%-,'$&'W!*5$*'!4I'*'!:'(%'!.),4(),'&#*-!2-!%'6I(#*-*!*'!2)%!-.&#:)%D!
!" ]#!I$)%!*-&)%!%)$!#,4)(&-$&'%!4)(!%I!.)$O#*'$.#-2#*-*W!%'!$'.'%#&-!%-1'(!'$!UI;!%#&#)%!:-$!-!('%#*#(!*#.V)%!*-&)%!J!4)(!UI;!2I6-('%!:-$!-!.#(.I2-([!'$!'%)%!4I$&)%!4I'*'$!%'(!(':'2-*)%D!
!" ]#!I$)%!*-&)%!%)$!#,4)(&-$&'%!4)(!%I!#$&'6(#*-*W!%'!$'.'%#&-!%-1'(!'$!UI;!%#&#)%!:-$!-!('%#*#(!*#.V)%!*-&)%!J!4)(!UI;!2I6-('%!:-$!-!.#(.I2-([!'$!'%)%!4I$&)%!4I'*'$!%'(!-2&'(-*)%D!
!" ]#!I$!%'(:#.#)!'%!#,4)(&-$&'!4)(!%I!*#%4)$#1#2#*-*W!%'!$'.'%#&-!%-1'(!UI;!'2','$&)%!%'!I%-$!4-(-!4('%&-(!*#.V)!%'(:#.#)[!'2!O-22)!*'!'%)%!'2','$&)%!*'&'$*(R-!'2!%'(:#.#)D!
L%&-%!.)$%#*'(-.#)$'%!4I'*'$!42-$&'-(%'!.)$!-(6I,'$&)%!*'2!)[!
!" %#!I%&'*!UI#%#'(-!-..'*'(!-!'%&)%!*-&)%W!X*5$*'!-&-.-(R-Y!
!" %#!I%&'*!UI#%#'(-!*'&'$'(!'%&'!%'(:#.#)W!X*5$*'!-&-.-(R-Y!
L%&'!42-$&'-,#'$&)!*'!j45$6-%'!'$!'2!2I6-(!*'2!-&-.-$&'k!'%!'2!UI'!*-!4#'!-!2-%!&;.$#.-%!*'$),#g$-*-%!j8(1)2'%!*'!-&-UI'kBS!UI'!:-$!4-('F-%!-!2)!UI'!'$!'%&-!,'&)*)2)6R-!%'!*'$),#$-$!*'4'$g*'$.#-%D!L$!'O'.&)W!I$!-.&#:)!4I'*'!%'(!-&-.-*)!*#('.&-,'$&'!)! #$*#('.&-,'$&'!-! &(-:;%!*'!)&()!-.&#:)!*'2!UI'!*'4'$*-D!
T-%!-$&'(#)('%!.)$%#*'(-.#)$'%!4I'*'$!*'%',1).-(!'$!I$!*#-6(-,-!j42-$)k!*'!*'4'$*'$.#-%!UI'!%'!4I'*'!?J!.)$:#'$'!-!'O'.&)%!4(8.&#.)%C!.)$:'(&#(!'$!I$!8(1)2!,8%!.),4-.&)D!+%RW!'%!$)(,-2!*'g.#(!UI'!2)%!%'(:#.#)%!*'4'$*'$!*'2!'UI#4-,#'$&)W!UI'!*'4'$*'!-!%I!:'Q!*'!2)%!2).-2'%!*)$*'!%'!I1#.-$!2)%!'UI#4)%W!%#$!$'.'%#*-*!*'!'M42#.#&-(!UI'!2)%!%'(:#.#)%!*'4'$*'$!*'!2)%!2).-2'%B@D!L%!O('g.I'$&'! #*'$&#O#.-(! j%'(:#.#)%! #$&'($)%k!)! j%'(:#.#)%!V)(#Q)$&-2'%k!UI'!%)$!-6(I4-.#)$'%!*'!-.&#:)%!4-(-!I$-!.#'(&-!OI$.#5$D!L%&)%!%'(:#.#)%!#$&'(,'*#)%!%)$!'O#.-.'%!4-(-!.),4-.&-(!'2!6(-O)!*'!*'g4'$*'$.#-%W!4I'%!2-%!*'4'$*'$.#-%!*'!*#.V)%!%'(:#.#)%!%'!#$&'(4('&-$!%#$!-,1#6l'*-*!.),)!*'g4'$*'$.#-!*'!&)*)%!2)%!'2','$&)%!UI'!4('%&-$!'2!%'(:#.#)D!
3I-$*)!%'!I%'$!*#-6(-,-%!*'!O2IF)!*'!*-&)%!)!*#-6(-,-%!*'!4().'%)%W!$)!*'1'!4(').I4-(!&-$&)!2-! (I&-!UI'!%#6I'$! 2)%!*-&)%!.),)!'2!.)$FI$&)! ?*'%)(*'$-*)C!*'!'2','$&)%!UI'! #$&'(:#'$'$D!9$!4().'%)!*'4'$*'!*'! &)*)%! 2)%!-.&#:)%!UI'!-4-('.'$!'$!%I!*#-6(-,-D!9$)%!*-&)%!*'4'$*'$!*'!&)*)%!2)%!%#&#)%!4)(!*)$*'!4-%'$D!`-$&)!'$!I$)%!.),)!'$!)&()%!*#-6(-,-%!'%!O('.I'$&'!'$.)$&(-(!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
BS!_'(!j^IR-!*'!`;.$#.-%kW!%'..#5$!<D>D!B@!L$!2-!m^IR-!*'!`;.$#.-%m!'$.)$&(-(8!'2!,)*'2)!-26)(R&,#.)!4-(-!.-2.I2-(!2-%!*'4'$*'$.#-%!&)&-2'%!'$&('!-.&#:)%!-!4-(&#(!*'!2-%!*'4'$*'$.#-%!*#('.&-%D!
"-6'(#&!:'(%#5$!<! ! 3)$%'F)%!4(8.&#.)%!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!PG!?*'!@ABC!
*'%.(#4.#)$'%! F'(-(UI#Q-*-%! *)$*'! I$! 4().'%)! %'! %I1*#:#*'! '$! $#:'2'%! *'!,-J)(! *'&-22'D!L%&-%!F'(-(UIR-%!*'!*#-6(-,-%!4I'*'$!-JI*-(!-!'2-1)(-(!'2!6(-O)!*'!*'4'$*'$.#-%D!
Errores típicos
7)!'%!.)(('.&)!*'.#(!UI'!I$-!-42#.-.#5$!*'4'$*'!*'! 2)%!*-&)%!UI'!,-$'F-D!L2! (-Q)$-,#'$&)!*'!UI#'$!&-2!-O#(,-!'%!UI'!j2-!-42#.-.#5$!$)!OI$.#)$-(R-!%#$!*-&)%kW! 2)!UI'!'%!.)(('.&)h!4'()!$)!'%!2)!UI'!#$&'('%-!('O2'F-(D!"8%!1#'$!'%!&)*)!2)!.)$&(-(#)[!2)%!*-&)%!*'4'$*'$!*'!2-!-42#.-.#5$D!L$!&;(,#g$)%!*'!:-2)(W!%'!4I'*'!-%'6I(-(!UI'!2-!-42#.-.#5$!$)!:-2'!$-*-!%#$!*-&)%D!3),)!'2!:-2)(!'%!I$-!4()4#'*-*!*'!2)%!*-&)%W!'%!'%'!:-2)(!'2!UI'!V'('*-!2-!-42#.-.#5$D!TI'6)!2)%!*-&)%!*'4'$*'$!*'!2-!-42#.-.#5$D!\'%*'!)&()!4I$&)!*'!:#%&-W!-!&(-:;%!*'!2-!-42#.-.#5$!4I'*'!-..'*'(%'!-!2)%!*-&)%W!.)$g:#(&#;$*)%'!2-!-42#.-.#5$!'$!2-!:R-!*'!-&-UI'!-!2)%!*-&)%D!
\-*)!UI'!*-&)%!J!-42#.-.#)$'%!%I'2'$!-I$-(!'%OI'(Q)%!4-(-!2-!4('%&-.#5$!*'!I$!%'(:#.#)W!'2!:-2)(!*'2!%'(:#.#)!%'!&(-$%,#&'!&-$&)!-!2)%!*-&)%!.),)!-!2-%!-42#.-.#)$'%!#$&'(:#$#'$&'%D!
mal bien
!" %'(:#.#)!!!-42#.-.#5$
!" -42#.-.#5$!!!*-&)%!
!" %'(:#.#)!!!*-&)%!
!" *-&)%!!!-42#.-.#5$!
!" %'(:#.#)!!!-42#.-.#5$
!
7)!'%!.)(('.&)!*'.#(!UI'!I$-!-42#.-.#5$!*'4'$*-!*'2!'UI#4)!*)$*'!%'!'F'.I&-D!L2!(-Q)$-,#'$&)!*'!UI#'$!&-2!-O#(,-!'%!UI'!j2-!-42#.-.#5$!$)!OI$.#)$-(R-!%#$!'UI#4)kW!2)!UI'!'%!.)(('.&)h!4'()!$)!'%!2)!UI'!#$&'('%-!('O2'F-(D!]#!&-$&)!2-!-42#.-.#5$!.),)!'2!'UI#4)!%)$!$'.'%-(#)%!4-(-!4('%&-(!I$!%'(:#.#)W!%'!*'1'!*'.#(!'M42R.#&-,'$&'W!%#$!1I%.-(!.-,#$)%!('&)(.#*)%D!
mal bien
!" %'(:#.#)!!!-42#.-.#5$
!" -42#.-.#5$!!!'UI#4)!
!" %'(:#.#)!!!-42#.-.#5$
!" %'(:#.#)!!!'UI#4)!
!
T)%!'(()('%!.),'$&-*)%!-!:'.'%!4-%-$!*'%-4'(.#1#*)%!,#'$&(-%!'2!%#%&',-!'%!,IJ!('*I.#*)!?%52)!V-J!I$!%'(:#.#)W!I$-!-42#.-.#5$!J!I$!'UI#4)Ch!4'()!-4-('.'$!'$!.I-$&)!'2!%#%&',-!.('.'D!/)(!'F',g42)W! I$-!-42#.-.#5$!n!4I'*'!'F'.I&-(%'!'$!*#O'('$&'%!'UI#4)%! .)$!*#O'('$&'%!*-&)%!4-(-!4('%&-(!*#O'('$&'%!%'(:#.#)%D!Z'%I2&-!'$&)$.'%! #,4)%#12'!('2-.#)$-(! 2-!-42#.-.#5$!.)$!I$)!)!,8%!'UI#4)%W!%-2:)!.)$%#*'(-$*)!.-*-!.-%)!
%'(:#.#) @%'(:#.#) @ %'(:#.#) <%'(:#.#) <
*-&)%!@*-&)%!@ *-&)%!<*-&)%!<*-&)%!@*-&)%!@ *-&)%!<*-&)%!<
-42#.-.#5$-42#.-.#5$
'UI#4)!@'UI#4)!@ 'UI#4)!<'UI#4)!<'UI#4)!@'UI#4)!@ 'UI#4)!<'UI#4)!<!
¿Están bien modeladas las dependencias?
L%&-12'.'(!*'4'$*'$.#-%!'%!I$-!&-('-!*'2#.-*-!UI'!4I'*'!-.-1-(!,-2D!+$&'%!*'!*-(!4)(!1I'$)!I$!,)*'2)!*'!*'4'$*'$.#-%!V-J!UI'! &(-Q-(!4-(-!.-*-!-.&#:)! &)*)%! 2)%!-.&#:)%!*'! 2)%!UI'!*'4'$*'!*#('.&-!)!#$*#('.&-,'$&'D!o!%'!*'1'!('%4)$*'(!4)%#&#:-,'$&'!-!2-%!4('6I$&-%!*'!%#!
"-6'(#&!:'(%#5$!<! ! 3)$%'F)%!4(8.&#.)%!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!PK!?*'!@ABC!
!" XL%&8$!&)*)%!2)%!UI'!%)$Y!L%!*'.#(W!%#!%'!V-$!#*'$&#O#.-*)!&)*)%!2)%!-.&#:)%!'$!2)%!UI'!4I'g*'!%'(!-&-.-*)!#$*#('.&-,'$&'!'2!-.&#:)!:-2)(-*)D!
!" X])$!&)*)%! 2)%!UI'!'%&8$Y!L%!*'.#(W!%#!('-2,'$&'!'2!-.&#:)!:-2)(-*)!4I'*'!%'(!-&-.-*)!'$!&)*)%!'%)%!-.&#:)%!*'!2)%!UI'!*'4'$*'!
3),)!2-!('2-.#5$!*'!*'4'$*'$.#-!4()4-6-!'2!:-2)(!-.I,I2-*)W!'$.)$&(-(!I$!-.&#:)!%#$!:-2)(!-.Ig,I2-*)!'%!%R$&),-!*'!UI'!2-%!*'4'$*'$.#-%!'%&8$!,-2!,)*'2-*-%!)W!%#,42','$&'W!UI'!'2!-.&#:)!'%!#(('2':-$&'D!
5.3. Para valorar activos ]#',4('!.)$:#'$'!:-2)(-(! 2-! #$O)(,-.#5$!)!*-&)%!UI'!.)$%&#&IJ'$! 2-!(-Q5$!*'!%'(!*'2!%#%&',-!*'!#$O)(,-.#5$D!
]#!%'!V-$!,)*'2-*)!%'(:#.#)%!O#$-2'%!?4('%&-*)%!-!I%I-(#)%!'M&'($)%!-2!*),#$#)!*'!-$82#%#%CW!.)$g:#'$'!:-2)(-(2)%!#6I-2,'$&'D!
L%!O8.#2!#*'$&#O#.-(!-.&#:)%!*'!)!*-&)%!)!#$O)(,-.#5$!J!:-2)(-(2)%!%#6I#'$*)!.2-%#O#.-.#)$'%!4-I&-g*-%!.),)!%I!.-(8.&'(!4'(%)$-2!)!%I!.2-%#O#.-.#5$!*'!%'6I(#*-*D!/'()!4-%-!-!%'(!,I.V)!,8%!*'2#g.-*)!:-2)(-(!*-&)%!*'!)!.),'(.#-2!I!)4'(-.#)$-2!4)(UI'!V-J!UI'!#(!-!2-%!.)$%'.I'$.#-%!*'2!*-gc)!%IO(#*)D!
L2!('%&)!*'!2)%!-.&#:)%!4I'*'!O('.I'$&','$&'!4-%-(!%#$!:-2)(-(W!4I'%!%I!:-2)(!,8%!#,4)(&-$&'!'%!%)4)(&-(!2)%!*-&)%!Jd)!2)%!%'(:#.#)%!J!*'!'%'!.82.I2)!%'!'$.-(6-$!2-%!('2-.#)$'%!*'!*'4'$*'$.#-%D!
7)!)1%&-$&'W!%#!.)$%#*'(-!)4)(&I$)!:-2)(-(!)&()!)!*'!-.&#:)%!DDD!
T)%!-.&#:)%!,8%!%'$.#22)%!*'!:-2)(-(!%)$!-UI'22)%!UI'!%'!-*UI#'('$!'$!I$!.),'(.#)D!]#!%'!-:'(R-W!V-J!UI'!4)$'(!)&()D!L%&)!.I'%&-!*#$'()!J!&#',4)!?)!%'-W!,8%!*#$'()CD!]'!V-12-!*'!I$!.)%&'!*'!('g4)%#.#5$D!]-2:)!$)&)(#-%!'M.'4.#)$'%W!O('.I'$&','$&'!).I(('!UI'!'2!.)%&'!*'!2)%!-.&#:)%!OR%#.)%!'%!*'%4('.#-12'!O('$&'!-!)&()%!.)%&'%W!4I*#'$*)!)1:#-(%'D!
L%!*#OR.#2!:-2)(-(!2-%!4'(%)$-%W!'$!6'$'(-2h!4'()!%#!I$!4I'%&)!%I4)$'!I$-!O)(,-.#5$!2'$&-!J!&(-1-F)g%-W!V-J!UI'!&'$'(!'$!.I'$&-!UI'!2-!4'(%)$-!UI'!*'%',4'c-!'%'!4I'%&)!%'!.)$:#'(&'!'$!,IJ!:-g2#)%-W!4I'%!%I!j.)%&'!*'!('4)%#.#5$k!'%!$)&-12'D!
L$!.I-2UI#'(!.-%)W!4-(-!:-2)(-(!I$!-.&#:)!%'!*'1'!#*'$&#O#.-(!-2!('%4)$%-12'W!UI'!%'(8!2-!4'(%)$-!-*'.I-*-!4-(-!:-2)(-(!'2!-.&#:)D!+!'%&'! ('%4)$%-12'!V-J!UI'!-JI*-(2'!.)$! &-12-%!*'!:-2)(-.#5$!.),)!2-%!*'2!.-4R&I2)!B!*'2!m3-&82)6)!*'!L2','$&)%m!UI'W!-*-4&-*-%!-2!.-%)!.)$.('&)W!4'(,#&-$!&(-*I.#(!2-!4'(.'4.#5$!*'!:-2)(!'$!I$-!,'*#*-!.I-2#&-&#:-!)!.I-$&#&-&#:-!*'2!,#%,)D!
+!,'$I*)!$)!'M#%&'!'2!('%4)$%-12'!0$#.)!J!%#$6I2-(!*'!I$!-.&#:)!Jd)!%'(:#.#)W!%#$)!UI'!:-(#-%!4'(g%)$-%!*'$&()!*'! 2-!E(6-$#Q-.#5$! &#'$'$!)4#$#5$!.I-2#O#.-*-!-2! ('%4'.&)D!i-J!UI'!)R(2-%! &)*-%D!o!22'6-(!-!I$!.)$%'$%)D!]#!'2!.)$%'$%)!$)!'%!)1:#)W!4I'*'!('UI'(#(!
un careo: FI$&'!-!2)%!UI'!)4#$-$!'!#$&'$&'!UI'!22'6I'$!-!I$-!)4#$#5$!.),0$!
un Delphi42: ,-$*'!.I'%&#)$-(#)%!-!2)%!UI'!)4#$-$!'!#$&'$&'!UI'!.)$:'(F-$!-!I$-!)4#$#5$!.)g,0$!
L$!2)%!4().'%)%!*'!:-2)(-.#5$!*'!-.&#:)%!'%!O('.I'$&'!('.I((#(!-!4'(%)$-%!*#O'('$&'%!4-(-!:-2)(-(!-.&#:)%!*#O'('$&'%D!o!'%!O('.I'$&'!UI'!.-*-!'$&(':#%&-*)!.)$%#*'('!%I%!-.&#:)%!.),)!*'!2-!,8M#,-!#,4)(&-$.#-h! &-$&)!,8%! O('.I'$&'! .I-$&)!,8%!'%4'.#-2#Q-*)!'%&;!'2! '$&(':#%&-*)D!3),)!,I.V-%!:-2)(-.#)$'%!%)$!'%&#,-.#)$'%!*'!:-2)(W!V-J!UI'!.I#*-(!UI'!&)*)!'2!,I$*)!I%'!2-!,#%,-!'%.-2-!*'!'%&#,-(D!/)(!'22)!'%!#,4)(&-$&'!I%-(!I$-!&-12-!.),)!2-!*'2!.-4R&I2)!B!*'2!m3-&82)6)!*'!L2','$g&)%mW!*#('.&-,'$&'!)!-*-4&-*-!-2!.-%)!.)$.('&)D!o!'%!#,4)(&-$&'!UI'!&(-%!V-1'(!4('6I$&-*)!-!2)%!UI'!'$&#'$*'$!*'!.-*-!-.&#:)W! &)*)%! ('.#1-$!I$-!.)4#-!*'! 2-!:-2)(-.#5$!62)1-2!*'2!%#%&',-!4-(-!UI'!-4('.#'$!'2!:-2)(!('2-&#:)!*'!j%I%!-.&#:)%k!J!)4#$'$!'$!.)$&'M&)D!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
B<!_'(!m^IR-!*'!`;.$#.-%mW!.-4R&I2)!>DKD!
"-6'(#&!:'(%#5$!<! ! 3)$%'F)%!4(8.&#.)%!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!PN!?*'!@ABC!
Datos de carácter personal
T)%!*-&)%!*'!.-(8.&'(!4'(%)$-2!'%&8$!#O#.-*)%!4)(!2'J'%!J!('62-,'$&)%W!('UI#(#'$*)!*'!2-!E(6-g$#Q-.#5$!UI'!-*)4&'!I$-!%'(#'!*'!,'*#*-%!*'!4()&'..#5$!#$*'4'$*#'$&'%!*'2!:-2)(!*'2!-.&#:)B>D!
T-! O)(,-!,8%!('-2#%&-!*'!'$O('$&-(%'!-! 2)%!-.&#:)%!*'!.-(8.&'(!4'(%)$-2!'%!.-(-.&'(#Q-(2)%!.),)!&-2'%!'$!'2!$#:'2!UI'!.)(('%4)$*-!JW!-*',8%W!*'&'(,#$-(!%I!:-2)([!'2!*-c)!UI'!%I4)$*(R-!%I!(':'g2-.#5$! )! -2&'(-.#5$! #$*'1#*-D!3)$!'%&-! -4()M#,-.#5$W! '2! -$82#%#%! *'! #,4-.&)%! J! (#'%6)%!4'(,#&#(8!4()&'6'(!2)%!*-&)%!&-$&)!4)(!)12#6-.#5$!2'6-2!.),)!4)(!%I!4()4#)!:-2)(D!
5.4. Para identificar amenazas T-!&-('-!-4-('.'!.),)!#,4)%#12'[!4-(-!.-*-!-.&#:)W!'$!.-*-!*#,'$%#5$W!#*'$&#O#.-(!-,'$-Q-%D!
]'!4I'*'!4-(&#(!*'!2-!'M4'(#'$.#-!4-%-*-W!4()4#-!)!*'!)(6-$#Q-.#)$'%!%#,#2-('%D!T)!UI'!V-!).I((#g*)!4I'*'!('4'&#(%'!JW!'$!.I-2UI#'(!.-%)W!%'(R-!#,4('%'$&-12'!$)!&'$'(2)!'$!.I'$&-D!
3),42','$&-(#-,'$&'W!I$!.-&82)6)!*'!-,'$-Q-%!.),)!'2!#$.2I#*)!'$!'2!m3-&82)6)!*'!L2','$&)%m!-JI*-!-!2).-2#Q-(!2)!UI'!.)$:#'$'!.)$%#*'(-(!'$!OI$.#5$!*'2!)!*'!-.&#:)!J!*'!2-%!*#,'$%#)$'%!'$!2-%!UI'!&#'$'!I$!:-2)(!4()4#)!)!-.I,I2-*)D!
+!,'$I*)!%'!('.I(('!-!#*'-(!'%.'$-(#)%!*'!-&-UI'!UI'!$)!%)$!%#$)!*(-,-&#Q-.#)$'%!*'!.5,)!I$!-&-.-$&'!%'!'$O('$&-(R-!-!$I'%&()%!%#%&',-%D!L%&-!&;.$#.-!'%!2-!UI'!-!:'.'%!%'!*'$),#$-!j8(1)2'%!*'!-&-UI'kD!/5$6-%'!'$!2-!4#'2!*'2!-&-.-$&'!'!#,-6#$'!UI;!V-(R-!.)$!%I%!.)$).#,#'$&)%!J!%I!.-g4-.#*-*!'.)$5,#.-D!/I'*'!UI'!&'$6-!UI'!42-$&'-(%'!*#O'('$&'%!%#&I-.#)$'%!*'4'$*#'$*)!*'2!4'(O#2!&;.$#.)!*'2!-&-.-$&'!)!*'!%I%!('.I(%)%!&;.$#.)%!J!VI,-$)%D!L%&-%!*(-,-&#Q-.#)$'%!%)$!#$&'('%-$g&'%!4-(-!4)*'(!.-2.I2-(!#,4-.&)%!J!(#'%6)%h!4'()!-*',8%!%'(8$!,IJ!0'%!-!2-!V)(-!*'!.)$:'$.'(!-!2-!-2&-!*#('..#5$!J!-!2)%!I%I-(#)%!*'!4)(!UI;!I$-!-,'$-Q-!$)!'%!&'5(#.-!%#$)!,IJ!('-2D!L%!,8%W!.I-$*)!':-20'!2-%!%-2:-6I-(*-%!4I'*'!%'(!.)$:'$#'$&'!(':#%-(!'%&)%!'%.'$-(#)%!*'!-&-UI'D!
5.5. Para valorar amenazas T-!&-('-!'%!*'%,)(-2#Q-*)(-[!4-(-!.-*-!-.&#:)!'$!.-*-!*#,'$%#5$W!*'&'(,#$-(!2-!*'6(-*-.#5$!UI'!.-I%-(R-$!J!2-!O('.I'$.#-!4()1-12'!*'!).I(('$.#-D!
]#',4('!UI'!%'-!4)%#12'!.)$:#'$'!4-(&#(!*'!*-&)%!'%&8$*-(D!L$!'2!.-%)!*'!*'%-%&('%!$-&I(-2'%!)!-..#*'$&'%!#$*I%&(#-2'%W!%'!4I'*'!*#%4)$'(!*'!%'(#'%!V#%&5(#.-%W!6'$;(#.-%!)!*'2!2I6-(!'$!'2!UI'!%'!I1#.-$! 2)%! 'UI#4)%! *'! $I'%&()! %#%&',-!*'! #$O)(,-.#5$! 1-F)! '%&I*#)D!/()1-12','$&'! &-,1#;$! %'!*#%4)$6-!*'!I$!V#%&)(#-2!UI'!#$O)(,'!*'!2)!UI'!'%!O('.I'$&'!J!*'!2)!UI'!j$)!4-%-!$I$.-kD!!
"8%!.),42#.-*)!'%!.-2#O#.-(!2)%!'(()('%!VI,-$)%h!4'()!2-!'M4'(#'$.#-!4'(,#&'!#(!-UI#2-&-$*)!:-2)g('%!('-2#%&-%D!
o!2)!,8%!.),42'F)!'%!.-2#O#.-(!2)%!-&-UI'%!*'2#1'(-*)%!4I'%!*'4'$*'$!*'!2-!%I'(&'W!1I'$-!)!,-2-D!i-J!,I.V)%!,)&#:)%!UI'!-6I*#Q-$!'2!4'2#6()!*'!I$-!-,'$-Q-[!
!" UI'!$)!('UI#'(-!6(-$*'%!.)$).#,#'$&)%!&;.$#.)%!4)(!4-(&'!*'2!-&-.-$&'BB!
!" UI'!$)!('UI#'(-!6(-$!#$:'(%#5$!'$!'UI#4)!4)(!4-(&'!*'2!-&-.-$&'BA!
!" UI'!V-J-!I$!'$)(,'!1'$'O#.#)!'.)$5,#.)!'$!FI'6)!?UI'!'2!-&-.-$&'!4I'*'!'$(#UI'.'(%'C!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
B>!L%!4)%#12'!-4()M#,-(%'!-!2-!:-2)(-.#5$!*'!2)%!-.&#:)%!UI'!%)$!*'!.-(8.&'(!4'(%)$-2!.I-$&#O#.-$*)!2-!,I2&-!UI'!#,4)$*(R-!2-!+6'$.#-!*'!/()&'..#5$!*'!\-&)%D!L%&-!-4()M#,-.#5$!$)!:-2'!'$!I$!-$82#%#%!.I-2#&-&#:)D!L$!I$!-$82#%#%!.I-$&#&-&#:)W!'%&-!-4()M#,-.#5$!4-(&'!*'!2-!V#45&'%#%!*'!UI'!2)!4')(!UI'!4I'*'!4-%-(!.)$!'%'!*-&)!'%!%'(!,)&#:)!*'!,I2&-D!
BB!i-J!UI'!'%&-(!-&'$&)%!-!2-!j.),'(.#-2#Q-.#5$k!*'!2-%!V'((-,#'$&-%!*'!-&-UI'!4I'%!I$!-&-UI'!4I'*'!('gUI'(#(!I$!6(-$!'M4'(&)!4-(-!('-2#Q-(2)!,-$I-2,'$&'!?'%!*'.#(W!'%!4).)!O('.I'$&'Ch!4'()!%#!'2!'M4'(&)!',g4-UI'&-!%I!-&-UI'!'$!I$-!V'((-,#'$&-!.)$!I$-!%#,42'!#$&'(O-Q!6(8O#.-W!I%-(!2-!V'((-,#'$&-!%'!.)$:#'(&'!'$!I$!*'4)(&'!UI'!$)!('UI#'('!*'2!-&-.-$&'!%#$)!-I%'$.#-!*'!'%.(04I2)%!?'%!*'.#(W!2-!-,'$-Q-!V-!4-%-g*)!-!%'(!,IJ!O('.I'$&'CD!
BA!i-J!UI'!&'$'(!,IJ!'$!.I'$&-!UI'!H$&'($'&!'%!I$-!('*! #$,'$%-!*'!4)*'(!*'!.5,4I&)D!]#!-26I#'$!%-1'!.5,)!)(6-$#Q-(%'W!$)!'%!*#OR.#2!4)$'(!-!2-!('*!-!j&(-1-F-(!4-(-!,Rk!2)!UI'!%I4)$'!UI'!'2!-&-.-$&'!*#%4)$g6-!*'!,I.VR%#,)%!,8%!,'*#)%!'O'.&#:)%!UI'!'2!-&-.-*)D!
"-6'(#&!:'(%#5$!<! ! 3)$%'F)%!4(8.&#.)%!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!PP!?*'!@ABC!
!" UI'!V-J-!I$!'$)(,'!1'$'O#.#)!'$!FI'6)!?UI'!'2!-&-.-$&'!4I'*-!%-2#(!OI'(&','$&'!1'$'O#.#-g*)W!'$!%I!'%&#,-W!'$!%I!.)$).#,#'$&)!4)(!&)*)!'2!,I$*)W!DDDCh!4)(!2)!UI'!,8%!UI#'(-W!':#&'!2)%!('&)%!J!F-,8%!-2-(*''!*'!UI'!%I!%#%&',-!*'!#$O)(,-.#5$!'%!#$:I2$'(-12'[!$)!2)!'%!J!$)!&#'$'!6(-.#-!UI'!%'!2)!*',I'%&('$!
!" UI'!V-J-!I$!,-2!-,1#'$&'!*'!&(-1-F)W!%',#22-!*'!',42'-*)%!*'%.)$&'$&)%!UI'!%'!:'$6-$!-!&(-:;%!*'!2)%!%#%&',-%W!%#,42','$&'!4-(-!.-I%-(!*-c)!
!" UI'!V-J-!I$-!,-2-!('2-.#5$!.)$!2)%!I%I-(#)%!'M&'($)%W!UI'!%'!:'$6-$!-!&(-:;%!*'!$I'%&()%!%#%&',-%!
/-(&#'$*)!*'!I$!:-2)(!'%&8$*-(W!V-J!UI'!#(!-I,'$&-$*)!)!*#%,#$IJ'$*)!%I%!.-2#O#.-.#)$'%!*'!O('g.I'$.#-!J!*'6(-*-.#5$!V-%&-! ('O2'F-(! 2)!,8%!4)%#12'!'2!.-%)!.)$.('&)D!+!,'$I*)!$)!'%!':#*'$&'!*'&'(,#$-(!'2!:-2)(!.)(('.&)!J!'%!$'.'%-(#)!('.I((#(!-!%#,I2-.#)$'%!UI'!)(#'$&'$D!L2!I%)!*'!-260$!)!*'!V'((-,#'$&-!'%!,IJ!0!4-(-!'%&I*#-(!2-%!.)$%'.I'$.#-%!*'!I$!.#'(&)!:-2)(W!2)!UI'!-26I$)%!-I&)('%!*'$),#$-$!2-!%'$%#1#2#*-*!*'2!,)*'2)!-!.#'(&)!*-&)D!]#!%'!-4('.#-!UI'!2)%!('%I2&-*)%!.-,g1#-$! (-*#.-2,'$&'! -$&'! 4'UI'c-%! -2&'(-.#)$'%! *'! I$-! '%&#,-.#5$! *'! O('.I'$.#-! )! *'6(-*-.#5$W!V-J!UI'!?@C!%'(!('-2#%&-%!J!?<C!4('%&-(!'M&(',-!-&'$.#5$!-!4)(!UI;!'2!%#%&',-!'%!&-$!%'$%#12'!-!-26)!&-$!.)$.('&)!J! &),-(!,'*#*-%!)(#'$&-*-%!-! #$*'4'$*#Q-(!'2!%#%&',-h!'%!*'.#(W!-!$)!V-.'(!.(R&#.-!I$-!.#'(&-!-,'$-Q-D!!
Z'.I'(*'!UI'!2-!O('.I'$.#-!$)!-O'.&-!-2!#,4-.&)W!4)(!2)!UI'!'%&I*#-$*)!'2!#,4-.&)!%'!4I'*'!-FI%g&-(! 2-!*'6(-*-.#5$!JW!4)%&'(#)(,'$&'W!'%&I*#-$*)!'2!(#'%6)!%'!4I'*'!-FI%&-(! 2-!O('.I'$.#-D!7I$.-!%'!*'1'!-.'4&-(!I$!:-2)(!#$FI%&#O#.-*)!*'!*'6(-*-.#5$!'$!2-!'%4'(-$Q-!*'!.),4'$%-(2)!.)$!2-!O('g.I'$.#-W!4I'%!2-!'%&#,-.#5$!*'2!#,4-.&)!'%!#,4)(&-$&'!'$!%R!,#%,-W!-*',8%!*'!2-!*'!(#'%6)D!
]'-!.I-2!%'-!2-!*'.#%#5$!O#$-2!UI'!%'!&),'!4-(-!'%&#,-(!I$!:-2)(W!V-J!UI'!*).I,'$&-(2-!4I'%!-$g&'%!)!*'%4I;%!%'!4'*#(8$!'M42#.-.#)$'%W!%)1('!&)*)!%#!.),)!.)$%'.I'$.#-!%'!:-$!-!('.),'$*-(!%-2:-6I-(*-%!.)%&)%-%D!
5.6. Para seleccionar salvaguardas /()1-12','$&'! 2-!0$#.-!O)(,-!'%!&#(-(!*'!.-&82)6)D!9%'!I$!?%#%&',-C!'M4'(&)!UI'!2'!-JI*'!-!:'(!UI;!%)2I.#5$!'%!-*'.I-*-!4-(-!.-*-!.),1#$-.#5$!*'!
!" )!*'!-.&#:)!
!" -,'$-Q-!-!2-!UI'!'%&8!'M4I'%&)!
!" *#,'$%#5$!*'!:-2)(!UI'!'%!,)&#:)!*'!4(').I4-.#5$!
!" $#:'2!*'!(#'%6)!
+!,'$I*)!'$.)$&(-(8!,I.V-%!%)2I.#)$'%!4-(-!I$!4()12',-W!.)$!*#O'('$&'%!.-2#*-*'%D!L$!'%&)%!.-%)%!*'1'!'2'6#(!I$-!%)2I.#5$!4()4)(.#)$-*-!-!2)%!$#:'2'%!*'!#,4-.&)!J!(#'%6)!.-2.I2-*)%D!
"I.V-%!%-2:-6I-(*-%!%)$!*'!1-F)!.)%&'W!1-%&-$*)!.)$O#6I(-(!-*'.I-*-,'$&'!2)%!%#%&',-%!I!)(g6-$#Q-(!$)(,-&#:-!4-(-!UI'!'2!4'(%)$-2!V-6-!2-%!.)%-%!*'!O)(,-!-*'.I-*-D!/'()!-26I$-%!.)$&(-!,'*#*-%!%)$!('-2,'$&'!.)%&)%-%!?'$!%I!-*UI#%#.#5$W!'$!%I!*'%42#'6I'W!'$!%I!,-$&'$#,#'$&)!4'g(#5*#.)W!'$!2-!O)(,-.#5$!*'2!4'(%)$-2!-!%I!.-(6)W!DDDCD!L$!'%&)%!.-%)%!.)$:#'$'!4)$*'(-(!%#!'2!.)%&'!*'!2-!%-2:-6I-(*-!$)!%I4'(-!'2!(#'%6)!4)&'$.#-2h!'%!*'.#(W!&),-(!%#',4('!*'.#%#)$'%!*'!6-%&)!UI'!%I4)$6-$!I$!-V)(()!$'&)D!
/)(!02&#,)W!J!$)!,'$)%! #,4)(&-$&'W!-! 2-!V)(-!*'!*'%42'6-(!%-2:-6I-(*-%!V-J!UI'!.)$%#*'(-(!%I!O-.#2#*-*!*'!I%)D!T)!#*'-2!'%!UI'!2-!%-2:-6I-(*-!%'-!&(-$%4-('$&'!*'!O)(,-!UI'!'2!I%I-(#)!$)!&'$g6-!UI'!V-.'(!$-*-!)W!'$!%I!*'O'.&)W!.I-$&)!,'$)%!V-J-!UI'!V-.'(W!,'F)(D!]#,42','$&'!4)(UI'!I$-! %-2:-6I-(*-!*'! .),42'F)!,-$'F)! ('UI#'('!4'(%)$-2! '%4'.#-2#Q-*)! J!-c-*'!-! 2-%!-,'$-Q-%!UI'!J-!&'$R-!'2!%#%&',-!2-!-,'$-Q-!UI'!%I4)$'!%I!*'O'.&I)%-!I#Q-.#5$D!
5.7. Aproximaciones sucesivas L2!2'.&)(!J-!%'!V-1(8!4'(.#1#*)!*'!UI'!'2!-$82#%#%!*'!(#'%6)%!4I'*'!%'(!,IJ!2-1)(#)%)W!('UI#(#'$*)!&#',4)!J!'%OI'(Q)D!+*',8%W!V-J!UI'!#$&()*I.#(!,I.V)%!'2','$&)%!UI'!$)!%)$!)1F'&#:)%W!%#$)!'%&#g,-.#)$'%!*'2!-$-2#%&-W! 2)!UI'! #,42#.-!UI'!V-J-!UI'!'M42#.-(! J!.)$%'$%I-(! 2)!UI'!%#6$#O#.-!.-*-!
"-6'(#&!:'(%#5$!<! ! 3)$%'F)%!4(8.&#.)%!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!@SS!?*'!@ABC!
.)%-!4-(-!$)!'%&-(!'M4I'%&)%!-!#,4-.&)%!)!(#'%6)%!UI'!%'!#6$)(-$!)!%'!#$O(-:-2)(-$W!$#!.)$:'(&#(!2-!4-(-$)#-!'$!I$!*#%4'$*#)!*'!('.I(%)%!#$FI%&#O#.-*)%D!
]#!V-J!UI'!%'(!4(8.&#.)%!J!'O'.&#:)%W!.)$:#'$'!('-2#Q-(!-4()M#,-.#)$'%!%I.'%#:-%D!]'!',4#'Q-!4)(!I$!-$82#%#%!%),'()W!*'!-2&)!$#:'2W! #*'$&#O#.-$*)!(84#*-,'$&'! 2)!,8%!.(R&#.)[!-.&#:)%!*'!6(-$!:-2)(W!:I2$'(-1#2#*-*'%!,-$#O#'%&-%! )W! %#,42','$&'W! ('.),'$*-.#)$'%! *'! 2#1()! *'! &'M&)! 4)(UI'! $)! V-J!$-*-!,8%!4(I*'$&'!UI'!-4('$*'(!'$!.-1'Q-!-F'$-W!-4():'.V-$*)! 2-!'M4'(#'$.#-!*'! 2)%!*',8%D!L%&'!-$82#%#%!*'!(#'%6)%!'%!#,4'(O'.&)W!':#*'$&','$&'h!4'()!.-1'!.)$O#-(!'$!UI'!22':'!'$!2-!*#('.g.#5$!.)(('.&-D!T)%!48((-O)%!%#6I#'$&'%!*-$!#$*#.-.#)$'%!*'!.5,)!)(#'$&-(%'!(84#*-,'$&'!V-.#-!'2!)1F'&#:)!O#$-2[!&'$'(!#,4-.&)%!J!(#'%6)%!1-F)!.)$&()2D!
75&'%'!UI'!'%&-%!-4()M#,-.#)$'%!#,4'(O'.&-%!4'(,#&'$!*'%42'6-(!(84#*-,'$&'!%#%&',-%!(-Q)$-g12','$&'!4()&'6#*)%!.I-$*)!$)!V-J!&#',4)!4-(-!I$!-$82#%#%!*'!(#'%6)%!'$!&)*-!%I!42'$#&I*D!3I-$g*)W!.)$!&#',4)W!%'!22'6I'!-!2-!O-%'!*'!6'%$!*'!(#'%6)%!&(-%!I$!-$82#%#%!'MV-I%&#:)W!,IJ!4()1-g12','$&'!).I((-!UI'!,I.V-%!%-2:-6I-(*-%!'%&8$!J-!*#%4I'%&-%W!$'.'%#&8$*)%'!%52)! 2-! #$&()*I.g.#5$!*'!-26I$-%!$I':-%!Jd)!2-!,'F)(-!*'!2-!'O#.-.#-!*'!2-%!'M#%&'$&'%D!7)!'%!4I'%!&(-1-F)!4'(*#*)!%'6I#(!'%&-%!-4()M#,-.#)$'%!#$O)(,-2'%D!
5.7.1. Protección básica
L%!O('.I'$&'!)R(!V-12-(!*'!,'*#*-%!18%#.-%!*'!4()&'..#5$!(baseline) UI'!*'1'(R-$!#,42-$&-(%'!'$!&)*)%!2)%!%#%&',-%W!%-2:)!UI'!%'!*',I'%&('!UI'!$)!%)$!4'(&#$'$&'%!-!-260$!.-%)!4-(&#.I2-(D!
/)(!O-:)(W!$)!*#%.I&-h!$#!2)!*I*'[!-!%I%!%#%&',-%!*'!#$O)(,-.#5$!$)!4I'*'!-..'*'(!.I-2UI#'(-!'$!.I-2UI#'(!,),'$&)D!/I'*'!4()&'6'(2)%! OR%#.-!)! 256#.-,'$&'W!4)$#;$*)2)%!'$!I$-!%-2-!*)$*'!$)!'$&(-!.I-2UI#'(-W!)!#,4)$#'$*)!I$-!#*'$&#O#.-.#5$!*'!-..'%)!256#.)D!/'()!z4()&;F-2)%{!
L%&'!)!*'!(-Q)$-,#'$&)%!%'!4I'*'$!-42#.-(!.)$!O('.I'$.#-!J!22':-$!-!*'%42'6-(!I$!,R$#,)!*'!%-2:-6I-(*-%!j*'!4I()!%'$&#*)!.),0$kD!9$-!:'Q!-:-$Q-*)!2)!UI'!'%!)1:#)!J!$)!%'!*'1'(R-!$I$.-!*#%.I&#(W!%'!4I'*'!-:-$Q-(!-!$#:'2'%!,8%!'2-1)(-*)%W!'%4'.RO#.)%!*'!.-*-!%#%&',-D!
/-(-!-42#.-(!I$! &(-&-,#'$&)!18%#.)!%'!('UI#'('!I$!.-&82)6)!*'!%-2:-6I-(*-%D!LM#%&'$!$I,'()%-%!OI'$&'%W!'$&('!2-%!UI'!.-1'!*'%&-.-([!
!" $)(,-%!#$&'($-.#)$-2'%W!4)(!'F',42)!H]EdHL3!@KKPP[<SSA!
!" $)(,-%!$-.#)$-2'%W!4)(!'F',42)!2)%!j3(#&'(#)%!*'!]'6I(#*-*k!
!" $)(,-%!%'.&)(#-2'%!
!" $)(,-%!.)(4)(-&#:-%W!'%4'.#-2,'$&'! O('.I'$&'%!'$!4'UI'c-%!*'2'6-.#)$'%!*'!6(-$*'%!)(g6-$#Q-.#)$'%!
T-%!:'$&-F-%!*'!4()&'6'(%'!4)(!.-&82)6)!%)$[!
!" '%!,IJ!(84#*)!
!" $)!.I'%&-!-4'$-%!'%OI'(Q)!
!" %'!2)6(-!I$!$#:'2!V),)6;$')!.)$!)&(-%!)(6-$#Q-.#)$'%!4-('.#*-%!
T)%!#$.)$:'$#'$&'%!*'!4()&'6'(%'!4)(!.-&82)6)!%)$[!
!" '2!%#%&',-!4I'*'!4()&'6'(%'!O('$&'!-!-,'$-Q-%!UI'!$)!4-*'.'W!2)!UI'!%I4)$'!I$!6-%&)!#$gFI%&#O#.-*)!
!" '2!%#%&',-!4I'*'!'%&-(!#$-*'.I-*-,'$&'!4()&'6#*)!O('$&'!-!-,'$-Q-%!('-2'%!
L$!6'$'(-2W!.)$!2-!4()&'..#5$!18%#.-!$)!%'!%-1'!2)!UI'!%'!V-.'!JW!-0$!'%&-$*)!4()1-12','$&'!'$!2-!%'$*-!.)(('.&-W!$)!V-J!,'*#*-!*'!%#!O-2&-!)!%#!%)1(-D!7)!)1%&-$&'W!4I'*'!%'(!I$!4I$&)!*'!4-(&#g*-!0!4-(-!('O#$-(!4)%&'(#)(,'$&'D!
T-!4()&'..#5$!4)(!.-&82)6)!4I'*'!('O#$-(%'!I$!4).)!.)$%#*'(-$*)!'2!:-2)(!*'!2)%!-.&#:)%!)!.I-$&#O#g.-$*)!2-%!-,'$-Q-%D!
"-6'(#&!:'(%#5$!<! ! 3)$%'F)%!4(8.&#.)%!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!@S@!?*'!@ABC!
En base a la tipificación de los activos
]#!I%&'*!&#'$'!*-&)%!*'!.-(8.&'(!4'(%)$-2!.-2#O#.-*)%!*'!$#:'2!-2&)W!&#'$'!UI'!.#O(-(2)%D!
]#!I%&'*!&#'$'!*-&)%!.2-%#O#.-*)%!.),)!.)$O#*'$.#-2'%W!&#'$'!UI'!'&#UI'&-(2)%!J!.#O(-(2)%D!
+4-(&'!*'!.I,42#(!.)$!2-!2'6#%2-.#5$!J!$)(,-&#:-!'%4'.RO#.-W!V-1(8!22':-*)!-!.-1)!I$-!'%4'.#'!*'!j:-.I$-.#5$!4(':'$&#:-k!*'!-.&#:)%!UI'!%'6I()!UI'!%)$!#,4)(&-$&'%D!
]#!I%&'*!&#'$'!I$-!('*!2).-2!.)$'.&-*-!-2!'M&'(#)(W!&#'$'!UI'!4)$'(!I$!.)(&-OI'6)%!'$!'2!4I$&)!*'!.)$'M#5$D!
En base al valor de los activos
]#!I%&'*!&#'$'!&)*)%!2)%!*-&)%!)4'(-.#)$-2'%!'$!%)4)(&'!#$O)(,8&#.)W!&#'$'!UI'!V-.'(!.)4#-%!*'!%'g6I(#*-*D!
]#!I%&'*!&#'$'!'UI#4)%!#$O)(,8&#.)%W!,-$&;$6-2)%!-2!*R-!.)$!2-%!-.&I-2#Q-.#)$'%!*'2!O-1(#.-$&'D!
T)!UI'!:-2'!V-J!UI'!.I#*-(2)W!4)(!%#!2'!4-%-(-!-26)W!%#$!'$&(-(!'$!,I.V-%!4('.#%#)$'%!*'!UI;!2'%!4I'*'!4-%-(!'M-.&-,'$&'D!
En base a las amenazas
]#!%'! &(-&-!*'!I$!%#%&',-!*'! 2-! 22-,-*-!-*,#$#%&(-.#5$!'2'.&(5$#.-!?&(-,#&-.#5$!-*,#$#%&(-&#:-!$)!4('%'$.#-2C!)!%#!2)%!%#%&',-%!%'!I%-$!4-(-!.),'(.#-(!'2'.&(5$#.-,'$&'!?.),4(-%!J!:'$&-%!$)!4('g%'$.#-2'%CW!('6#%&('!.I#*-*)%-,'$&'!UI#;$!V-.'!UI;!'$!.-*-!,),'$&)!4I'%!%'!'$O('$&-(8!-!#$.#g*'$.#-%!.)$!2)%!I%I-(#)%W!&'$#'$*)!UI'!*'&'(,#$-(!UI#;$!&#'$'!(-Q5$!J!UI#'$!4-6-!2)%!4'(FI#.#)%D!`-,1#;$!V-1(8!UI#'$!UI#'(-!I%-(!%I%!%'(:#.#)%!%#$!&'$'(!*'('.V)!-!'22)!?O(-I*'CD!
T)!UI'!%'!4I'*'!$'.'%#&-(W!'%!$'.'%-(#)W!J!4-(&'!*'!2-%!('%4)$%-1#2#*-*'%!*'2!('%4)$%-12'!*'!%'g6I(#*-*!'%!*#%4)$'(!*'!2-!#$O)(,-.#5$!.)(('.&-!.I-$*)!V-6-!O-2&-D!
En base a las vulnerabilidades
]#!I%&'*!&#'$'!I$-!('*!*'!'UI#4)%!-$I)%!J!%'!.)$'.&-!-!H$&'($'&W!*'1'!#$%&-2-(!I$!.)(&-OI'6)%D!
]#! &#'$'!I%&'*! I$-!-42#.-.#5$! '$! 4()*I..#5$W! *'1'!,-$&'$'(2-! -2! *R-! -42#.-$*)!,'F)(-%! J! .)((#g6#'$*)!2)%!*'O'.&)%!-$I$.#-*)%!4)(!'2!O-1(#.-$&'D!
3I-$*)!%'!%-1'!UI'!2)%!%#%&',-%!*'!#$O)(,-.#5$!%)$!:I2$'(-12'%W!V-J!UI'!4()&'6'(2)%D!
5.8. Referencias !" H]EdHL3!@KKPP[<SSAW! jH$O)(,-&#)$! &'.V$)2)6J!b!]'.I(#&J! &'.V$#UI'%!b!3)*'!)O!4(-.&#.'! O)(!#$O)(,-&#)$!%'.I(#&J!,-$-6','$&kW!xI$#)!<SSAD!
!" j3(#&'(#)%!*'!%'6I(#*-*W!$)(,-2#Q-.#5$!J!.)$%'(:-.#5$!*'!2-%!-42#.-.#)$'%!I#Q-*-%!4-(-!'2!'F'(.#.#)!*'!4)&'%&-*'%kW!"+/W!<SSB!
!" 3D!+21'(&%!-$*!+D!\)()O''W!j"-$-6#$6!#$O)(,-&#)$!]'.I(#&J!Z#%r%D!`V'!E3`+_L!+44()-.VkW!+**#%)$!|'%2'JW!<SS>D!
!" 97LgH]EdHL3!@KKPP[<SS<W!j`'.$)2)6R-!*'!2-!H$O)(,-.#5$D!35*#6)!*'!fI'$-%!/(8.&#.-%!*'!2-!^'%$!*'!2-!]'6I(#*-*!*'!2-!H$O)(,-.#5$kW!<SS<D!
!" 9$#&'*!]&-&'%!^'$'(-2!+..)I$&#$6!EOO#.'W!+..)I$&#$6!-$*!H$O)(,-&#)$!"-$-6','$&!\#:#%#)$W!jH$O)(,-&#)$!]'.I(#&J!Z#%r!+%%'%%,'$&!gg!^+E!/(-.&#.'%!)O!T'-*#$6!E(6-$#Q-&#)$%D!
!" "#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%W!j"'&)*)2)6R-!*'!+$82#%#%!J!^'%$!*'!Z#'%6)%!*'!2)%!]#%&',-%!*'!H$O)(,-.#5$kW!"+/W!:'(%#5$!@DSW!@PPKD!
"-6'(#&!:'(%#5$!<! ! ^2)%-(#)!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!@S<!?*'!@ABC!
Apéndice 1. Glosario \#O'('$&'%!-I&)('%!I!)(6-$#Q-.#)$'%!*'O#$'$!2)%!,#%,)%!&;(,#$)%!*'!*#O'('$&'%!O)(,-%!J!,-$'(-%D!T-%!%#6I#'$&'%!&-12-%!('.)4#2-$!*'O#$#.#)$'%!-.)(*'%!-2!%'$&#*)!'$!'2!.I-2!%'!',42'-$!2)%!&;(,#$)%!'$!'%&-!6IR-!,'&)*)256#.-W!&-$&)!'$!'%4-c)2!.),)!'$!#$62;%D!\'!2-%!,02*'%!*'O#$#.#)$'%!%'!V-!%'2'..#)$-*)!2-!4('O'(#*-!'$!"-6'(#&!:<W!('%-2&8$*)2-!'$!$'6(#&-D!3I-$*)!2-!*'O#$#.#5$!4().'*'!*'!-26I$-! OI'$&'W!%'!.#&-!'%&-D!T-!-I%'$.#-!*'! OI'$&'! #$*#.-!UI'!'%!*'O#$#.#5$!4()4#-!*'!'%&-!6IR-D!]-2:)!(-Q)$'%!'$!.)$&(-W!%#',4('!%'!V-!4('O'(#*)!,-$&'$'(!2-!*'O#$#.#5$!4()4I'%&-!'$!"-6'(#&!:@!?@PPKCD!
1.1. Términos en español
Acreditación +..#5$!*'!O-.I2&-(!-!I$!%#%&',-!)!('*!*'!#$O)(,-.#5$!4-(-!UI'!4().'%'!*-g&)%!%'$%#12'%W!*'&'(,#$-$*)!'2!6(-*)!'$!'2!UI'!'2!*#%'c)!J!2-!,-&'(#-2#Q-g.#5$! *'! *#.V)! %#%&',-! .I,42'! 2)%! ('UI'(#,#'$&)%! *'! %'6I(#*-*! &;.$#.-!4(''%&-12'.#*)%D!p3L]H\[@PPKq!
+..('*#&-&#)$[!e)(,-2!*'.2-(-&#)$!1J!&V'!('%4)$%#12'!,-$-6','$&!-44():g#$6!&V'!)4'(-&#)$!)O!-$!-I&),-&'*!%J%&',!#$!-!4-(&#.I2-(!%'.I(#&J!,)*'!I%g#$6!-!4-(&#.I2-(!%'&!)O!%-O'6I-(*%D!+..('*#&-&#)$ #%!&V'!)OO#.#-2!-I&V)(#Q-&#)$!1J!,-$-6','$&! O)(! &V'!)4'(-&#)$!)O! &V'!%J%&',W!-$*!-..'4&-$.'!1J! &V-&!,-$-6','$&!)O!&V'!-%%).#-&'*!('%#*I-2!(#%r%D!+..('*#&-&#)$!#%!1-%'*!)$!&V'!.'(&#O#.-&#)$!4().'%%!-%!y'22!-%!)&V'(!,-$-6','$&!.)$%#*'(-&#)$%D!p@ABB>g@[<SSAq!!
Activo Recursos del sistema de información o relacionados con éste, nece-sarios para que la Organización funcione correctamente y alcance los objetivos propuestos por su dirección.
Z'.I(%)%!*'2!%#%&',-!*'!#$O)(,-.#5$!)!('2-.#)$-*)%!.)$!;%&'W!$'.'%-(#)%!4-(-!UI'! 2-!E(6-$#Q-.#5$! OI$.#)$'!.)(('.&-,'$&'!J!-2.-$.'! 2)%!)1F'&#:)%!4()4I'%&)%!4)(!%I!*#('..#5$D!p"-6'(#&[@PPKq!
f#'$'%[!L$!2-!&')(R-!*'!2)%!:-2)('%W!2-!('-2#*-*!UI'!4)%''!I$!:-2)(!4)%#&#:)!J!4)(!'22)!'%!'%&#,-12'D!p\Z+Lq!
+%%'&[!+$J&V#$6!&V-&!V-%!:-2I'!&)!&V'!)(6-$#Q-&#)$D!p@>>>Ag@[<SSBq!
+%%'&[! +! .),4)$'$&! )(! 4-(&! )O! &V'! &)&-2! %J%&',D! +%%'&%! ,-J! 1'! )O! O)I(!&J4'%[! 4VJ%#.-2W! -442#.-&#)$! %)O&y-('W! *-&-W! )(! '$*! I%'(! %'(:#.'%D!p3Z+""[<SS>q!
+%%'&[!]),'&V#$6!)O!:-2I'!&)!&V'!'$&'(4(#%'D!pE.&-:'[<SS>q!
+%%'&[!+$J!#$O)(,-&#)$!('%)I(.'!y#&V!:-2I'!&V-&!#%!y)(&V!4()&'.&#$6!)(!4('g%'(:#$6D!p`\HZ[<SS>q!
+%%'&%[! H$O)(,-&#)$!)(! ('%)I(.'%! &)!1'!4()&'.&'*!1J! &V'!.)I$&'(,'-%I('%!)O!-!`-(6'&!)O!L:-2I-&#)$D!p33[@PPPq!
AGR +$82#%#%!J!^'%$!*'!Z#'%6)%!
Amenaza Eventos que pueden desencadenar un incidente en la Organización, produciendo daños materiales o pérdidas inmateriales en sus acti-vos.
L:'$&)%!UI'!4I'*'$!*'%'$.-*'$-(!I$! #$.#*'$&'!'$! 2-!E(6-$#Q-.#5$W!4()g*I.#'$*)!*-c)%!,-&'(#-2'%!)!4;(*#*-%!#$,-&'(#-2'%!'$!%I%!-.&#:)%D!p"-6'g(#&[@PPKq!
3)$*#.#5$!*'2!'$&)($)!*'2!%#%&',-!*'!#$O)(,-.#5$!UI'W!*-*-!I$-!)4)(&I$#g*-*W 4)*(R- *-( 2I6-( - UI' %' 4()*IF'%' I$- :#)2-.#5$ *' 2- %'6I(#*-*D
"-6'(#&!:'(%#5$!<! ! ^2)%-(#)!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!@S>!?*'!@ABC!
p3L]H\[@PPKq!
`V('-&[!+!4)&'$&#-2!.-I%'!)O!-$!#$.#*'$&!yV#.V!,-J!('%I2&!#$!V-(,!&)!-!%J%g&',!)(!)(6-$#Q-&#)$D!p@KKPP[<SSAqp@>>>Ag@[<SSBq!
`V('-&[!+$J! .#(.I,%&-$.'!)(! ':'$&!y#&V! &V'! 4)&'$&#-2! &)! -*:'(%'2J! #,4-.&!-6'$.J! )4'(-&#)$%! ?#$.2I*#$6! ,#%%#)$W! OI$.&#)$%W! #,-6'W! )(! ('4I&-&#)$CW!-6'$.J!-%%'&%W!)(!#$*#:#*I-2%!&V()I6V!-$!#$O)(,-&#)$!%J%&',!:#-!I$-I&V)(g#Q'*!-..'%%W!*'%&(I.&#)$W!*#%.2)%I('W!,)*#O#.-&#)$!)O!#$O)(,-&#)$W!-$*d)(!*'g$#-2!)O!%'(:#.'D!pNSSgA>[<SSBq!
`V('-&[!+$J!.#(.I,%&-$.'!)(!':'$&!y#&V!&V'!4)&'$&#-2!&)!-*:'(%'2J!#,4-.&!-$!#$O)(,-&#)$! %J%&',! &V()I6V! I$-I&V)(#Q'*! -..'%%W! *'%&(I.&#)$W! *#%.2)%I('W!,)*#O#.-&#)$!)O!*-&-W!-$*d)(!*'$#-2!)O!%'(:#.'D!p37]][<SS>q!
`V('-&[!+$!-.&#:#&JW!*'2#1'(-&'!)(!I$#$&'$&#)$-2W!y#&V!&V'!4)&'$&#-2!O)(!.-I%#$6!V-(,!&)!-$!-I&),-&'*!#$O)(,-&#)$!%J%&',!)(!-.&#:#&JD!p`\HZ[<SS>q!
`V('-&[!+$J!.#(.I,%&-$.'!)(!':'$&!&V-&!.)I2*!V-(,!-!.(#&#.-2!-%%'&!&V()I6V!I$-I&V)(#Q'*!-..'%%W!.),4(),#%'!)O!*-&-! #$&'6(#&JW!*'$#-2!)(!*#%(I4&#)$!)O!%'(:#.'W!)(!4VJ%#.-2!*'%&(I.&#)$!)(!#,4-#(,'$&D!p3H+E[<SSSq!
+!&V('-&!#%!-$!#$*#.-&#)$!)O!-!4)&'$&#-2!I$*'%#(-12'!':'$&D!p7]`H]]H[@PPNq!
`V('-&[!+!4)&'$&#-2!:#)2-&#)$!)O!%'.I(#&JD!pKBPNg<[@PNPq!
Análisis de impacto L%&I*#)!*'!2-%!.)$%'.I'$.#-%!UI'!&'$*(R-!I$-!4-(-*-!*'!n!&#',4)!%)1('!2-!E(6-$#Q-.#5$D!!
Análisis de riesgos Proceso sistemático para estimar la magnitud de los riesgos a que está expuesta una Organización.
H*'$&#O#.-.#5$!*'! 2-%!-,'$-Q-%!UI'!-.'.V-$!-! 2)%!*#%&#$&)%!.),4)$'$&'%!4'(&'$'.#'$&'%! )! ('2-.#)$-*)%! .)$! '2! %#%&',-! *'! #$O)(,-.#5$! ?.)$).#*)%!.),)! }-.&#:)%~Ch! 4-(-! *'&'(,#$-(! 2-! :I2$'(-1#2#*-*! *'2! %#%&',-! -$&'! '%-%!-,'$-Q-%!J!4-(-!'%&#,-(!'2! #,4-.&)!)!6(-*)!*'!4'(FI#.#)!UI'!I$-!%'6I(#g*-*!#$%IO#.#'$&'!4I'*'!&'$'(!4-(-!2-!)(6-$#Q-.#5$W!)1&'$#'$*)!.#'(&)!.)$)g.#,#'$&)!*'2!(#'%6)!UI'!%'!.)(('D!p"-6'(#&[@PPKq!
Z#%r!-$-2J%#%[!]J%&',-&#.!I%'!)O!#$O)(,-&#)$!&)!#*'$&#OJ!%)I(.'%!-$*!&)!'%g&#,-&'!&V'!(#%rD!p@KKPP[<SSAqp^I#*'!K>[<SS<q!
Z#%r!-%%'%%,'$&[!/().'%%!)O!':-2I-&#$6!&V'!(#%r%!)O!#$O)(,-&#)$!2)%%!1-%'*!)$!-$!-$-2J%#%!)O! &V('-&%! &)W!-$*!:I2$'(-1#2#&#'%!)OW!-!%J%&',W!)4'(-&#)$!)(!-.&#:#&JD!pE/]L3q!
Z#%r!-$-2J%#%[!`V'!%J%&',-&#.!4().'%%!)O!'%&#,-&#$6!&V'!,-6$#&I*'!)O!(#%r%D!p@>>>Ag@[<SSBq!
Z#%r!+$-2J%#%[!LM-,#$-&#)$!)O!#$O)(,-&#)$!&)!#*'$&#OJ!&V'!(#%r!&)!-$!#$O)(,-g&#)$!%J%&',D!p37]][<SS>q!
Z#%r!+%%'%%,'$&[[!/().'%%!)O!-$-2JQ#$6!&V('-&%!&)!-$*!:I2$'(-1#2#&#'%!)O!-$!#$O)(,-&#)$!%J%&',W!-$*! &V'!4)&'$&#-2! #,4-.&! ('%I2&#$6! O(),!&V'! 2)%%!)O! #$gO)(,-&#)$!)(!.-4-1#2#&#'%!)O!-!%J%&',D!`V#%!-$-2J%#%! #%!I%'*!-%!-!1-%#%! O)(!#*'$&#OJ#$6! -44()4(#-&'! -$*! .)%&g'OO'.&#:'! %'.I(#&J! .)I$&'(,'-%I('%D!p37]][<SS>q!
Z#%r!+$-2J%#%[!+$!-$-2J%#%!)O!%J%&',!-%%'&%!-$*!:I2$'(-1#2#&#'%!&)!'%&-12#%V!-$!'M4'.&'*! 2)%%! O(),!.'(&-#$!':'$&%!1-%'*!)$!'%&#,-&'*!4()1-1#2#&#'%!)O!)..I(('$.'D!p`\HZ[<SS>q!
Z#%r!+%%'%%,'$&[!+!%&I*J!)O!:I2$'(-1#2#&#'%W!&V('-&%W!2#r'2#V))*W!2)%%!)(!#,g4-.&W! -$*! &V')('&#.-2! 'OO'.&#:'$'%%! )O! %'.I(#&J!,'-%I('%D! `V'! 4().'%%! )O!':-2I-&#$6!&V('-&%!-$*!:I2$'(-1#2#&#'%W!r$)y$!-$*!4)%&I2-&'*W!&)!*'&'(,#$'!'M4'.&'* 2)%% -$* '%&-12#%V &V' *'6('' )O -..'4&-1#2#&J &) %J%&', )4'(-g
"-6'(#&!:'(%#5$!<! ! ^2)%-(#)!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!@SB!?*'!@ABC!
&#)$%D!p`\HZ[<SS>q!
Ataque 3I-2UI#'(!-..#5$!*'2#1'(-*-!'$.-,#$-*-!-!:#)2-(!2)%!,'.-$#%,)%!*'!%'6Ig(#*-*!*'!I$!%#%&',-!*'!#$O)(,-.#5$D!p3L]H\[@PPKq!
Auditoría de segu-ridad
L%&I*#)!J!'M-,'$!#$*'4'$*#'$&'!*'2!V#%&)(#-2!J!-.&#:#*-*'%!*'!I$!%#%&',-!*'!#$O)(,-.#5$W!.)$!2-!O#$-2#*-*!*'!.),4()1-(!2-!#*)$'#*-*!*'!2)%!.)$&()2'%!*'2! %#%&',-W! -%'6I(-(! %I! .)$O)(,#*-*! .)$! 2-! '%&(I.&I(-! *'! %'6I(#*-* J!4().'*#,#'$&)%! )4'(-&#:)%! '%&-12'.#*)%W! -! O#$! *'! *'&'.&-(! 1('.V-%! '$! 2-!%'6I(#*-*! J! ('.),'$*-(! .-,1#)%! '$! 2)%! 4().'*#,#'$&)%W! .)$&()2'%! J! '%g&(I.&I(-%!*'!%'6I(#*-*D!
Autenticidad Aseguramiento de la identidad u origen.
+I&'$&#.-.#5$[!3-(-.&'(R%&#.-!*'!*-(!J!('.)$).'(!2-!-I&'$&#.#*-*!*'!2)%!-.g&#:)%!*'2!*),#$#)!?*'!)!#$O)(,-.#5$C!Jd)!2-!#*'$&#*-*!*'!2)%!-.&)('%!Jd)!2-!-I&)(#Q-.#5$!4)(!4-(&'!*'!2)%!-I&)(#Q-*)('%W!-%R!.),)!2-!:'(#O#.-.#5$!*'!*#g.V-%!&('%!.I'%&#)$'%D!p"-6'(#&[@PPKq!
+I&V'$&#.#&J[!i-:#$6!-$!I$*#%4I&'*!#*'$&#&J!)(!)(#6#$D!pE/]L3q!
+I&V'$&#.#&J[!`V'!4()4'(&J!)O! 1'#$6!6'$I#$'!-$*!1'#$6!-12'! &)!1'!:'(#O#'*!-$*! &(I%&'*h! .)$O#*'$.'! #$! &V'! :-2#*#&J! )O! -! &(-$%,#%%#)$W! -! ,'%%-6'W! )(!,'%%-6'!)(#6#$-&)(D!pNSSgA>[<SSBq!
+I&V'$&#.#&J[!`V'!4()4'(&J!&V-&!'$%I('%!&V-&!&V'!#*'$&#&J!)O!-!%I1F'.&!)(!('g%)I(.'! #%! &V'!)$'! .2-#,'*D!+I&V'$&#.#&J! -442#'%! &)! '$&#&#'%! %I.V!-%!I%'(%W!4().'%%'%W!%J%&',%W!-$*!#$O)(,-&#)$D!p@>>>Ag@[<SSBq!
Certificación 3)$O#(,-.#5$!*'2! ('%I2&-*)!*'!I$-!':-2I-.#5$W!J!UI'! 2)%!.(#&'(#)%!*'!':-g2I-.#5$!I#Q-*)%!OI'()$!.)(('.&-,'$&'!-42#.-*)%D!
Confidencialidad Aseguramiento de que la información es accesible sólo para aquellos autorizados a tener acceso.
+%'6I(-,#'$&)!*'!UI'!2-!#$O)(,-.#5$!'%!-..'%#12'!%52)!4-(-!-UI'22)%!-I&)g(#Q-*)%!-!&'$'(!-..'%)D!p@KKPP[<SS<q!
3-(-.&'(R%&#.-!UI'!4(':#'$'!.)$&(-!2-!*#:I26-.#5$!$)!-I&)(#Q-*-!*'!-.&#:)%!*'2!*),#$#)D!p"-6'(#&[@PPKq!
3)$O#*'$&#-2#&J[!+$!-%%I(-$.'!&V-&!#$O)(,-&#)$!#%!$)&!*#%.2)%'*!&)!I$-I&V)(g#Q'*!'$&#&#'%!)(!4().'%%'%!?\E\!x/!@PPBh!x3]!@PPKC!pE/]L3q!
3)$O#*'$&#-2#&J[! /('%'(:#$6! -I&V)(#Q'*! ('%&(#.&#)$%! )$! #$O)(,-&#)$! -..'%%!-$*! *#%.2)%I('W! #$.2I*#$6!,'-$%! O)(! 4()&'.&#$6! 4'(%)$-2! 4(#:-.J! -$*! 4()g4(#'&-(J!#$O)(,-&#)$D!pNSSgA>[<SSBq!
3)$O#*'$&#-2#&J[! `V'! ('UI#(','$&! )O! r''4#$6! 4()4(#'&-(JW! %'$%#&#:'W! )(! 4'(g%)$-2!#$O)(,-&#)$!4(#:-&'!-$*!#$-..'%%#12'!&)!-$J)$'!&V-&!#%!$)&!-I&V)(#Q'*!&)!%''!#&D!pE.&-:'[<SS>q!
3)$O#*'$&#-2#&J[!+%%I(-$.'!&V-&!#$O)(,-&#)$!#%!$)&!*#%.2)%'*!&)!I$-I&V)(#Q'*!4'(%)$%W!4().'%%'%W!)(!*':#.'%D!p37]][<SS>q!p`\HZ[<SS>q!
3)$O#*'$&#-2#&J[!`V'!4()4'(&J!&V-&! #$O)(,-&#)$! #%!$)&!,-*'!-:-#2-12'!)(!*#%g.2)%'*!&)!I$-I&V)(#Q'*!#$*#:#*I-2%W!'$&#&#'%W!)(!4().'%%'%D!pKBPNg<[@PNPq!
Contra medida _;-%'!%-2:-6I-(*-D!
Control _;-%'!%-2:-6I-(*-D!
Degradación /;(*#*-!*'!:-2)(!*'!I$!-.&#:)!.),)!.)$%'.I'$.#-!*'!2-!,-&'(#-2#Q-.#5$!*'!I$-!-,'$-Q-D!
Dimensión (de seguridad) Un aspecto, diferenciado de otros posibles aspectos, respecto del que se puede medir el valor de un activo en el sentido del perjuicio que causaría su pérdida de valor.
"-6'(#&!:'(%#5$!<! ! ^2)%-(#)!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!@SA!?*'!@ABC!
Disponibilidad Aseguramiento de que los usuarios autorizados tienen acceso cuan-do lo requieran a la información y sus activos asociados.
+%'6I(-,#'$&)!*'!UI'! 2)%!I%I-(#)%!-I&)(#Q-*)%! &#'$'$!-..'%)!.I-$*)! 2)!('UI#'(-$!-!2-!#$O)(,-.#5$!J!%I%!-.&#:)%!-%).#-*)%D!p@KKPP[<SS<q!
3-(-.&'(R%&#.-!UI' 4(':#'$'!.)$&(-!2-!*'$'6-.#5$!$)!-I&)(#Q-*-!*'!-..'%)!-!-.&#:)%!*'2!*),#$#)D!p"-6'(#&[@PPKq!
+:-#2-1#2#&J[! `V'! -%%I(-$.'! &V-&! *-&-! &(-$%,#%%#)$%W! .),4I&'(! 4().'%%#$6!%J%&',%W!-$*d)(!.),,I$#.-&#)$%!-('!$)&!*'$#'*!&)! &V)%'!yV)!-('!-I&V)(g#Q'*!&)!I%'!&V',!?x3]!@PPKC!pE/]L3q!
+:-#2-1#2#&J[!L$%I(#$6!&#,'2J!-$*!('2#-12'!-..'%%!&)!-$*!I%'!)O!#$O)(,-&#)$D!pNSSgA>[<SSBq!
+:-#2-1#2#&J[!`V'!'M&'$*! &)!yV#.VW!)(! O('UI'$.J!y#&V!yV#.VW!-$!-%%'&!,I%&!1'!4('%'$&!)(!('-*J!O)(!I%'D!pE.&-:'[<SS>q!
+:-#2-1#2#&J[!`#,'2JW!('2#-12'!-..'%%!&)!*-&-!-$*!#$O)(,-&#)$!%'(:#.'%!O)(!-Ig&V)(#Q'*!I%'(%D!p37]][<SS>q!p`\HZ[<SS>q!p3H+E[<SSSq!
+:-#2-1#2#&J[!`V'!4()4'(&J!)O!1'#$6!-..'%%#12'!-$*!I%-12'!I4)$!*',-$*!1J!-$!-I&V)(#Q'*!'$&#&JD!pKBPNg<[@PNPq!
Documento de selección de controles
\).I,'$&)!O)(,-2!'$!'2!UI'W!4-(-!I$!.)$FI$&)!*'!%-2:-6I-(*-%W!%'!#$*#.-!%#$!%)$!*'!-42#.-.#5$!'$!'2!%#%&',-!*'!#$O)(,-.#5$!1-F)!'%&I*#)!)!%#W!4)(!'2!.)$&(-(#)W!.-('.'$!*'!%'$&#*)D!
Estado de riesgo Informe: Caracterización de los activos por su riesgo residual; es de-cir lo que puede pasar tomando en consideración las salvaguardas desplegadas.
Evaluación de salvaguardas
Informe: Evaluación de la eficacia de las salvaguardas existentes en relación al riesgo que afrontan.
Frecuencia Tasa de ocurrencia de una amenaza.
Gestión de riesgos Selección e implantación de salvaguardas para conocer, prevenir, impedir, reducir o controlar los riesgos identificados.
]'2'..#5$! '! #,42-$&-.#5$! *'! 2-%! ,'*#*-%! )! }%-2:-6I-(*-%~! *'! %'6I(#*-*!-*'.I-*-%!4-(-!.)$).'(W!4(':'$#(W!#,4'*#(W!('*I.#(!)!.)$&()2-(!2)%!(#'%6)%!#*'$&#O#.-*)%!J!-%R!('*I.#(!-2!,R$#,)!%I!4)&'$.#-2#*-*!)!%I%!4)%#12'%!4'(FI#g.#)%D!T-!6'%$!*'!(#'%6)%!%'!1-%-!'$!2)%!('%I2&-*)%!)1&'$#*)%!'$!'2!-$8g2#%#%!*'!2)%!(#'%6)%D!p"-6'(#&[@PPKq!
Z#%r! &('-&,'$&[! 4().'%%! )O! %'2'.&#)$! -$*! #,42','$&-&#)$! )O! ,'-%I('%! &)!,)*#OJ!(#%rD!p@KKPP[<SSAqp@>>>Ag@[<SSBqp^I#*'!K>[<SS<q!
Z#%r!,-$-6','$&[! +! %'.I(#&J! 4V#2)%)4VJ!yV#.V! .)$%#*'(%! -.&I-2! &V('-&%W!#$V'('$&!:I2$'(-1#2#&#'%W!-$*! &V'!-:-#2-1#2#&J!-$*!.)%&%!)O!.)I$&'(,'-%I('%!-%! &V'!I$*'(2J#$6!1-%#%! O)(!,-r#$6!%'.I(#&J!*'.#%#)$%! ?x]3Z!@PPBCD! pE/g]L3q!
Z#%r!,-$-6','$&[! /().'%%! )O! #*'$&#OJ#$6! -$*! -442J#$6! .)I$&'(,'-%I('%!.),,'$%I(-&'!y#&V! &V'!:-2I'!)O! &V'!-%%'&%!4()&'.&'*!1-%'*!)$!-!(#%r!-%g%'%%,'$&D!p37]][<SS>q!
`V'! #*'$&#O#.-&#)$W! -%%'%%,'$&W! -$*! ,#-&#)$! )O! 4()1-1#2#%&#.! %'.I(#&J!':'$&%! ?(#%r%C! #$! #$O)(,-&#)$! %J%&',%! &)! -! 2':'2! .),,'$%I(-&'! y#&V! &V'!:-2I'!)O!&V'!-%%'&%!4()&'.&'*D!p3H+E[<SSSq!
Impacto Consecuencia que sobre un activo tiene la materialización de una amenaza.
3)$%'.I'$.#- UI' %)1(' I$ -.&#:) &#'$' 2- ,-&'(#-2#Q-.#5$ *' I$- -,'$-g
"-6'(#&!:'(%#5$!<! ! ^2)%-(#)!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!@SG!?*'!@ABC!
Q-D!p"-6'(#&[@PPKq!
H,4-.&[!`V'!('%I2&!)O!-$!#$O)(,-&#)$!%'.I(#&J!#$.#*'$&D!p@>>>Ag@[<SSBq!
H,4-.&[!`V'!'OO'.&! )O! -! &V('-&! )$!-$!)(6-$#Q-&#)$�%!,#%%#)$!-$*!1I%#$'%%!)1F'.&#:'%D!pE.&-:'[<SS>q!
H,4-.&[! `V'! 'OO'.&! )$! &V'! )(6-$#%-&#)$! )O! -! 1('-.V! #$! %'.I(#&JD!p3Z+""[<SS>q!
Impacto residual Impacto remanente en el sistema tras la implantación de las salva-guardas determinadas en el plan de seguridad de la información.
Incidente Evento con consecuencias en detrimento de la seguridad del sistema de información.
H$O)(,-&#)$!%'.I(#&J!':'$&[!+$!#*'$&#O#'*!)..I(('$.'!)O!-!%J%&',W!%'(:#.'!)(!$'&y)(r!%&-&'!#$*#.-&#$6!-!4)%%#12'!1('-.V!)O!#$O)(,-&#)$!%'.I(#&J!4)2#.J!)(!O-#2I('!)O!%-O'6I-(*%W!)(!-!4(':#)I%2J!I$r$)y$!%#&I-&#)$!&V-&!,-J!1'!%'.Ig(#&J!('2':-$&D!p@KKPP[<SSAq!
H$O)(,-&#)$! %'.I(#&J! #$.#*'$&[! +$J! I$'M4'.&'*! )(! I$y-$&'*! ':'$&! &V-&!,#6V&! .-I%'! -! .),4(),#%'! )O! 1I%#$'%%! -.&#:#&#'%! )(! #$O)(,-&#)$! %'.I(#&JD!p@>>>Ag@[<SSBq!
H$.#*'$&[! +! %I..'%%OI2! )(! I$%I..'%%OI2! -.&#)$! -&&',4&#$6! &)! .#(.I,:'$&!&'.V$#.-2!.)$&()2%W!)(6-$#Q-&#)$-2!4)2#.JW!)(! 2-yD!`V#%! #%!)O&'$!.-22'*!-$!-&g&-.rD!p`\HZ[<SS>q!
Informe de insuficiencias
Informe: Ausencia o debilidad de las salvaguardas que aparecen co-mo oportunas para reducir el riesgo sobre el sistema.
Integridad Garantía de la exactitud y completitud de la información y los méto-dos de su procesamiento.
^-(-$&R-!*'!2-!'M-.&#&I*!J!.),42'&#&I*!*'!2-!#$O)(,-.#5$!J!2)%!,;&)*)%!*'!%I!4().'%-,#'$&)D!p@KKPP[<SS<q!
3-(-.&'(R%&#.-!UI'!4(':#'$'!.)$&(-!2-!,)*#O#.-.#5$!)!*'%&(I..#5$!$)!-I&)(#gQ-*-%!*'!-.&#:)%!*'2!*),#$#)D!p"-6'(#&[@PPKq!
H$O)(,-&#)$! #$&'6(#&J[!`V'!%&-&'! &V-&!'M#%&%!yV'$! #$O)(,-&#)$! #%!I$.V-$6'*!O(),!#&%!%)I(.'!-$*!V-%!$)&!1''$!-..#*'$&-22J!)(!#$&'$&#)$-22J!,)*#O#'*W!-2g&'('*W!)(!*'%&()J'*!?7]3!LE!@PPAh!x3]!@PPKCD!!pE/]L3q!
H$&'6(#&J[! ^I-(*#$6! -6-#$%&! #,4()4'(! #$O)(,-&#)$! ,)*#O#.-&#)$! )(! *'%&(I.g&#)$W! -$*! #$.2I*'%! '$%I(#$6! #$O)(,-&#)$! $)$g('4I*#-&#)$! -$*! -I&V'$&#.#&JD!pNSSgA>[<SSBq!
H$&'6(#&J[! &V'! 4()4'(&J! )O! %-O'6I-(*#$6! &V'!-..I(-.J!-$*! .),42'&'$'%%!)O!-%%'&%D!p@>>>Ag@[<SSBq!
H$&'6(#&J[! &V'! -I&V'$&#.#&JW! -..I(-.JW! -$*! .),42'&'$'%%! )O! -$! -%%'&D! pE.g&-:'[<SS>q!
\-&-!#$&'6(#&J[!+!.)$*#&#)$!'M#%&#$6!yV'$!*-&-!#%!I$.V-$6'*!O(),!#&%!%)I(.'!-$*! V-%! $)&! 1''$! -..#*'$&-22J! )(! ,-2#.#)I%2J! ,)*#O#'*W! -2&'('*W! )(! *'g%&()J'*D!p37]][<SS>q!p`\HZ[<SS>q!p3H+E[<SSSq!
\-&-! #$&'6(#&J[! `V'! *-&-! UI-2#&J! &V-&! 'M#%&%! -%! 2)$6!-%! -..#*'$&-2! )(!,-2#g.#)I%!*'%&(I.&#)$W!-2&'(-&#)$W!)(!2)%%!)O!*-&-!*)'%!$)&!)..I(D!p3Z+""[<SS>q
H$&'6(#&J[!3)$*#&#)$!'M#%&#$6!yV'$!-$! #$O)(,-&#)$!%J%&',!)4'(-&'%!y#&V)I&!I$-I&V)(#Q'*!,)*#O#.-&#)$W!-2&'(-&#)$W! #,4-#(,'$&W!)(!*'%&(I.&#)$!)O!-$J!)O!#&%!.),4)$'$&%D!p3H+E[<SSSq!
Mapa de riesgos Informe: Relación de las amenazas a que están expuestos los acti-
"-6'(#&!:'(%#5$!<! ! ^2)%-(#)!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!@SK!?*'!@ABC!
vos.
`V('-&!+$-2J%#%[!`V'!'M-,#$-&#)$!)O!-22!-.&#)$%!-$*!':'$&%! &V-&!,#6V&!-*g:'(%'2J!-OO'.&!-!%J%&',!)(!)4'(-&#)$D!p`\HZ[<SS>q!
`V('-&! +%%'%%,'$&[! +$! ':-2I-&#)$! )O! &V'! $-&I('W! 2#r'2#V))*W! -$*! .)$%'gUI'$.'!)O!-.&%!)(!':'$&%!&V-&!.)I2*!42-.'!%'$%#&#:'!#$O)(,-&#)$!-$*!-%%'&%!-%!(#%rD!p`\HZ[<SS>q!
Modelo de valor Informe: Caracterización del valor que representan los activos para la Organización así como de las dependencias entre los diferentes acti-vos.
Plan de seguridad Conjunto de programas de seguridad que permiten materializar las decisiones de gestión de riesgos.
Programa de seguridad
Agrupación de tareas orientadas a afrontar el riesgo del sistema. La agrupación se realiza por conveniencia, bien porque se trata de ta-reas que en singular carecerían de eficacia, bien porque se trata de tareas con un objetivo común, bien porque se trata de tareas que competen a una única unidad de acción.
Proyecto de seguridad
Programa de seguridad cuya envergadura es tal que requiere una planificación específica.
Riesgo Estimación del grado de exposición a que una amenaza se materiali-ce sobre uno o más activos causando daños o perjuicios a la Organi-zación.
/)%#1#2#*-*!*'!UI'!%'!4()*IQ.-!I$! #,4-.&)!*'&'(,#$-*)!'$!I$!-.&#:)W!'$!I$!*),#$#)!)!'$!&)*-!2-!E(6-$#Q-.#5$D!p"-6'(#&[@PPKq!
/()1-1#2#*-*!*'!UI'!I$-!:I2$'(-1#2#*-*!4()4#-!*'!I$!%#%&',-!*'! #$O)(,-g.#5$!%'-!'M42)&-*-!4)(! 2-%!-,'$-Q-%!-!*#.V)!%#%&',-W!.)$!'2!)1F'&#:)!*'!4'$'&(-(2)D!p3L]H\[@PPKq!
Z#%r[! .),1#$-&#)$! )O! &V'! 4()1-1#2#&J! )O! -$! ':'$&! -$*! #&%! .)$%'UI'$.'D!p@KKPP[<SSAqp^I#*'!K>[<SS<q!
Z#%r[!+!,'-%I('!)O! &V'!4)&'$&#-2!*'6(''! &)!yV#.V!4()&'.&'*! #$O)(,-&#)$! #%!%I1F'.&!&)!2)%%!&V()I6V!-*:'(%-(J!'M42)#&-&#)$D!pE/]L3q!
Z#%r[!&V'!4)&'$&#-2!&V-&!-!6#:'$!&V('-&!y#22!'M42)#&!:I2$'(-1#2#&#'%!)O!-$!-%%'&!)(! 6()I4! )O! -%%'&%! -$*! &V'('1J! .-I%'! V-(,! &)! &V'! )(6-$#Q-&#)$D! p@>>>Ag@[<SSBq!
Z#%r[!/)%%#1#2#&J!&V-&!-!4-(&#.I2-(!&V('-&!y#22!-*:'(%'2J!#,4-.&!-$!#$O)(,-&#)$!%J%&',!1J!'M42)#&#$6!-!4-(&#.I2-(!:I2$'(-1#2#&JD!!p37]][<SS>q!
Z#%r[!+!.),1#$-&#)$!)O!&V'!2#r'2#V))*!&V-&!-!&V('-&!y#22!)..I(W!&V'!2#r'2#V))*!&V-&!-!&V('-&!)..I(('$.'!y#22!('%I2&!#$!-$!-*:'(%'!#,4-.&W!-$*!&V'!%':'(#&J!)O!&V'!('%I2&#$6!-*:'(%'!#,4-.&D!Z'*I.#$6!'#&V'(!&V'!&V('-&!)(!&V'!:I2$'(-1#2#&J!('*I.'%!&V'!(#%rD!p`\HZ[<SS>q!
`)&-2!(#%r[!`V'!4)&'$&#-2! O)(! &V'!)..I(('$.'!)O!-$!-*:'(%'!':'$&! #O!$)!,#&#g6-&#$6!-.&#)$!#%!&-r'$!?#D'DW!&V'!4)&'$&#-2!O)(!-$J!-442#.-12'!&V('-&!&)!'M42)#&!-!%J%&',!:I2$'(-1#2#&JCD!p`\HZ[<SS>q!
Z#%r[! +!,'-%I('! )O! &V'! 'M4)%I('! &)!yV#.V! -! %J%&',! )(! 4)&'$&#-2! %J%&',!,-J!1'!%I1F'.&'*D!p3Z+""[<SS>q!
Riesgo residual Riesgo remanente en el sistema tras la implantación de las salva-guardas determinadas en el plan de seguridad de la información.
Z#'%6)!UI'!%'!*-!&(-%!2-!-42#.-.#5$!*'!%-2:-6I-(*-%!*#%4I'%&-%!'$!I$!'%g.'$-(#)!*'!%#,I2-.#5$!)!'$!'2!,I$*)!('-2D!p"-6'(#&[@PPKq!
"-6'(#&!:'(%#5$!<! ! ^2)%-(#)!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!@SN!?*'!@ABC!
Z'%#*I-2!(#%r[!`V'!(#%r!&V-&!(',-#$%!-O&'(!(#%r!&('-&,'$&D!p@>>>Ag@[<SSBq!
Z'%#*I-2!(#%r[!/)(&#)$!)O!(#%r!(',-#$#$6!-O&'(!%'.I(#&J!,'-%I('%!V-:'!1''$!-442#'*D!p37]][<SS>q!p3Z+""[<SS>q!
Z'%#*I-2!Z#%r[!`V'!4)&'$&#-2! O)(! &V'!)..I(('$.'!)O!-$!-*:'(%'!':'$&!-O&'(!-*FI%&#$6!O)(!&V'!#,4-.&!)O!-22!#$g42-.'!%-O'6I-(*%D!p`\HZ[<SS>q!
Riesgo acumulado \R.'%'!*'2!.-2.I2-*)!&),-$*)!'$!.)$%#*'(-.#5$!'2!:-2)(!4()4#)!*'!I$!-.&#g:)!J!'2!:-2)(!*'!2)%!-.&#:)%!UI'!*'4'$*'!*'!;2D!L%&'!:-2)(!%'!.),1#$-!.)$!2-!*'6(-*-.#5$!.-I%-*-!4)(!I$-!-,'$-Q-!J! 2-! O('.I'$.#-!'%&#,-*-!*'! 2-!,#%,-D!
Riesgo repercutido \R.'%'!*'2!.-2.I2-*)!&),-$*)!'$!.)$%#*'(-.#5$!0$#.-,'$&'!'2!:-2)(!4()4#)!*'!I$!-.&#:)D!L%&'!:-2)(!%'!.),1#$-!.)$!2-!*'6(-*-.#5$!.-I%-*-!4)(!I$-!-,'$-Q-!J!2-!O('.I'$.#-!'%&#,-*-!*'!2-!,#%,-W!,'*#*-%!-,1-%!%)1('!-.g&#:)%!*'!2)%!UI'!*'4'$*'D!
Salvaguarda Procedimiento o mecanismo tecnológico que reduce el riesgo.
3)$&()2[! "'-$%! )O! ,-$-6#$6! (#%r%W! #$.2I*#$6! 4)2#.#'%W! 4().'*I('%W! 6I#*'g2#$'%W!4(-.&#.'%!)(!)(6-$#Q-&#)$-2!%&(I.&I('%W!yV#.V!.-$!1'!)O!-*,#$#%&(-&#:'W!&'.V$#.-2W!,-$-6','$&!)(!2'6-2!$-&I('D!p@KKPP[<SSAq!
3)I$&'(,'-%I('[! +$J&V#$6! yV#.V! 'OO'.&#:'2J! $'6-&'%! )(! ,#-&'%! -$! -*g:'(%-(J�%!-1#2#&J!&)!'M42)#&!:I2$'(-1#2#&#'%D!pE/]L3q!
]-O'6I-(*[! /()&'.&#:'!,'-%I('%! 4('%.(#1'*! &)!,''&! &V'! %'.I(#&J! ('UI#('g,'$&%!?#D'DW!.)$O#*'$&#-2#&JW! #$&'6(#&JW!-$*!-:-#2-1#2#&JC!%4'.#O#'*! O)(!-$! #$O)(g,-&#)$! %J%&',D! ]-O'6I-(*%! ,-J! #$.2I*'! %'.I(#&J! O'-&I('%W! ,-$-6','$&!.)$%&(-#$&%W!4'(%)$$'2!%'.I(#&JW!-$*!%'.I(#&J!)O!4VJ%#.-2!%&(I.&I('%W!-('-%W!-$*!*':#.'%D!pNSSgA>[<SSBq!
]-O'6I-(*[! -! 4(-.&#.'W! 4().'*I('! )(! ,'.V-$#%,! &V-&! &('-&%! (#%rD! p@>>>Ag@[<SSBq!
3)I$&'(,'-%I('[!+.&#)$W! *':#.'W! 4().'*I('W! &'.V$#UI'W! )(! )&V'(!,'-%I('!&V-&!('*I.'%!&V'!:I2$'(-1#2#&J!)O!-$!#$O)(,-&#)$!%J%&',D!p37]][<SS>q!
]'.I(#&J! %-O'6I-(*[!/()&'.&#:'!,'-%I('%!-$*!.)$&()2%!4('%.(#1'*! &)!,''&!&V'!%'.I(#&J!('UI#(','$&%!%4'.#O#'*!O)( -$!#$O)(,-&#)$!%J%&',D!]-O'6I-(*%!,-J! #$.2I*'! %'.I(#&J! O'-&I('%W!,-$-6','$&! .)$%&(-#$&%W! 4'(%)$$'2! %'.Ig(#&JW!-$*!%'.I(#&J!)O!4VJ%#.-2!%&(I.&I('%W!-('-%W!-$*!*':#.'%D!p37]][<SS>q!
3)I$&'(,'-%I('[! +$J! -.&#)$W! *':#.'W! 4().'*I('W! &'.V$#UI'W! )(! )&V'(!,'-%I('!&V-&!,#-&'%!(#%r!1J!('*I.#$6!&V'!:I2$'(-1#2#&J!)OW!&V('-&!&)W!)(!#,g4-.&!)$!-!%J%&',D!p`\HZ[<SS>q!
Seguridad La capacidad de las redes o de los sistemas de información de resis-tir, con un determinado nivel de confianza, los accidentes o acciones ilícitas o malintencionadas que comprometan la disponibilidad, au-tenticidad, integridad y confidencialidad de los datos almacenados o transmitidos y de los servicios que dichas redes y sistemas ofrecen o hacen accesibles.
H$O)(,-&#)$! ]J%&',! ]'.I(#&J[! /()&'.&#)$! )O! #$O)(,-&#)$! %J%&',%! -6-#$%&!I$-I&V)(#Q'*!-..'%%!&)!)(!,)*#O#.-&#)$!)O! #$O)(,-&#)$W!yV'&V'(! #$!%&)(-6'W!4().'%%#$6!)(!&(-$%#&W!-$*!-6-#$%&!&V'!*'$#-2!)O!%'(:#.'!&)!-I&V)(#Q'*!I%'(%W!#$.2I*#$6! &V)%'! ,'-%I('%! $'.'%%-(J! &)! *'&'.&W! *).I,'$&W! -$*! .)I$&'(!%I.V!&V('-&%D!p37]][<SS>q!
Sistema de infor-mación
Los ordenadores y redes de comunicaciones electrónicas, así como los datos electrónicos almacenados, procesados, recuperados o transmitidos por los mismos para su operación, uso, protección y
"-6'(#&!:'(%#5$!<! ! ^2)%-(#)!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!@SP!?*'!@ABC!
mantenimiento.
3)$FI$&)!*'!'2','$&)%!OR%#.)%W!256#.)%W!'2','$&)%!*'!.),I$#.-.#5$W!*-&)%!J!4'(%)$-2!UI'!4'(,#&'$!'2!-2,-.'$-,#'$&)W! &(-$%,#%#5$!J!4().'%)!*'! 2-!#$O)(,-.#5$D!p"-6'(#&[@PPKq!
3I-2UI#'(!%#%&',-!)!4()*I.&)!*'%&#$-*)!-!-2,-.'$-(W!4().'%-(!)!&(-$%,#&#(!#$O)(,-.#5$D!p3L]H\[@PPKq!
H$O)(,-&#)$!]J%&',[!]'&!)O!#$O)(,-&#)$!('%)I(.'%!)(6-$#Q'*!O)(!&V'!.)22'.g&#)$W!%&)(-6'W!4().'%%#$6W!,-#$&'$-$.'W!I%'W!%V-(#$6W!*#%%',#$-&#)$W!*#%4)g%#&#)$W!*#%42-JW!)(!&(-$%,#%%#)$!)O!#$O)(,-&#)$D!p37]][<SS>q!
H$O)(,-&#)$!]J%&',[!+$J!4().'*I('!)(!4().'%%W!y#&V!)(!y#&V)I&!H`!%I44)(&W!&V-&! 4():#*'%!-!y-J!)O! -.UI#(#$6W! %&)(#$6W!4().'%%#$6!)(!*#%%',#$-&#$6! #$gO)(,-&#)$D! H$O)(,-&#)$! %J%&',%! #$.2I*'! -442#.-&#)$%! -$*! &V'#(! %I44)(&#$6!#$O(-%&(I.&I('D!p3Z+""[<SS>q!
Trazabilidad Aseguramiento de que en todo momento se podrá determinar quién hizo qué y en qué momento.
Z'%4)$%-1#2#*-*[!3I-2#*-*!UI'!4'(,#&'!UI'!&)*-%!2-%!-..#)$'%!('-2#Q-*-%!%)1('!I$!%#%&',-!*'!&'.$)2)6R-!*'!2-!#$O)(,-.#5$!%'-$!-%).#-*-%!*'!,)*)!#$'UIR:).)!-!I$!#$*#:#*I)!)!'$&#*-*D!p3L]H\[@PPKq!
+..)I$&-1#2#&J[!`V'!4()4'(&J!&V-&!'$%I('%!&V-&!&V'!-.&#)$%!)O!-$!'$&#&J!,-J!1'!&(-.'*!I$#UI'2J!&)!&V'!'$&#&JD!p@>>>Ag@[<SSBq!
+..)I$&-1#2#&J[!/().'%%!)O!&(-.#$6!#$O)(,-&#)$!%J%&',!-.&#:#&#'%!&)!-!('%4)$g%#12'!%)I(.'D!p37]][<SS>q!
Valor De un activo. Es una estimación del coste inducido por la materiali-zación de una amenaza.
3I-2#*-*!UI'!4)%''$!-26I$-%!('-2#*-*'%W!.)$%#*'(-*-%!1#'$'%W!4)(!2)!.I-2!%)$!'%&#,-12'%D!p\Z+Lq!
Valor acumulado Considera tanto el valor propio de un activo como el valor de los ac-tivos que dependen de él.
f#'$'%!*'!-1)2'$6)[!T)%!V'('*-*)%!*'!2)%!-1I'2)%D!p\Z+Lq!
Vulnerabilidad Estimación de la exposición efectiva de un activo a una amenaza. Se determina por dos medidas: frecuencia de ocurrencia y degradación causada.
_I2$'(-1#2#*-*!*'!I$!-.&#:)!'%!2-!4)&'$.#-2#*-*!)!4)%#1#2#*-*!*'!).I(('$.#-!*'!2-!,-&'(#-2#Q-.#5$!*'!I$-!-,'$-Q-!%)1('!*#.V)!-.&#:)D!p"-6'(#&[@PPKq!
\'1#2#*-*!'$!2-!%'6I(#*-*!*'!I$!%#%&',-!*'!#$O)(,-.#5$D!p3L]H\[@PPKq!
_I2$'(-1#2#&J[!+!y'-r$'%%!)O!-$!-%%'&!)(!6()I4!)O!-%%'&%! &V-&!.-$!1'!'Mg42)#&'*!1J!)$'!)(!,)('!&V('-&%D!p@KKPP[<SSAqp@>>>Ag@[<SSBq!
_I2$'(-1#2#&J[!`V'!%I%.'4#2#&J!)O! #$O)(,-&#)$! &)!'M42)#&-&#)$!1J!-$!-*:'(g%-(JD!pE/]L3q!
_I2$'(-1#2#&J[!|'-r$'%%! #$!-$! #$O)(,-&#)$!%J%&',W!%J%&',!%'.I(#&J!4().'g*I('%W! #$&'($-2! .)$&()2%W! )(! #,42','$&-&#)$! &V-&! .)I2*! 1'! 'M42)#&'*D!p37]][<SS>q!
_I2$'(-1#2#&J[!+!y'-r$'%%!)(!2-.r!)O!.)$&()2%!&V-&!y)I2*!-22)y!)(!O-.#2#&-&'!-!&V('-&!-.&I-&#)$!-6-#$%&!-!%4'.#O#.!-%%'&!)(!&-(6'&D!p3Z+""[<SS>q!
1.2. Términos anglosajones f(':'!*#..#)$-(#)!#$62;%g'%4-c)2!*'!&;(,#$)%!V-1#&I-2'%!'$!-$82#%#%!J!6'%$!*'!(#'%6)%[!
"-6'(#&!:'(%#5$!<! ! ^2)%-(#)!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!@@S!?*'!@ABC!
!
Accountability `(-Q-1#2#*-*!
ALE +$$I-2!T)%%!LM4'.&-$.J!
ARO +$$I-2!Z-&'!)O!E..I(('$.'!
Authenticity +I&'$&#.#*-*!
Availability \#%4)$#1#2#*-*!
Asset +.&#:)!!
BIA fI%#$'%%!H,4-.&!+$-2J%#%!
Business Impact Analysis +$82#%#%!*'!#,4-.&)!
Confidentiality 3)$O#*'$.#-2#*-*!
Countermeasure 3)$&(-!,'*#*-!
Frequency e('.I'$.#-!
Impact H,4-.&)!
Integrity H$&'6(#*-*!
Residual risk Z#'%6)!('%#*I-2!
Risk Z#'%6)!
Risk analysis +$82#%#%!*'!(#'%6)%!
Risk assessment +$82#%#%!*'!(#'%6)%!
Risk management ^'%$!*'!(#'%6)%!
Risk map "-4-!*'!(#'%6)!
Risk treatment `(-&-,#'$&)!*'2!(#'%6)!
Safeguard ]-2:-6I-(*-!
Security ]'6I(#*-*!
Statement of applicability \).I,'$&)!*'!%'2'..#5$!*'!.)$&()2'%!
Traceability `(-Q-1#2#*-*!
Threat +,'$-Q-!
Value _-2)(!
Vulnerability _I2$'(-1#2#*-*!!
1.3. ISO/IEC Guide 73:2002 T-!^IR-!K>!*'!H]E!p<SS<q!'%&(I.&I(-!2)%!.)$.'4&)%!*'!6'%$!*'!(#'%6)%!*'!2-!%#6I#'$&'!O)(,-[!
Risk management: !.))(*#$-&'*!-.&#:#&#'%!&)!*#('.&!-$*!.)$&()2!-$!)(6-$#Q-&#)$!y#&V!('6-(*!&)!(#%rD!
Risk assessment: !):'(-22!4().'%%!)O!(#%r!-$-2J%#%!-$*!(#%r!':-2I-&#)$D!
Risk analysis:!!%J%&',-&#.!I%'!)O!#$O)(,-&#)$!&)!#*'$&#OJ!%)I(.'%!-$*!&)!'%&#,-&'!(#%rD!
Source identification:!4().'%%!&)!O#$*W!2#%&!-$*!.V-(-.&'(#Q'!%)I(.'%BGD!
Risk estimation: 4().'%%!I%'*!&)!-%%#6$!:-2I'%!&)!&V'!4()1-1#2#&JBK!-$*!.)$%'UI'$.'%!)O!-!(#%rD!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
BG!!])I(.'[!#&',!)(!-.&#:#&J!V-:#$6!-!4)&'$&#-2!O)(!-!.)$%'UI'$.'D!3)$%'UI'$.'[!)I&.),'!)O!-$!':'$&D!L:'$&[!)..I(('$.'!)O!-!4-(&#.I2-(!%'&!)O!.#(.I,%&-$.'%D!
BK!!/()1-1#2#&J[!'M&'$*!&)!yV#.V!-$!':'$&!#%!2#r'2J!&)!)..I(D!
"-6'(#&!:'(%#5$!<! ! ^2)%-(#)!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!@@@!?*'!@ABC!
Risk evaluation: 4().'%%!)O!.),4-(#$6!&V'!'%&#,-&'*!(#%r!-6-#$%&!6#:'$!(#%r!.(#&'(#-!&)!*'&'(,#$'!&V'!%#6$#O#g.-$.'!)O!&V'!(#%rD!
Risk treatment: 4().'%%!)O!%'2'.&#)$!-$*!#,42','$&-&#)$!)O!,'-%I('%!&)!,)*#OJ!(#%rD!
!
T-!%#6I#'$&'!&-12-!('%I,'!2-!('2-.#5$!'$&('!2-!&'(,#$)2)6R-!#*'$&#O#.-*-!'$!2-!^I#*'!K>!J!"-6'(#&[!
!
Guide 73:2002 Magerit v2
Z#%r!,-$-6','$&! +$82#%#%!J!6'%$!*'!(#'%6)% /@!�!/<!�!/>!
Z#%r!-%%'%%,'$&! ! !
Z#%r!-$-2J%#%! +$82#%#%!*'!(#'%6)%! /<!
])I(.'!#*'$&#O#.-&#)$ ! !
Z#%r!'%&#,-&#)$! ! !
Z#%r!':-2I-&#)$! ! +>D@!
Z#%r!&('-&,'$&! ^'%$!*'!(#'%6)%! +>D<!�!+>D>!
!
1.4. Referencias p\Z+Lq!
Z'-2!+.-*',#-!L%4-c)2-D!\#..#)$-(#)!*'!2-!T'$6I-!L%4-c)2-D!<<D�!'*#.#5$W!<SS@D!!V&&4[dd1I%.)$D(-'D'%d*#..#)$-(#)d*(-'DV&,!
pE/]L3q!E/]L3!^2)%%-(J!)O!`'(,%W!!V&&4[ddyyyD#)%%D6):d*).%d*'O#$#&#)$%DV&,2!
!
p@KKPP[<SSAq!H]EdHL3!@KKPP[<SSAW!jH$O)(,-&#)$!&'.V$)2)6J!gg!3)*'!)O!4(-.&#.'!O)(!#$O)(,-&#)$!%'.I(#&J!,-$g-6','$&kW!<SSAD!
p@ABB>g@[<SSAq!H]EdHL3!`Z!@ABB>[<SSAW!jH$O)(,-&#)$!&'.V$)2)6J!gg!]'.I(#&J!&'.V$#UI'%!gg!+!O(-,'y)(r!O)(!H`!%'.I(#&J!-%%I(-$.'!gg!/-(&!@[!E:'(:#'y!-$*!O(-,'y)(rkW!<SSAD!
pNSSgA>[<SSBq!7H]`W!jZ'.),,'$*'*!]'.I(#&J!3)$&()2%!O)(!e'*'(-2!H$O)(,-&#)$!]J%&',%kW!7-&#)$-2!H$%&#&I&'!)O!]&-$*-(*%!-$*!`'.V$)2)6JW!%4'.#-2!4I12#.-&#)$!NSSgA>W!<SSBD!
p@>>>Ag@[<SSBq!H]EdHL3!@>>>Ag@[<SSBW!jH$O)(,-&#)$!&'.V$)2)6J!gg!]'.I(#&J!&'.V$#UI'%!gg!"-$-6','$&!)O!#$O)(g,-&#)$!-$*!.),,I$#.-&#)$%!&'.V$)2)6J!%'.I(#&J!gg!/-(&!@[!3)$.'4&%!-$*!,)*'2%!O)(!#$O)(,-&#)$!-$*!.),,I$#.-&#)$%!&'.V$)2)6J!%'.I(#&J!,-$-6','$&kW!<SSBD!
p3Z+""[<SS>q!!j33`+!Z#%r!+$-2J%#%!-$*!"-$-6','$&!"'&V)*!?3Z+""CkW!_'(%#)$!ADSW!<SS>D!
pE.&-:'[<SS>q!3D!+21'(&%!-$*!+D!\)()O''W!j"-$-6#$6!#$O)(,-&#)$!]'.I(#&J!Z#%r%D!`V'!E3`+_L!+44()-.VkW!+**#%)$!|'%2'JW!<SS>D!
"-6'(#&!:'(%#5$!<! ! ^2)%-(#)!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!@@<!?*'!@ABC!
p`\HZ[<SS>q!`'M-%!\'4-(&,'$&!)O!H$O)(,-&#)$!Z'%)I(.'%W!j/(-.&#.'%!O)(!/()&'.&#$6!H$O)(,-&#)$!Z'%)I(.'%!+%%'&%jW!Z':#%'*!]'4&',1'(!<SS>D!
p37]][<SS>q!3),,#&&''!)$!7-&#)$-2!]'.I(#&J!]J%&',%W!H$%&(I.&#)$!7)D!BSSPW!j7-&#)$-2!H$O)(,-&#)$!+%%I(-$g.'!?H+C!^2)%%-(JjW!"-J!<SS>D!
p^I#*'!K>[<SS<q!H]EdHL3!^I#*'!K>[<SS<W!jZ#%r!,-$-6','$&!b!_).-1I2-(J!b!^I#*'2#$'%!O)(!I%'!#$!]&-$*-(*%kW!<SS<D!
p@KKPP[<SS<q!97L!H]EdHL3[<SS<W!j`'.$)2)6R-!*'!2-!H$O)(,-.#5$!b!35*#6)!*'!fI'$-%!/(8.&#.-%!4-(-!2-!^'%g$!*'!2-!]'6I(#*-*!*'!2-!H$O)(,-.#5$kW!<SS<D!
p3H+E[<SSSq!3(#&#.-2!H$O(-%&(I.&I('!+%%I(-$.'!EOO#.'W!j/(-.&#.'%!O)(!]'.I(#$6!3(#&#.-2!H$O)(,-&#)$!+%%'&%kW!x-$I-(J!<SSSD!
p33[@PPPq!H]EdHL3!@ABSN[@PPPW!jH$O)(,-&#)$!&'.V$)2)6J!�!]'.I(#&J!&'.V$#UI'%!�!L:-2I-&#)$!.(#&'(#-!O)(!H`!%'.I(#&JkW!@PPPD!
p7]`H]][@PPNq!7-&#)$-2!]'.I(#&J!`'2'.),,I$#.-&#)$%!-$*!H$O)(,-&#)$!]J%&',%!]'.I(#&J!3),,#&&''W!jH$*'M!)O!7-&#)$-2!]'.I(#&J!`'2'.),,I$#.-&#)$%!H$O)(,-&#)$!]J%&',%!]'.I(#&J!H%%I-$.'%kW!7]`H]]H!$)D!BS@BW!7]`H]]3!]'.('&-(#-&W!@PPND!
p3L]H\[@PPKq!3'$&()!]I4'(#)(!*'!H$O)(,-.#5$!*'!2-!\'O'$%-W!j^2)%-(#)!*'!`;(,#$)%!*'!3(#4&)2)6R-kW!"#$#%&'g(#)!*'!\'O'$%-W!>�!'*#.#5$W!@PPKD!
p"-6'(#&[@PPKq!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%W!j"'&)*)2)6R-!*'!+$82#%#%!J!^'%$!*'!Z#'%6)%!*'!2)%!]#%&',-%!*'!H$O)(,-.#5$kW!"+/W!:'(%#5$!@DSW!@PPKD!
pZ#1-6)(*-[@PPKq!+D!Z#1-6)(*-W!j^2)%-(#)!*'!`;(,#$)%!*'!]'6I(#*-*!*'!2-%!`DHDkW!L*#.#)$'%!3E\+W!@PPKD!
pKBPNg<[@PNPq!H]E!KBPNg<[@PNPW!jH$O)(,-&#)$!4().'%%#$6!%J%&',%!gg!E4'$!]J%&',%!H$&'(.)$$'.&#)$!gg!f-%#.!Z'O'('$.'!")*'2!gg!/-(&!<[!]'.I(#&J!+(.V#&'.&I('kW!@PNPD!
!
"-6'(#&!:'(%#5$!<! ! Z'O'('$.#-%!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!@@>!?*'!@ABC!
Apéndice 2. Referencias +I$UI'!2)%!.-4R&I2)%!J!-4;$*#.'%!#$.2IJ'$!('O'('$.#-%!1#12#)6(8O#.-%!'%4'.RO#.-%!-2!&',-!UI'!'$O)g.-$W!'$!'%&'!-4;$*#.'!%'!('.)4#2-$!2-%!('O'('$.#-%!-!,;&)*)%!J!,'&)*)2)6R-%!UI'!-O()$&-$!'2!-$8g2#%#%!J!6'%$!*'!(#'%6)%!.),)!-.&#:#*-*!#$&'6(-2D!T-%!('O'('$.#-%!%'!)(*'$-$!&',4)(-2,'$&'[!*'!,8%!('.#'$&'%!-!,8%!-$I-%D!
!" e'*'(-2!EOO#.'!O)(!H$O)(,-&#)$!]'.I(#&J!?f]HCD!jH`!f-%'2#$'!/()&'.&#)$!"-$I-2kW!E.&)1'(!<SS>D!^'(,-$JD!V&&4[ddyyyD1%#D*'d6%V1d'$62#%Vd'&.d#$*'MDV&,!
!" j`V'!_I2$'(-1#2#&J!+%%'%%,'$&!-$*!"#-&#)$!"'&V)*)2)6JkW!/D]D!+$&5$!'&!-2DW!Z+7\!7-g&#)$-2!\'O'$%'!Z'%'-(.V!H$%&#&I&'W!"Zg@GS@g\+Z/+W!<SS>D!
!" j"-$-6#$6!H$O)(,-&#)$!]'.I(#&J!Z#%r%[!`V'!E3`+_L!+44()-.VkW!3DxD!+21'(&%!-$*!+DxD!\)()gO''W!!+**#%)$g|'%2'J!/I1!3)h!@%&!'*#&#)$!?xI2J!PW!<SS<C!V&&4[ddyyyD.'(&D)(6d).&-:'d!
!" jH$O)(,-&#)$!]'.I(#&J!Z#%r!+$-2J%#%kW!`DZD!/'2&#'(W!+I'(1-.V!/I1h!@%&!'*#&#)$!?x-$I-(J!<>W!<SS@C!
!" jZ#%r!"-$-6','$&[!"I2&#%'(:#.'!`-.&#.%W!`'.V$#UI'%W!-$*!/().'*I('%!O)(!Z#%r!"-$-6'g,'$&kW!+#(!T-$*!]'-!+442#.-&#)$!3'$&'(W!e"!>g@SSD@<W!"3Z/!Ag@<D@3W!7``/!AgS>DAW!+e``/?HC!>g<D>SD!e'1(I-(J!<SS@D!
!" +#(!e)(.'!/-,4V2'&!PSgPS<W!jE4'(-&#)$-2!Z#%r!"-$-6','$&!?EZ"C!^I#*'2#$'%!-$*!`))2%kW!\'.',1'(!<SSSD!
!" u/"^!/'-&!"-(y#.r!TT/W!j_I2$'(-1#2#&J!+%%'%%,'$&!e(-,'y)(r!@D@jW!E.&)1'(!@PPND!
!" "-6'(#&W!j"'&)*)2)6R-!*'!+$82#%#%!J!^'%$!*'!Z#'%6)%!*'!2)%!]#%&',-%!*'!H$O)(,-.#5$kW!"+/W!:'(%#5$!@DSW!@PPK!V&&4[ddyyyD.%#D,-4D'%d.%#d46A,<SDV&,!
!" ^"H`]W!H]EdHL3!`Z!@>>>Ag<[@PPKW!jH$O)(,-&#)$!&'.V$)2)6J!g!]'.I(#&J!&'.V$#UI'%!g!^I#*'g2#$'%!O)(!&V'!,-$-6','$&!)O!H`!%'.I(#&J!g!/-(&!<[!"-$-6#$6!-$*!42-$$#$6!H`!%'.I(#&JkD!
/)(!02&#,)!%'!*'1'!.#&-(!I$-!V'((-,#'$&-!UI'!22':-!#,42R.#&-,'$&'!I$-!,'&)*)2)6R-D!+2!%'(!I$!4()g*I.&)W!2'!O'.V-!%'!2#,#&-!-!#$*#.-(!2-!*'!2-!I2&#,-!:'(%#5$!'$!'2!,'(.-*)D!
!" 3Z+""W!j33`+!Z#%r!+$-2J%#%!-$*!"-$-6','$&!"'&V)*!?3Z+""CkW!_'(%#)$!ADSW!<SS>D!
"-6'(#&!:'(%#5$!<! ! "-(.)!2'6-2!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!@@B!?*'!@ABC!
Apéndice 3. Marco legal L$!'%&'! -4;$*#.'! %'! ('.)4#2-! 2-! $)(,-&#:-! 2'6-2W! $-.#)$-2! '! #$&'($-.#)$-2W! ('2':-$&'! -2! .-%)!*'2!-$82#%#%!J!6'%$!*'!(#'%6)%W!1#'$!4)(!'M#6#(2)W!1#'$!4)(!%I%&'$&-(2)W!1#'$!4)(!%'(!*'!I#*-*!'$!I$!4()J'.&)!+^ZD!T-!('2-.#5$!$)!4('&'$*'!%'(!'MV-I%&#:-W!-,;$!*'!'%&-(!%IF'&-!-!I$!4().'%)!2'6#%2-g&#:)!-.&#:)W!4)(!2)!UI'!'%!)12#6-.#5$!*'2!('%4)$%-12'!4('%&-(!-&'$.#5$!-!2-%!$):'*-*'%!UI'!:-J-$!-4-('.#'$*)DD!
T-!*).I,'$&-.#5$!-.&I-2#Q-*-!4I'*'!'$.)$&(-(%'!'$!2-%!486#$-%!y'1!*'2!]]H]`+\BN!*'2!3]+LBP[!
V&&4[ddyyyD.%#D,-4D'%d!
/)(!02&#,)W!%'!V-$!#$.2I#*)!-26I$-%!('O'('$.#-%!-!-.I'(*)%!*'!.-(8.&'(!4)2R&#.)!)!*'!)&(-!$-&I(-2'gQ-!-!2)%!.I-2'%!.)$:#'$'!&-,1#;$!4('%&-(!-&'$.#5$D!/)(!'F',42)W!2-%!^IR-%!*'!2-!E3\LD!
3.1. Procedimiento administrativo !" T'J!>Sd@PP<W!*'!<G!*'!$):#',1('W!*'!Z;6#,'$!xI(R*#.)!*'!2-%!+*,#$#%&(-.#)$'%!/012#.-%!J!*'2!/().'*#,#'$&)!+*,#$#%&(-&#:)!3),0$W!TZxg/+3D!
!" Z'-2!\'.('&)!<G>d@PPGW!*'!@G!*'!O'1('()W!4)(!'2!UI'!%'!('6I2-!2-!I#Q-.#5$!*'!&;.$#.-%!'2'.g&(5$#.-%W!#$O)(,8&#.-%!J!&'2',8&#.-%!4)(!2-!+*,#$#%&(-.#5$!^'$'(-2!*'2!L%&-*)D!
!" Z'-2!\'.('&)!<SPd<SS>W!*'!<@!*'!O'1('()W!4)(!'2!UI'!%'!('6I2-$!2)%!('6#%&()%!J!2-%!$)&#O#.-g.#)$'%! &'2',8&#.-%W!-%R! .),)! 2-!I#Q-.#5$!*'!,'*#)%! &'2',8&#.)%!4-(-! 2-!%I%&#&I.#5$!*'! 2-!-4)(&-.#5$!*'!.'(&#O#.-*)%!4)(!2)%!.#I*-*-$)%D!
!" Z'%)2I.#5$!*'!<G!*'!,-J)!*'!<SS>!*'!2-!]'.('&-(R-!*'!L%&-*)!4-(-!2-!+*,#$#%&(-.#5$!/012#g.-!4)(!2-!UI'!%'!*#%4)$'!2-!4I12#.-.#5$!*'2!+.I'(*)!*'2!/2'$)!*'!2-!3),#%#5$!H$&'(,#$#%&'(#-2!*'!+*UI#%#.#5$!*'!f#'$'%!J!]'(:#.#)%!H$O)(,8&#.)%!?3H+f]HC!*'!@N!*'!*#.#',1('!*'!<SS<!4)(!'2!UI'!%'!-4(I'1-$!2)%!3(#&'(#)%!*'!%'6I(#*-*W!$)(,-2#Q-.#5$!J!.)$%'(:-.#5$!*'!2-%!-42#.-g.#)$'%!I#Q-*-%!4)(!2-!+*,#$#%&(-.#5$!^'$'(-2!*'2!L%&-*)!'$!'2!'F'(.#.#)!*'!%I%!4)&'%&-*'%D!
!" E(*'$!/ZLd@AA@d<SS>W!*'!@S!*'!FI$#)W!4)(!2-!UI'!%'!*'%-(()22-!2-!\#%4)%#.#5$!O#$-2!4(#,'(-!*'2!Z'-2!\'.('&)!<SPd<SS>W!*'!<@!*'!O'1('()W!4)(!'2!UI'!%'!('6I2-$!2)%!('6#%&()%!J!2-%!$)&#O#g.-.#)$'%!&'2',8&#.-%W!-%R!.),)!2-!I#Q-.#5$!*'!,'*#)%!&'2',8&#.)%!4-(-!2-!%I%&#&I.#5$!*'!2-!-4)(&-.#5$!*'!.'(&#O#.-*)%!4)(!2)%!.#I*-*-$)%D!
3.2. Protección de datos de carácter personal !" TE/\W!T'J!E(68$#.-!@Ad@PPPW!*'!@>!*'!*#.#',1('W!*'!/()&'..#5$!*'!\-&)%!*'!3-(8.&'(!/'(g%)$-2D!
!" Z'-2!\'.('&)!PPBd@PPPW!*'!@@!*'!FI$#)W!4)(!'2!UI'!%'!-4(I'1-!'2!Z'62-,'$&)!*'!,'*#*-%!*'!%'6I(#*-*!*'!2)%!O#.V'()%!-I&),-&#Q-*)%!UI'!.)$&'$6-$!*-&)%!*'!.-(8.&'(!4'(%)$-2D!
3.3. Firma electrónica !" T'J!APd<SS>W!*'!@P!*'!*#.#',1('W!*'!O#(,-!'2'.&(5$#.-D!
!" T'J!GGd@PPKW!*'!>S!*'!*#.#',1('W!*'!"'*#*-%!e#%.-2'%W!+*,#$#%&(-&#:-%!J!*'2!E(*'$!]).#-2h!-(&D!N@D!!
!" Z'-2!\'.('&)!@>@Kd<SS@W!*'!>S!*'!$):#',1('W!4)(!'2!UI'!%'!*'%-(()22-!'2!-(&R.I2)!N@!*'! 2-!T'J!GGd@PPKW!*'!>S!*'!*#.#',1('W!*'!"'*#*-%!e#%.-2'%W!+*,#$#%&(-&#:-%!J!*'2!E(*'$!]).#-2W!'$!,-&'(#-! *'! 4('%&-.#5$! *'! %'(:#.#)%! *'! %'6I(#*-*!4)(! 2-!e81(#.-!7-.#)$-2! *'!")$'*-! J!`#,1('gZ'-2!3-%-!*'!2-!")$'*-W!'$!2-%!.),I$#.-.#)$'%!-!&(-:;%!*'!&;.$#.-%!J!,'*#)%!'2'.g&(5$#.)%W!#$O)(,8&#.)%!J!&'2',8&#.)%W!.)$!2-%!+*,#$#%&(-.#)$'%!/012#.-%D!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
BN!]]H`+\[!]'6I(#*-*!*'!2)%!]#%&',-%!*'!H$O)(,-.#5$!J!/()&'..#5$!*'!\-&)%!/'(%)$-2#Q-*)%!+I&),-&#Q-g*)%W!.),#&;!&;.$#.)!*'2!3]+LD!
BP!3]+L[!3)$%'F)!]I4'(#)(!*'!+*,#$#%&(-.#5$!L2'.&(5$#.-D!
"-6'(#&!:'(%#5$!<! ! "-(.)!2'6-2!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!@@A!?*'!@ABC!
3.4. Información clasificada !" T'J!Pd@PGNW!*'!A!*'!-1(#2W!%)1('!]'.('&)%!EO#.#-2'%D!
!" \'.('&)!<B<d@PGPW!*'!<S!*'!e'1('()D!4)(!'2!UI'!%'!*'%-(()22-$!2-%!*#%4)%#.#)$'%!*'!2-!T'J!Pd@PGND!*'!A!*'!-1(#2!%)1('!]'.('&)%!EO#.#-2'%D!
!" T'J!BNd@PKNW!*'!K!*'!).&I1('W!UI'!,)*#O#.-!2-!T'J!Pd@PGNW!*'!A!*'!-1(#2W!%)1('!%'.('&)%!)O#g.#-2'%D!
!" E(*'$!"#$#%&'(#-2!$0,'()!KGd<SS<W!*'!@N!*'!-1(#2W!4)(!2-!UI'!%'!'%&-12'.'!2-!4)2R&#.-!*'!%'g6I(#*-*!4-(-! 2-!4()&'..#5$!*'!2-! #$O)(,-.#5$!*'2!"#$#%&'(#)!*'!\'O'$%-!-2,-.'$-*-W!4().'g%-*-!)!&(-$%,#&#*-!4)(!%#%&',-%!*'!#$O)(,-.#5$!J!&'2'.),I$#.-.#)$'%D!
!" TLo!@@d<SS<W!*'!G!*'!,-J)W!('6I2-*)(-!*'2!3'$&()!7-.#)$-2!*'!H$&'2#6'$.#-D!
!" Z'-2!\'.('&)!B<@d<SSBW!*'!@<!*'!,-(Q)W!4)(!'2!UI'!%'!('6I2-!'2!3'$&()!3(#4&)256#.)!7-.#)g$-2D!
!" \'.#%#5$!*'2!3)$%'F)!*'!@P!*'!,-(Q)!*'!<SS@W!4)(!2-!UI'!%'!-*)4&-$!2-%!$)(,-%!*'!%'6I(#g*-*!*'2!3)$%'F)!?<SS@d<GBdL3C!
!" \'.#%#5$!*'!2-!3),#%#5$!*'!<P!*'!$):#',1('!*'!<SS@W!4)(!2-!UI'!%'!,)*#O#.-!%I!Z'62-,'$&)!#$&'($)!?<SS@dNBBd3LW!3L3+W!LI(-&),C!
3.5. Seguridad de las redes y de la información !" 3E"?<SS@C<PN!O#$-2!gg!]'6I(#*-*!*'!2-%!('*'%!J!*'!2-!#$O)(,-.#5$[!/()4I'%&-!4-(-!I$!'$O)gUI'!4)2R&#.)!'I()4')!
!" ^IR-%!*'!2-!E3\L!4-(-!2-!%'6I(#*-*!*'!2)%!%#%&',-%!*'!#$O)(,-.#5$!J!('*'%D!i-.#-!I$-!.I2g&I(-!*'!%'6I(#*-*!
"-6'(#&!:'(%#5$!<! ! L:-2I-.#5$!J!.'(&#O#.-.#5$!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!@@G!?*'!@ABC!
Apéndice 4. Marco de evaluación y certificación T-!.),42'F#*-*!*'!2)%!%#%&',-%!*'!#$O)(,-.#5$!.)$22':-!I$!6(-$!'%OI'(Q)!4-(-!*'&'(,#$-(!2-!.-2#g*-*!*'!2-%!,'*#*-%!*'!%'6I(#*-*!*'!UI'!%'!V-!*)&-*)!J!2-!.)$O#-$Q-!UI'!,'('.'$D!L%!O('.I'$&'!2-!-4-(#.#5$!*'!&'(.'(-%!4-(&'%!UI'!*'!O)(,-!#$*'4'$*#'$&'!',#&'$!FI#.#)%!%)1('!*#.V)%!-%4'.&)%W!FI#.#)%!UI'!%'!',#&'$!&(-%!I$-!':-2I-.#5$!(#6I()%-!J!UI'!%'!42-%,-$!'$!I$!*).I,'$&)!('.)$).#*)D!
L$!'%&'!.-4R&I2)!%'!('4-%-$!%),'(-,'$&'!*)%!,-(.)%!'$!2)%!UI'!%'!V-!O)(,-2#Q-*)!'2!4().'%)!*'!':-2I-.#5$!J!.'(&#O#.-.#5$!?)!('6#%&()C[!
!" '$!2)%!%#%&',-%!*'!6'%$!*'!2-!%'6I(#*-*!*'!2-!#$O)(,-.#5$!
!" '$!2)%!4()*I.&)%!*'!%'6I(#*-*!
/-(-!.-*-!I$)!*'!'%&)%!,-(.)%!%'!#$*#.-!%I!)4)(&I$#*-*W!2-!O)(,-!*'!)(6-$#Q-(%'!4-(-!-2.-$Q-(!2-!.'(&#O#.-.#5$!J!'2!,-(.)!-*,#$#%&(-&#:)!J!$)(,-&#:)!'$!'2!UI'!%'!*'%-(()22-!2-!-.&#:#*-*D!
4.1. Sistemas de gestión de la seguridad de la información (SGSI) T)%!4()12',-%!*'!%'6I(#*-*!*'!2)%!%#%&',-%!*'!#$O)(,-.#5$!&#'$'$!I$!)(#6'$!&;.$#.)!4'()!%)$!&-$!.),42'F)%!UI'! 2-!%)2I.#5$!$)!4I'*'!%'(!%)2-,'$&'! &;.$#.-D!T-! &'.$)2)6R-!'%!*',-%#-*)!(#.-!'$!)4)(&I$#*-*'%!J!4)(!&-$&)!V-J!UI'!,-$&'$'(2-!1-F)!.)$&()2!-%'6I(-$*)!UI'!&(-1-F'!4-(-!2)%!)1F'&#g:)%!*'!2-!E(6-$#Q-.#5$D!
]'6I(#*-*!'%!'%&-(!4(':'$#*)!?-$&'%Ch!'%!'%&-(!4('4-(-*)!4-(-!('-..#)$-(!-!2-%!','(6'$.#-%W!4('g:#%&-%!)!#,4(':#%&-%h!J!'%!%-1'(!('V-.'(%'!&(-%!'2!*'%-%&('D!`)*)!'%&)!$)!'%!6(-&#%[!.I'%&-!*#$'()W!&#',4)!J!'%OI'(Q)D!/)(!'22)!'%!$'.'%-(#)!(-.#)$-2#Q-(W!.)$!.(#&'(#)!'.)$5,#.)W!I$-!%)2I.#5$!'UI#2#g1(-*-!'$&('!2)!UI'!%'!':#&-!UI'!).I((-W!2)!UI'!%'!,)$&-!4-(-!*'&'.&-(!O-22)%W!J!2)!UI'!%'!&#'$'!4('g4-(-*)!4-(-!.I-$*)!).I((-! 2)!UI'W! &'5(#.-,'$&'W!$I$.-!*'1#'(-!V-1'(!).I((#*)D!oW! &)*)!'%)W!%#$!)2:#*-(! 2-!*#,'$%#5$! &#',4)W!4)(UI'!V-J!UI'! (-.#)$-2#Q-(!6-%&)%!'! #$:'(%#)$'%! &-$&)!4-(-! 2)!UI'!%-1',)%!V)J!.),)!4-(-!2)!UI'!*'%.I1(#(',)%!,-c-$-D!!
+4-('.'!4I'%!I$!.),4)$'$&'!*'!6'%$W!&-$!$'.'%-(#)!.),)!2)%!.),4)$'$&'%!&;.$#.)%D!!
Sistema de gestión de la seguridad de la información
L%!I$!%#%&',-!*'!6'%$!UI'!.),4('$*'!2-!4)2R&#.-W!2-!'%&(I.&I(-!)(6-$#Q-&#:-W!2)%!4().'*#g,#'$&)%W!2)%!4().'%)%!J!2)%!('.I(%)%!$'.'%-(#)%!4-(-!#,42-$&-(!2-!6'%$!*'!2-!%'6I(#*-*!*'!2-!#$O)(,-.#5$D!L2!%#%&',-!'%!2-!V'((-,#'$&-!*'!UI'!*#%4)$'!2-!\#('..#5$!*'!2-%!)(6-$#Q-.#)g$'%!4-(-!22':-(!-!.-1)!2-%!4)2R&#.-%!J!2)%!)1F'&#:)%!*'!%'6I(#*-*!?#$&'6(#*-*W!.)$O#*'$.#-2#*-*!J! *#%4)$#1#2#*-*W! -%#6$-.#5$!*'! ('%4)$%-1#2#*-*W! -I&'$&#.-.#5$W! '&.DCD!/()4)(.#)$-!,'.-$#%g,)%!4-(-!2-!%-2:-6I-(*-!*'!2)%!-.&#:)%!*'!#$O)(,-.#5$!J!*'!2)%!%#%&',-%!UI'!2)%!4().'%-$W!'$! .)$.)(*-$.#-! .)$! 2-%! 4)2R&#.-%! *'! %'6I(#*-*! J! 42-$'%! '%&(-&;6#.)%! *'! 2-! )(6-$#Q-.#5$D!p97L!K@AS<[<SSBq!
L%&-!'%!2-!'%'$.#-!*'2!,)*'2)!/\3+!?*'!#$62;%!Plan, Do, Check, ActC!UI'!%'!I%-!'$!2)%!,)*'2)%!*'!6'%$!*'!2-!.-2#*-*D!!
planificaciónplanificación
Plan
monitorizacióny evaluación
monitorizacióny evaluación
Check
implementacióny operación
implementacióny operación
Do
mantenimientoy mejora
mantenimientoy mejora
Act
!
T-!42-$#O#.-.#5$!?/!*'!PlanC!*'1'!#$.2I#(!I$-!4)2R&#.-!*'!%'6I(#*-*!UI'!,-(UI'!)1F'&#:)%!J!I$!-$8g2#%#%!*'!(#'%6)%!UI'!,)*'2'!'2!:-2)(!*'2!%#%&',-W!%I!'M4)%#.#5$!-!-,'$-Q-%W!J!2)!UI'!%'!&#'$'!?)!%'!
"-6'(#&!:'(%#5$!<! ! L:-2I-.#5$!J!.'(&#O#.-.#5$!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!@@K!?*'!@ABC!
$'.'%#&-C!4-(-!,-$&'$'(!'2!(#'%6)!1-F)!.)$&()2D!L%!$-&I(-2!UI'!.)$!'%&-%!1-%'%!%'!6'$'('!I$!42-$!*'!%'6I(#*-*!(-Q)$-*)!4-(-!2-!6'%$!*'!(#'%6)%D!
T-!-..#5$!?\!*'!DoC!'%!2-!'F'.I.#5$!*'2!42-$W!'$!%I%!-%4'.&)%!&;.$#.)%!J!*'!)(6-$#Q-.#5$W!#$:)2Ig.(-$*)!-!2-%!4'(%)$-%!UI'!%'!V-.'$!.-(6)!*'2!%#%&',-!)!'%&8$!('2-.#)$-*-%!.)$!;%&'D!9$!42-$!&#'g$'!;M#&)!.I-$*)!22':-!-!I$-!)4'(-.#5$!*#-(#-!%#$!%)(4('%-%D!
T-!,)$#&)(#Q-.#5$!?3!*'!CheckC!*'!2-!)4'(-.#5$!*'2!%#%&',-!4-(&'!*'2!V'.V)!*'!UI'!$)!%'!4I'*'!.)$O#-(!.#'6-,'$&'!'$!2-!'O#.-.#-!*'!2-%!,'*#*-%W!%#$)!UI'!.)$&#$I-,'$&'!V-J!UI'!':-2I-(!%#!('%g4)$*'$!-! 2)!'%4'(-*)!.)$! 2-!'O#.-.#-!*'%'-*-D!i-J!UI'!,'*#(! &-$&)! 2)!UI'!).I(('!.),)! 2)!UI'!!).I((#(R-!%#!$)!%'!VI1#'(-$!&),-*)!,'*#*-%D!+!:'.'%!%'!V-12-!*'2!j.)%&'!*'!2-!#$%'6I(#*-*k!.),)!FI%&#O#.-.#5$!*'!UI'!'2!6-%&)!*'!*#$'()!J!'%OI'(Q)!&#'$'!OI$*-,'$&)D!o!V-J!UI'!-&'$*'(!-!2-%!$):'g*-*'%!UI'!%'!4()*IQ.-$W!&-$&)!'$!.I-$&)!-!,)*#O#.-.#)$'%!*'2!4()4#)!%#%&',-!*'!#$O)(,-.#5$W!.)g,)!-!$I':-%!-,'$-Q-%D!
T-!('-..#5$!?+!*'!ActC!'%!%-1'(!*'(#:-(!.)$%'.I'$.#-%!*'!2-!'M4'(#'$.#-W!4()4#-!J!*'!%#%&',-%!%#g,#2-('%W!('4#&#'$*)!'2!.#.2)!/\3+D!
T-!':-2I-.#5$!*'!I$!%#%&',-!*'!6'%$!*'! 2-!%'6I(#*-*!4-(&'!*'2!%I4I'%&)!*'!UI'!'2!'%UI',-!-$&'(#)(!:'(&'1(-!2-%!-.&I-.#)$'%!*'!2-!E(6-$#Q-.#5$!'$!,-&'(#-!*'!%'6I(#*-*W!J!FIQ6-!2-!'O#.-.#-!*'!2)%!.)$&()2'%!#,42-$&-*)%!4-(-!-2.-$Q-(!2)%!)1F'&#:)%!4()4I'%&)%D!
4.1.1. La certificación
3'(&#O#.-(!I$!%#%&',-!*'!6'%$!*'!2-!%'6I(#*-*!.)$%#%&'!'$!UI'!-26I#'$W!.),4'&'$&'W!-O#(,-!UI'!I$!%#%&',-!'%&8!%-$)!J!.),4(),'&'!'$!'22)!%I!4-2-1(-! ?4)(!'%.(#&)CD!3)$! &)*-%! 2-%!.-I&'2-%!*'!-2.-$.'!J! &#',4)!UI'!%'!.)$%#*'('$!)4)(&I$-%!?J!%'!('.)F-$!'M42R.#&-,'$&'CD!o!%-1#'$*)!UI'! 2)!UI'!%'!-%'6I(-!V)JW!V-J!UI'!(':#%-(2)!-!,'*#)!42-Q)!4I'%!&)*)!':)2I.#)$-D!
/-(-!)1&'$'(!I$!.'(&#O#.-*)!V-J!UI'!%'6I#(!I$-!%'(#'!*'!O)(,-2#%,)%D!]#$!'$&(-(!'$!'M.'%#:)!*'&-g22'!$)%!.'$&(-(',)%!'$!UI;!':-20-!'2!'UI#4)!UI'!'$:R-!'2!)(6-$#%,)!*'!.'(&#O#.-.#5$!-!FIQ6-(!-!2-!E(6-$#Q-.#5$D!
T)!4(#,'()!UI'!V-J!UI'!V-.'(!'%!*'2#,#&-(!'2!-2.-$.'!*'!2)!UI'!%'!:-!-!':-2I-(!.),)!j]#%&',-!*'!^'%$!*'!2-!]'6I(#*-*!*'!2-!H$O)(,-.#5$kD!L%&-!'%!I$-!*'2#,#&-.#5$!4()4#-!*'!.-*-!E(6-$#Q-.#5$W!UI'!('O2'F-!%I!,#%#5$!J!%I!)(6-$#Q-.#5$!#$&'($-D!L%!#,4)(&-$&'!*'2#,#&-(!.)$!.2-(#*-*D!]#!'2!4'(R,'g&()!'%!*#OI%)!$)!UI'*-(8!.2-()!UI;!V-J!UI'!V-.'(!'$!2)%!4-%)%!%#6I#'$&'%h!'$!4-(&#.I2-(W!$)!%'!%-g1(8!,IJ!1#'$!-!UI;!4'(%)$-%!J!*'4-(&-,'$&)%!V-J!UI'!*#(#6#(%'!4-(-!('.2-,-(!2-!#$O)(,-.#5$!4'(g&#$'$&'D!75&'%'!UI'!'%&)!4I'*'!$)!%'(!':#*'$&'D!+.&I-2,'$&'!'%!(-()!'$.)$&(-(!I$-!)(6-$#Q-.#5$!.'((-*-!*'%*'!'2!4I$&)!*'!:#%&-!*'!%I%!%#%&',-%!*'!#$O)(,-.#5$[!2-!'M&'($-2#Q-.#5$!*'!%'(:#.#)%W!2-!-*,#$#%&(-.#5$!'2'.&(5$#.-!J!'2!.),'(.#)!'2'.&(5$#.)!V-$!*#2I#*)!2-%!O()$&'(-%D!/)(!)&(-!4-(&'W!'2!)(g6-$#6(-,-!#$&'($)!(-(-!:'Q!('%4)$*'!-!2-%!('%4)$%-1#2#*-*'%!'$!%'6I(#*-*D!
T)!%#6I#'$&'!UI'!V-J!UI'!&'$'(!.2-()W!'%.(#&)!J!,-$&'$#*)!'%!2-!4)2R&#.-!*'!%'6I(#*-*!.)(4)(-&#:-D!+!,'$I*)!2-!4)2R&#.-!*'!%'6I(#*-*!#$.2IJ'!2-!('2-.#5$!*'!2-!2'6#%2-.#5$!UI'!-O'.&-D!L%!-1%)2I&-,'$&'!$'.'%-(#)!*'2#,#&-(!'2!,-(.)!2'6#%2-&#:)!J!('6I2-&)(#)!-2!UI'!V-J!UI'!-&'$'(%'D!!
`)*)!*'1'!'%&-(!'%.(#&)D!o!1#'$!'%.(#&)[!%'!'$&#'$*'W!'%!.)V'('$&'W!%'!*#:I26-W!'%!.)$).#*)!4)(!2)%!#$:)2I.(-*)%!J!%'!,-$&#'$'!-2!*R-D!9$!4().'%)!*'!.'(&#O#.-.#5$!%#',4('!&#'$'!I$!OI'(&'!.),4)$'$&'!*'!(':#%#5$!*'!*).I,'$&-.#5$D!!
+$&'%!*'!UI'!:'$6-!'2!'UI#4)!':-2I-*)(W!V-J!UI'!&'$'(!I$-!O)&)!*'2!'%&-*)!*'!(#'%6)!*'!2-!E(6-g$#Q-.#5$D!L%!*'.#(W!UI'!V-J!UI'!V-.'(!I$!-$82#%#%!*'! (#'%6)%! #*'$&#O#.-$*)!-.&#:)%W!:-2)(8$*)2)%W!#*'$&#O#.-$*)! J! :-2)(-$*)! 2-%!-,'$-Q-%!%#6$#O#.-&#:-%D!L$!'%&'!4().'%)!%'!*'&'(,#$-!UI;!%-2:-g6I-(*-%!('UI#'('!'2!%#%&',-!J!.)$!UI;!.-2#*-*D!3-*-!.-%)!'%!I$!,I$*)!-4-(&'[!$#!&)*)!'2!,I$*)!&#'$'!2)%!,#%,)%!-.&#:)%W!$#!:-2'$!2)!,#%,)W!$#!'%&8$!#6I-2,'$&'!#$&'(.)$'.&-*)%W!$#!&)*)!'2!,I$*)!'%&8!%IF'&)!-!2-%!,#%,-%!-,'$-Q-%W!$#!&)*)!'2!,I$*)!-*)4&-!2-!,#%,-!'%&(-&'6#-!4-(-!4()&'6'(%'D!L2!.-%)!'%!&'$'(!I$-!'%&(-&'6#-W!,-(.-*-!4)(!2-!4)2R&#.-!J!'2!*'&-22'!*'2!,-4-!*'!(#'%6)%D!
L2!-$82#%#%!*'!(#'%6)%!'%!I$-!V'((-,#'$&-!?#,4('%.#$*#12'C!*'!6'%$D!/)(!V-.'(!)!*'F-(!*'!V-.'(!I$!-$82#%#%!*'!(#'%6)%!$)!%'!'%&8!$#!,8%!$#!,'$)%!%'6I()[!%#,42','$&'W!%'!%-1'!*5$*'!%'!'%&8D!
"-6'(#&!:'(%#5$!<! ! L:-2I-.#5$!J!.'(&#O#.-.#5$!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!@@N!?*'!@ABC!
T)%!('%I2&-*)%!*'2!-$82#%#%!*'!(#'%6)%!4'(,#&'$!'2-1)(-(!I$!*).I,'$&)!*'!%'2'..#5$!*'!.)$&()2'%W!-%R!.),)!I$-!FI%&#O#.-.#5$!*'! 2-!.-2#*-*!UI'!*'1'$!&'$'(D!`)*)!'%&)!*'1'(8!%'(!:'(#O#.-*)!4)(!'2!'UI#4)!':-2I-*)(!UI'W!*'!UI'*-(!%-&#%O'.V)W!-:-2-(8!2-!.)$.'%#5$!*'2!.'(&#O#.-*)D!
L2!'UI#4)!':-2I-*)(!#$%4'..#)$-!'2!%#%&',-!*'!#$O)(,-.#5$!UI'!%'!*'%'-!.'(&#O#.-(!.)$&(-%&8$*)2)!.)$!I$-!('O'('$.#-!('.)$).#*-!UI'!4'(,#&-!)1F'&#:-(!2-!':-2I-.#5$!-!O#$!*'!':#&-(!.I-2UI#'(!)!*'!-(1#&(-(#'*-*!)!%I1F'&#:#*-*!J!4'(,#&#(!2-!I#Q-.#5$!I$#:'(%-2!*'!2-%!.'(&#O#.-.#)$'%!',#&#*-%D!]'!I&#g2#Q-!I$!j'%UI',-!*'!.'(&#O#.-.#5$k!?4)(!'F',42)W!'$!L%4-c-W!*#%4)$',)%!*'!2-!$)(,-!97L!K@AS<CD!
T-!$)(,-!97L!K@AS<[<SSB! &#'$'!4)(!)1F'&)! 2-!'%4'.#O#.-.#5$!*'! j2)%! ('UI#%#&)%!4-(-!'%&-12'.'(W!#,42-$&-(W! *).I,'$&-(! J! ':-2I-(! I$! ]#%&',-! *'!^'%$! *'! 2-! ]'6I(#*-*! *'! 2-! H$O)(,-.#5$! *'!-.I'(*)!.)$!2-!$)(,-!97L!H]EdHL3!@KKPP[<SS<!*'$&()!*'2!.)$&'M&)!*'!2)%!(#'%6)%!#*'$&#O#.-*)%!4)(!2-%!)(6-$#Q-.#)$'%D!L%4'.#O#.-!2)%!('UI#%#&)%!*'!2)%!.)$&()2'%!*'!%'6I(#*-*!*'!-.I'(*)!.)$!2-%!$'.'%#*-*'%!*'!2-%!)(6-$#Q-.#)$'%!.)$!#$*'4'$*'$.#-!*'!%I!)W!&-,-c)!)!8('-!*'!-.&#:#*-*Dk!
T-!$)(,-!97L!K@AS<[<SSB!4-(&'!*'!I$-!('2-.#5$!*'!.)$&()2'%!1-%-*-!'$!2-!$)(,-!97LgH]EdHL3!@KKPP[<SS<W!('2-.#5$!UI'!V-J!UI'!-FI%&-(!-!2-!)(6-$#Q-.#5$!%IF'&-!-!':-2I-.#5$W!)1:#-$*)!2)%!'2'g,'$&)%!UI'!$)!%)$!4'(&#$'$&'%D!\'!.)$%#*'(-(%'!$'.'%-(#)!%'!%'2'..#)$-(8$!.)$&()2'%!'%4'.RO#.)%!-*#.#)$-2'%W! OI'(-! *'! 2-! 97LgH]EdHL3! @KKPPW! 4-(-! .-*-! )(6-$#Q-.#5$W! -*'.I-*)%! -! %I!,)*'2)!4-(&#.I2-(!*'!$'6).#)W!-%R!.),)!2)%!)1F'&#:)%!UI'!%'!4('&'$*'$!)1&'$'(!.)$!2)%!,#%,)%W!FI%&#O#.-$g*)!2-!%'2'..#5$D!
T-!('2-.#5$!18%#.-!'%!2-!%#6I#'$&'[!
Política de seguridad
Z':#%#5$!J!':-2I-.#5$!4'(#5*#.-!*'!2-!4)2R&#.-!*'!%'6I(#*-*!
3)$&()2!J!6'%$!*'!2-!*).I,'$&-.#5$!
Aspectos organizativos para la seguridad
+%#6$-.#5$!*'!('%4)$%-1#2#*-*'%!%)1('!]'6I(#*-*!*'!2-!H$O)(,-.#5$!
H*'$&#O#.-.#5$!*'!(#'%6)!4)(!'2!-..'%)!*'!&'(.'()%!
3)$&(-&-.#5$!*'!%'(:#.#)%!
3)$&(-&-.#5$!*'!)I&%)I(.#$6!
3)$&(-&-.#5$!*'!',4('%-%!.)2-1)(-*)(-%!
Clasificación y control de activos
H$:'$&-(#)!*'!-.&#:)%!
32-%#O#.-.#5$!*'!-.&#:)%!
32-%#O#.-.#5$!*'!2-!#$O)(,-.#5$!
Z':#%#5$!J!.2-%#O#.-.#5$!4'(#5*#.-!*'!-.&#:)%!
Z':#%#5$!4'(#5*#.-!*'2!-$82#%#%!*'!(#'%6)%!
"-(.-*)!J!&(-&-,#'$&)!*'!2-!#$O)(,-.#5$!
Seguridad ligada al personal
3)$&(-&-.#5$!*'2!4'(%)$-2!
e)(,-.#5$!
3),I$#.-.#5$!*'!#$.#*'$.#-%!
Seguridad física y del entorno
H$%&-2-.#5$!J!4()&'..#5$!*'!2)%!'UI#4)%!
"-$&'$#,#'$&)!*'!2)%!'UI#4)%!
Gestión de comunicaciones y operaciones
/().'%)%!)4'(-&#:)%!
3)$&()2!*'!.-,1#)%!
^'%$!*'!#$.#*'$.#-%!
"-6'(#&!:'(%#5$!<! ! L:-2I-.#5$!J!.'(&#O#.-.#5$!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!@@P!?*'!@ABC!
"'*#*-%!J!.)$&()2'%!.)$&(-!software!*-c#$)!
Z'.I4'(-.#5$!*'!#$O)(,-.#5$!
^'%$!*'!%)4)(&'%!(',):#12'%!
L2#,#$-.#5$!*'!%)4)(&'%!
]'6I(#*-*!*'2!.)((')!'2'.&(5$#.)!
\#%4)$#1#2#*-*!*'!%#%&',-%!4012#.)%!
3)$&()2!*'!'$&(-*-W!-2,-.'$-,#'$&)!J!%-2#*-!*'!#$O)(,-.#5$!
+$82#%#%!J!6'%$!*'!('6#%&()%!
/2-$#O#.-.#5$!*'!2-!.-4-.#*-*!*'2!%#%&',-!
H$&'(.-,1#)!OR%#.)!*'!#$O)(,-.#5$!
H$&'(.-,1#)!256#.)!*'!#$O)(,-.#5$!
+I&)(#Q-.#5$!*'!%-2#*-!*'!,-&'(#-2!Jd)!#$O)(,-.#5$!
3)4#-%!*'!('%4-2*)!J!('%&-I(-.#5$!
Control de accesos
H*'$&#O#.-.#5$!J!-I&'$&#.-.#5$!*'!I%I-(#)%!
Z'%&(#..#5$!*'!-..'%)!-!2-!#$O)(,-.#5$!
3)$&()2!*'!-..'%)!-!2-!('*!
3)$&()2!*'!-..'%)!-2!%#%&',-!)4'(-&#:)!
3)$&()2!*'!-..'%)!256#.)!-!2-!#$O)(,-.#5$!
^'%$!*'!.)$&(-%'c-%!
^'%$!(',)&-!*'!'UI#4)%!
Desarrollo y mantenimiento de sistemas
3)$&()2!*'2!4-%)!*'!*'%-(()22)!-!4(I'1-%!
3)$&()2!*'!4-%)!*'!4(I'1-%!-!4()*I..#5$!
3)$&()2!*'!.-,1#)%!*'!%#%&',-!)4'(-&#:)!
3)$&()2!*'!.-,1#)%!'$!'2!software
]'2'..#5$W!.)$&()2!J!-4()1-.#5$!*'!software!'M&'($)!
3)$&()2!*'2!*#%'c)!*'!-42#.-.#)$'%!
L%4'.#O#.-.#5$!*'!2)%!('UI'(#,#'$&)%!*'!%'6I(#*-*!
3)$&()2!*'!software!'$!)4'(-.#5$!
Gestión de continuidad del negocio
^'%$!*'!2-!.)$&#$I#*-*!*'!$'6).#)!
"-$&'$#,#'$&)!J!':-2I-.#5$!*'!2)%!42-$'%!*'!.)$&#$I#*-*!
Conformidad
H*'$&#O#.-.#5$!*'!2-!2'6#%2-.#5$!-42#.-12'!
Z':#%#5$!*'!.I,42#,#'$&)!*'!2'6#%2-.#5$!
+I*#&)(R-%!#$&'($-%!
4.1.2. La acreditación de la entidad certificadora
T-! .('*#1#2#*-*! *'2! .'(&#O#.-*)!'%! 2-! .)$O#-$Q-!UI'!,'('Q.-!'2! .'(&#O#.-*)(D! X35,)!%'! .)$%&(IJ'!'%&-!.)$O#-$Q-Y!!
9$!.),4)$'$&'!'%'$.#-2!'%!2-!.('*#1#2#*-*!*'2!'%UI',-!*'!.'(&#O#.-.#5$D!9$!%'6I$*)!.),4)$'$&'!'%!2-!.('*#1#2#*-*!*'!2-!)(6-$#Q-.#5$!UI'!',#&'!2)%!.'(&#O#.-*)%D!L%&-!)(6-$#Q-.#5$!'%!('%4)$%-12'!*'!2-!.),4'&'$.#-!*'2!'UI#4)!':-2I-*)(!J!*'!2-!'F'.I.#5$!*'2!4().'%)!*'!':-2I-.#5$D!/-(-!.'(&#O#g.-(! UI'! '%&-%! ('%4)$%-1#2#*-*'%! %'! .I,42'$! %'! 4().'*'! -2! 22-,-*)! j4().'%)! *'! -.('*#&-.#5$k!*)$*'! I$-! $I':-! )(6-$#Q-.#5$! ':-20-! -2! ':-2I-*)(D! L$! L%4-c-W! 2-! )(6-$#Q-.#5$! '$.-(6-*-! *'!
"-6'(#&!:'(%#5$!<! ! L:-2I-.#5$!J!.'(&#O#.-.#5$!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!@<S!?*'!@ABC!
-.('*#&-(!)(6-$#%,)%!.'(&#O#.-*)('%!'%!L7+3W!UI'!%'!-.)6'!-!2-!$)(,-&#:-!#$&'($-.#)$-2!*'!('.)g$).#,#'$&)!,I&I)!*'!.'(&#O#.-*)%!',#&#*)%!4)(!*#O'('$&'%!.'(&#O#.-*)('%!'$!*#O'('$&'%!4-R%'%D!
4.1.3. Terminología
]'!('.)6'$!-!.)$&#$I-.#5$!2)%!&;(,#$)%!I%-*)%!'$!2-%!-.&#:#*-*'%!*'!.'(&#O#.-.#5$!*'!%#%&',-%!*'!#$O)(,-.#5$W!&-2!J!.),)!%'!'$&#'$*'$!'$!'%&'!.)$&'M&)D!
Acreditación
/().'*#,#'$&)!,'*#-$&'! '2! .I-2! I$!E(6-$#%,)! -I&)(#Q-*)! ('.)$).'! O)(,-2,'$&'! UI'! I$-!)(6-$#Q-.#5$!'%!.),4'&'$&'!4-(-!2-!('-2#Q-.#5$!*'!I$-!*'&'(,#$-*-!-.&#:#*-*!*'!':-2I-.#5$!*'!2-!.)$O)(,#*-*D!!
Auditoría
_'(!j':-2I-.#5$kD!
Certificación
L2!)1F'&#:)!*'!2-!.'(&#O#.-.#5$!'%!j*'.2-(-(!4012#.-,'$&'!UI'!I$!4()*I.&)W!4().'%)!)!%'(:#.#)!'%!.)$O)(,'!.)$!('UI#%#&)%!'%&-12'.#*)%k!D!
Certification: A comprehensive assessment of the management, operational, and technical security controls in an information system, made in support of security accreditation, to de-termine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting the security requirements for the system.!p7H]`!]/!NSSg>Kq!
Documento de certificación (o registro)
\).I,'$&)!UI'!-O#(,-!UI'!'2!%#%&',-!*'!6'%$!*'!2-!%'6I(#*-*!*'!2-!#$O)(,-.#5$!?]^]HC!*'!I$-!)(6-$#Q-.#5$!'%!.)$O)(,'!-!2-!$)(,-&#:-!*'!('O'('$.#-!-*-4&-*-!-!2-!%#$6I2-(#*-*!*'!2-!)(6-$#Q-.#5$!.'(&#O#.-*-D!
Documento de selección de controles
\).I,'$&)!UI'!*'%.(#1'! 2)%!)1F'&#:)%!*'!.)$&()2!J! 2)%!.)$&()2'%! ('2':-$&'%!J!-42#.-12'%!-2!]#%&',-!*'!^'%$!*'!2-!]'6I(#*-*!*'!2-!H$O)(,-.#5$!*'!2-!)(6-$#Q-.#5$D!a%&'!*).I,'$&)!*'1'! '%&-(! 1-%-*)! '$! 2)%! ('%I2&-*)%! J! .)$.2I%#)$'%! *'2! 4().'%)! *'! -$82#%#%! J! 6'%$! *'!(#'%6)%D!!
Esquema de certificación
"-(.)!&;.$#.)!J!-*,#$#%&(-&#:)!UI'!'%&-12'.'!2-!('O'('$.#-!*'!&(-1-F)!O('$&'!-!2-!UI'!%'!.)$g&(-%&-!'2!.I,42#,#'$&)!*'!2-!)(6-$#Q-.#5$!%),'&#*-!-!':-2I-.#5$W!%'!',#&'!'2!.'(&#O#.-*)!)!('g6#%&()!J!%'!,-$&#'$'!-.&I-2#Q-*)!J!:82#*)D!
Evaluación
3)$FI$&)! *'! -.&#:#*-*'%! UI'! 4'(,#&'$! *'&'(,#$-(! %#! 2-! )(6-$#Q-.#5$! %-&#%O-.'! 2)%! .(#&'(#)%!-42#.-12'%!*'$&()!*'2!'%UI',-!*'!.'(&#O#.-.#5$D!H$.2IJ'!-.&#:#*-*'%!4('4-(-&)(#-%W!(':#%#5$!*'!2-!*).I,'$&-.#5$W!#$%4'..#5$!*'2!%#%&',-!*'!#$O)(,-.#5$!J!2-!4('4-(-.#5$!*'!2-!*).I,'$&-g.#5$!4'(&#$'$&'!4-(-!2-!',#%#5$!*'2!.'(&#O#.-*)!*'!.)$O)(,#*-*W!%#!4().'*'D!
Organismo de certificación (o registro)
L$&#*-*!UI'W!-!2-!:#%&-!*'2!#$O)(,'!*'!':-2I-.#5$W!!.'(&#O#.-!?)!('6#%&(-C!2-!%-&#%O-..#5$!4)(!2-!)(6-$#Q-.#5$!*'!2)%!('UI#%#&)%!'%&-12'.#*)%!'$!'2!'%UI',-!*'!.'(&#O#.-.#5$D!
Organismos de evaluación de la conformidad
])$! 2)%! '$.-(6-*)%! *'! ':-2I-(! J! ('-2#Q-(! I$-! *'.2-(-.#5$! )1F'&#:-! *'! UI'! 2)%! %'(:#.#)%! J!4()*I.&)%!.I,42'$!I$)%! ('UI#%#&)%!'%4'.RO#.)%W!J-!%'-$!*'2!%'.&)(! ('62-,'$&-(#)!)!*'2!:)g2I$&-(#)D!!
Política de seguridad
3)$FI$&)!*'!$)(,-%!('6I2-*)(-%W!('62-%!J!4(8.&#.-%!UI'!*'&'(,#$-$!'2!,)*)!'$!UI'!2)%!-.&#g:)%W! #$.2IJ'$*)! 2-! #$O)(,-.#5$! .)$%#*'(-*-! .),)! %'$%#12'W! %)$! 6'%&#)$-*)%W! 4()&'6#*)%! J!*#%&(#1I#*)%!*'$&()!*'!I$-!)(6-$#Q-.#5$D!
"-6'(#&!:'(%#5$!<! ! L:-2I-.#5$!J!.'(&#O#.-.#5$!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!@<@!?*'!@ABC!
4.1.4. Referencias
!" H]EdHL3! @KKPP[<SSAW! “Information technology -- Code of practice for information security management”, <SSAD!
!" 97L!K@AS<[<SSBW!“Especificaciones para los Sistemas de Gestión de la Seguridad de la In-formación (SGSI)”, <SSBD!
!" 97LgH]EdHL3!@KKPP[<SS<W!“Tecnología de la Información. Código de Buenas Prácticas de la Gestión de la Seguridad de la Información”, <SS<D!
!" H]E!^I#*'!K<[<SS@W!“Guidelines for the justification and development of management system standards”, <SS@D!
!" LI()4'-$!3)gE4'(-&#)$!O)(!+..('*#&-&#)$W!j^I#*'2#$'%!O)(!&V'!+..('*#&-&#)$!)O!f)*#'%!E4'(-&g#$6!3'(&#O#.-&#)$!d!Z'6#%&(-&#)$!)O!H$O)(,-&#)$!]'.I(#&J!"-$-6','$&!]J%&',%kW!EA-7/03, Feb-ruary 2000.
4.2. Criterios comunes de evaluación (CC) T-!$'.'%#*-*!*'!':-2I-(!2-!%'6I(#*-*!*'!I$!%#%&',-!*'!#$O)(,-.#5$!-4-('.'!,IJ!&',4(-$)!*'!2-!,-$)!*'!2)%!4().'%)%!*'!-*UI#%#.#5$!*'!'UI#4)%!*'2!\'4-(&-,'$&)!*'!\'O'$%-!*'!2)%!LL99!UI'W!'$!@PN>W!4I12#.-!'2!22-,-*)!jT#1()!7-(-$F-k!?`3]L3!b!Trusted Computer System Evaluation Crite-riaCD!L2!)1F'&#:)!'%!'%4'.#O#.-(!%#$!-,1#6l'*-*!UI;!%'!$'.'%#&-!4)(!4-(&'!*'2!.),4(-*)(!J!UI;!%'!)O('.'!4)(!4-(&'!*'2!:'$*'*)(W!*'!O)(,-!UI'!$)!V-J-!,-2'$&'$*#*)%!%#$)!I$!'%UI',-!&(-$%4-('$g&'!*'!':-2I-.#5$W!6-(-$&#Q-$*)!2-!)1F'&#:#*-*!*'!2-%!-*UI#%#.#)$'%D!
T-!,#%,-!$'.'%#*-*!22':-!-!2-!-4-(#.#5$!*'!#$#.#-&#:-%!'I()4'-%!.),)!H`]L3!(Information Techno-logy Security Evaluation Criteria). +!,'*#-*)%!*'!2)%!-c)%!PSW!'M#%&'!'$!'2!,I$*)!I$-!4()2#O'(-.#5$!*'!.(#&'(#)%!*'!':-2I-.#5$!UI'!*#O#.I2&-!'$)(,','$&'!'2!.),'(.#)! #$&'($-.#)$-2W! 22'68$*)%'!-!I$!-.I'(*)!*'!.)$:'(6'$.#-!UI'!('.#1'!'2!$),1('!*'! “Common Criteria for Information Technology Security Evaluation”, $)(,-2,'$&'!.)$).#*)%!.),)!j3(#&'(#)%!3),I$'%k!)!4)(!%I%!%#62-%W!33D!
T)%!33W!-*',8%!*'!2-!$'.'%#*-*!*'!I$!'$&'$*#,#'$&)!I$#:'(%-2W!.-4&I(-$!2-!$-&I(-2'Q-!.-,1#-$&'!*'!2-%!&'.$)2)6R-%!*'!2-!#$O)(,-.#5$!UI'W!'$!'2!4'(#)*)!*'%*'!@PNSW!V-$!4-%-*)!*'!'%&-(!.'$&(-g*-%!'$!2)%!'UI#4)%!*'!.),4I&-.#5$W!-!'$62)1-(!%#%&',-%!*'!#$O)(,-.#5$!,I.V)!,8%!.),42'F)%D!
T)%!33!4'(,#&'$!
@D! *'O#$#(!2-%!OI$.#)$'%!*'!%'6I(#*-*AS!*'!2)%!4()*I.&)%!J!%#%&',-%!?'$!&'.$)2)6R-%!*'!2-!#$O)(g,-.#5$C!J!
<D! *'&'(,#$-(!2)%!.(#&'(#)%!4-(-!':-2I-(!p2-!.-2#*-*q!*'!*#.V-%!OI$.#)$'%D!
L%!'%'$.#-2!2-!4)%#1#2#*-*!UI'!2)%!33!-1('$!4-(-!UI'!2-!':-2I-.#5$!%'-!)1F'&#:-!J!4I'*-!('-2#Q-(%'!4)(!I$-! &'(.'(-!4-(&'! ?$#!4)(!'2!4():''*)(W!$#!4)(!'2!I%I-(#)C!*'! O)(,-!UI'! 2-!'2'..#5$!*'!%-2:-g6I-(*-%!-*'.I-*-%!%'!:'-!$)&-12','$&'!%#,42#O#.-*-!4-(-!2-%!)(6-$#Q-.#)$'%!UI'!$'.'%#&-$!,#&#g6-(!%I%!(#'%6)%D!
T-!-*,#$#%&(-.#5$!'%4-c)2-W!J!)&(-%!,I.V-%W!('.)$).'$!2-%!.'(&#O#.-.#)$'%!*'!%'6I(#*-*!',#&#*-%!'$!)&()%!4-R%'%!'$!1-%'!-2!j+(('62)!%)1('!'2!Z'.)$).#,#'$&)!*'!2)%!3'(&#O#.-*)%!*'!3(#&'(#)%!3)g,I$'%!'$!'2!3-,4)!*'!2-!`'.$)2)6R-!*'!2-!H$O)(,-.#5$kA@D!
T-!':-2I-.#5$!*'!I$!%#%&',-!'%!2-!1-%'!4-(-!%I!.'(&#O#.-.#5$D!/-(-!.'(&#O#.-(!'%!$'.'%-(#)!*#%4)$'(!*'!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
AS!L$!33!%'!',42'-!I$-!&'(,#$)2)6R-!4()4#-W!(#6I()%-!4'()!$)!%#',4('!#$&I#&#:-D!"8%!-*'2-$&'!%'!('.)6'!2-!*'O#$#.#5$!4('.#%-!*'!.-*-!&;(,#$)!'$!'2!.)$&'M&)!*'!2)%!33D!
A@!L2!*R-!<>!*'!,-J)!*'!<SSS!&I:)!2I6-(!'$!f-2&#,)('!?"-(J2-$*W!L%&-*)%!9$#*)%C!2-!(-&#O#.-.#5$!*'!2-!-*gV'%#5$!*'!+2',-$#-W!+I%&(-2#-W!3-$-*8W!L%4-c-W!L%&-*)%!9$#*)%W!e#$2-$*#-W!e(-$.#-W!^('.#-W!H&-2#-W!7)g(I'6-W!7I':-!�'2-$*-W!/-R%'%!f-F)%!J!Z'#$)!9$#*)W!-2!+(('62)!%)1('!'2!Z'.)$).#,#'$&)!*'!2)%!3'(&#O#.-g*)%!*'!3(#&'(#)%!3),I$'%!'$!'2!.-,4)!*'!2-!]'6I(#*-*!*'!2-!`'.$)2)6R-!*'!2-!H$O)(,-.#5$!?'$!2)!%I.'%#g:)!+(('62)CD!/)%&'(#)(,'$&'W!%'!V-$!#$.)(4)(-*)!H%(-'2W!]I'.#-W!+I%&(#-W!`I(UIR-W!iI$6(R-W!x-45$W!Z'40g12#.-!3V'.-W!3)('-W!]#$6-4I(!'!H$*#-D!_;-%'!V&&4[ddyyyD.%#D,-4D'%d.%#d46>B>>DV&,D!
"-6'(#&!:'(%#5$!<! ! L:-2I-.#5$!J!.'(&#O#.-.#5$!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!@<<!?*'!@ABC!
@D! I$)%!.(#&'(#)%W!UI'!*'O#$'$!'2!%#6$#O#.-*)!*'!2)%!'2','$&)%!UI'!%'!:-$!-!':-2I-(!
<D! I$-!,'&)*)2)6R-W!UI'!,-(UI'!.5,)!%'!22':-!-!.-1)!2-!':-2I-.#5$!
>D! I$!'%UI',-!*'!.'(&#O#.-.#5$A<!UI'! O#F'!'2!,-(.)!-*,#$#%&(-&#:)!J! ('6I2-&)(#)!1-F)!'2!UI'!%'!('-2#Q-!2-!.'(&#O#.-.#5$!
!
!
\'!'%&-!O)(,-!%'!4I'*'!6-(-$&#Q-(! 2-!)1F'&#:#*-*!*'2!4().'%)h!'%!*'.#(W!.)$%&(I#(! 2-!.)$O#-$Q-!'$!UI'!2)%!('%I2&-*)%!*'!I$!4().'%)!*'!.'(&#O#.-.#5$!%)$!:82#*)%!I$#:'(%-2,'$&'W!#$*'4'$*#'$&','$&'!*'!*5$*'!%'!('-2#.'!2-!.'(&#O#.-.#5$D!
\-*)!UI'!p2-!.-2#*-*!*'q!2-!%'6I(#*-*!('UI'(#*-!*'!I$!%#%&',-!$)!'%!%#',4('!2-!,#%,-W!%#$)!UI'!*'4'$*'!*'!4-(-!UI;!%'!UI#'(-!',42'-(W!33!'%&-12'.'!I$-!'%.-2-!*'!$#:'2'%!*'!-%'6I(-,#'$&)A>[!
EAL0: sin garantías
EAL1: 4()1-*)!OI$.#)$-2,'$&'!
EAL2: 4()1-*)!'%&(I.&I(-2,'$&'!
EAL3: 4()1-*)!J!.V'UI'-*)!!,'&5*#.-,'$&'!
EAL4: *#%'c-*)W!4()1-*)!J!(':#%-*)!,'&5*#.-,'$&'!
EAL5: *#%'c-*)!J!4()1-*)!%',#gO)(,-2,'$&'!
EAL6: *#%'c-*)W!4()1-*)!J!:'(#O#.-*)!%',#gO)(,-2,'$&'!
EAL7: *#%'c-*)W!4()1-*)!J!:'(#O#.-*)!O)(,-2,'$&'!
T)%!$#:'2'%!%I4'(#)('%! ('UI#'('$!I$!,-J)(!'%OI'(Q)!*'!*'%-(()22)!J!*'!':-2I-.#5$W!)O('.#'$*)!-!.-,1#)!I$-%!6(-$*'%!6-(-$&R-%!-!2)%!I%I-(#)%D!/)(!'F',42)W!'$!'2!8,1#&)!*'!2-!O#(,-!'2'.&(5$#.-W!2)%!*#%4)%#&#:)%!%'6I()%!*'!O#(,-!%I'2'$!.'(&#O#.-(%'!.)$&(-!I$!4'(O#2!*'!$#:'2!L+TB�ABD!
4.2.1. Beneficiarios
T)%!33!%'!*#(#6'$!-!I$-!-,42#-!-I*#'$.#-!*'!4)&'$.#-2'%!1'$'O#.#-(#)%!*'!2-!O)(,-2#Q-.#5$!*'!2)%!.)$.'4&)%!J!'2','$&)%!*'!':-2I-.#5$[!2)%!.)$%I,#*)('%!?I%I-(#)%!*'!4()*I.&)%!*'!%'6I(#*-*CW!2)%!*'%-(()22-*)('%!J! 2)%!':-2I-*)('%D!9$! 2'$6I-F'! .),0$!'$&('! &)*)%!'22)%! %'! &(-*I.'!'$!:'$&-F-%!-4('.#-12'%[!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
A<!L2!Z'-2!\'.('&)!B<@d<SSB!*'!@<!*'!,-(Q)W!('6I2-!2-%!OI$.#)$'%!*'2!3'$&()!3(#4&)256#.)!7-.#)$-2W!'$&('!.IJ-%!OI$.#)$'%!-4-('.'!2-!*'!j.)$%&#&I#(!'2!)(6-$#%,)!*'!.'(&#O#.-.#5$!*'2!'%UI',-!$-.#)$-2!*'!':-2I-g.#5$!J!.'(&#O#.-.#5$!*'!2-!%'6I(#*-*!*'!2-%!&'.$)2)6R-%!*'!#$O)(,-.#5$W!*'!-42#.-.#5$!-!4()*I.&)%!J!%#%&'g,-%!'$!%I!8,1#&)Dk!L2!'%UI',-!$-.#)$-2!4I'*'!'$.)$&(-(%'!'$!V&&4[ddyyyD).D..$D.$#D'%d!D!
A>!L+T[!L:-2I-&#)$!+%%I(-$.'!T':'2!AB!3I-$*)!I$!4()*I.&)!'%&8!'$&('!*)%!$#:'2'%W!%'!#$*#.-!%I!$#:'2!#$O'(#)(!%'6I#*)!*'!I$!%#6$)!j�k!UI'!%'!2''!.),)!j-I,'$&-*)kD!+%RW!I$!4()*I.&)!':-2I-*)!L+TB�!!%#6$#O#.-!UI'!.I,42'!&)*)%!2)%!$#:'2'%!*'!.-2#*-*!*'2!$#:'2!B!J!-26I$)%!*'!$#:'2'%!%I4'(#)('%D!
"-6'(#&!:'(%#5$!<! ! L:-2I-.#5$!J!.'(&#O#.-.#5$!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!@<>!?*'!@ABC!
Para los consumidores
!" UI'!4I'*'$!'M4('%-(!%I%!$'.'%#*-*'%W!-$&'%!*'!-*UI#(#(!2)%!%'(:#.#)%!)!4()*I.&)%!UI'!2-%!%-&#%O-6-$h! '%&-! .-(-.&'(#Q-.#5$! 4I'*'! ('%I2&-(! 0! &-$&)! '$! -*UI#%#.#)$'%! #$*#:#*I-2'%W!.),)!'$!2-!#*'$&#O#.-.#5$!*'!$'.'%#*-*'%!*'!6(I4)%!*'!I%I-(#)%!
!" UI'!4I'*'$!-$-2#Q-(!2-%!.-(-.&'(R%&#.-%!*'!2)%!%'(:#.#)%!)!4()*I.&)%!UI'!)O('.'!'2!,'(.-g*)!
!" UI'!4I'*'$!.),4-(-(!*#O'('$&'%!)O'(&-%!
Para los desarrolladores
!" UI'!%-1'$!UI;!%'!2'%!:-!-!'M#6#(!J!.5,)!%'!:-$!-!':-2I-(!%I%!*'%-(()22)%!
!" UI'!%-1'$W!)1F'&#:-,'$&'W!UI;!('UI#'('$!2)%!I%I-(#)%!
!" UI'!4I'*'$!'M4('%-(!%#$!-,1#6l'*-*!2)!UI'!V-.'$!%I%!*'%-(()22)%!
Para los evaluadores
!" UI'!*#%4)$'$!*'!I$!,-(.)!O)(,-2#Q-*)!4-(-!%-1'(!UI;!&#'$'$!UI'!':-2I-(!J!.5,)!&#'$'$!UI'!.-2#O#.-(2)!
Para todo el mundo
!" UI'!*#%4)$'!*'!I$)%!.(#&'(#)%!)1F'&#:)%!UI'!4'(,#&'$!-.'4&-(! 2-%!.'(&#O#.-.#)$'%!('-2#Q-g*-%!'$!.I-2UI#'(!4-(&'!
`)*)%!'%&)%!4-(&#.#4-$&'%!.)$:'(6'$!%)1('!I$!)1F'&)!-!':-2I-(!*'$),#$-*)!TOE (Target Of Eva-luationC, UI'!$)!'%!%#$)!'2!%'(:#.#)!)!4()*I.&)!?*'!%'6I(#*-*C!.IJ-%!.-(-.&'(R%&#.-%!?*'!%'6I(#*-*C!%'!UI#'('$!':-2I-(D!
3I-$*)!I$!-$82#%#%!*'!(#'%6)%!'M4)$'!2-!('2-.#5$!*'!%-2:-6I-(*-%!-*'.I-*-%W!'%&-%!4I'*'$!:'$#(!'M4('%-*-%!'$!&'(,#$)2)6R-!33W!2)!UI'!4'(,#&'!'$6-(Q-(!.)$!2-%!:'$&-F-%!.#&-*-%W!.)$:#(&#;$*)%'!'$!I$-!'%4'.#O#.-.#5$!$)(,-2#Q-*-D!
4.2.2. Requisitos de seguridad
\-*)!I$!%#%&',-!%'!4I'*'$!*'&'(,#$-(W!-!&(-:;%!*'!I$!-$82#%#%!*'!(#'%6)%W!UI;!%-2:-6I-(*-%!%'!('UI#'('$!J!.)$!UI;!.-2#*-*D!L%&'!-$82#%#%!4I'*'!V-.'(%'!%)1('!I$!%#%&',-!6'$;(#.)!)!%)1('!I$!%#%&',-!.)$.('&)D!L$!33W!'2!.)$FI$&)!*'!('UI#%#&)%!UI'!%'!2'!'M#6'$!-!I$!%#%&',-!6'$;(#.)!%'!*'g$),#$-!perfil de protección!?PP!b!Protection ProfileCD!]#!$)!%'!'%&8!V-12-$*)!*'!I$!%#%&',-!6'g$;(#.)W! %#$)!*'!I$! %#%&',-!.)$.('&)W!'2! .)$FI$&)!*'! ('UI#%#&)%! %'!.)$).'!.),)!declaración de seguridad ?ST!b!Security TargetCD!
T)%!//W!*-*)!%I!.-(8.&'(!6'$;(#.)W!.I1('$!*#O'('$&'%!4()*I.&)%!.)$.('&)%D!]I'2'$!%'(!4('4-(-*)%!4)(!6(I4)%!*'!I%I-(#)%!I!)(6-$#%,)%!#$&'($-.#)$-2'%!UI'!UI#'('$!,)*'2-(!'2!,'(.-*)AAD!
T)%!]`W!*-*)!%I!.-(8.&'(!'%4'.RO#.)W!.I1('$!I$!4()*I.&)!.)$.('&)D!]I'2'$!%'(!4('4-(-*)%!4)(!2)%!4()4#)%!O-1(#.-$&'%!UI'!*'!'%&-!,-$'(-!O)(,-2#Q-$!%I!)O'(&-AGD!
33!*'&'(,#$-!2)%!-4-(&-*)%!'$!UI'!*'1'!'%&(I.&I(-(%'!I$!//!)!I$!]`D!L2!R$*#.'!*'!'%&)%!*).Ig,'$&)%!'%!I$!1I'$!#$*#.-*)(!*'!%I!-2.-$.'[!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
AA!9$!'F',42)!&R4#.)!*'!//!4)*(R-!%'(!-UI'2!UI'!O#F-!2-%!.-(-.&'(R%&#.-%!*'!%'6I(#*-*!UI'!%'!*'1'$!'M#6#(!-!I$!.)(&-OI'6)%D!
AG!9$!'F',42)!&R4#.)!*'!]`!4)*(R-!%'(!-UI'2!UI'!O#F-!2-%!.-(-.&'(R%&#.-%!*'!%'6I(#*-*!*'2!,)*'2)!>SSS!*'2!O-1(#.-$&'!nnT!]D+DW!I$!,)*'2)!UI'!4'(,#&'!.#O(-(!2-%!.),I$#.-.#)$'%!&'2'O5$#.-%D!
"-6'(#&!:'(%#5$!<! ! L:-2I-.#5$!J!.'(&#O#.-.#5$!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!@<B!?*'!@ABC!
PP- perfil de protección ST – declaración de seguridad
!"H$&()*I.&#)$!!
!"`EL!*'%.(#4&#)$!!
!"]'.I(#&J!'$:#()$,'$&!!
!" -%%I,4&#)$%!!
!" &V('-&%!!
!" )(6-$#Q-&#)$-2!%'.I(#&J!4)2#.#'%!!
!"]'.I(#&J!)1F'.&#:'%!!
!" O)(!&V'!`EL!
!" O)(!&V'!'$:#()$,'$&!
!"]'.I(#&J!('UI#(','$&%!!
!" O)(!&V'!'$:#()$,'$&!
!" `EL!OI$.&#)$-2!('UI#(','$&%!!
!" `EL!-%%I(-$.'!('UI#(','$&%!!
!"+442#.-&#)$!$)&'%!
!"Z-&#)$-2'!!
!"H$&()*I.&#)$!!
!"`EL!*'%.(#4&#)$!!
!"]'.I(#&J!'$:#()$,'$&!!
!" -%%I,4&#)$%!!
!" &V('-&%!!
!" )(6-$#Q-&#)$-2!%'.I(#&J!4)2#.#'%!!
!"]'.I(#&J!)1F'.&#:'%!!
!" O)(!&V'!`EL!
!" O)(!&V'!'$:#()$,'$&!
!"]'.I(#&J!('UI#(','$&%!!
!" O)(!&V'!'$:#()$,'$&!
!" `EL!OI$.&#)$-2!('UI#(','$&%!!
!" `EL!-%%I(-$.'!('UI#(','$&%!!
!"`EL!%I,,-(J!%4'.#O#.-&#)$!!
!"//!.2-#,%!
!" //!('O'('$.'!
!" //!&-#2)(#$6!
!" //!-**#&#)$%!
!"Z-&#)$-2'!!
!
T)%!//!J!2)%!]`!4I'*'$!%'(!-!%I!:'Q!%),'&#*)%!-!I$-!':-2I-.#5$!O)(,-2!UI'!:'(#O#UI'!%I!.),42'&#g&I*!'!#$&'6(#*-*D!T)%!//!-%R!':-2I-*)%!4I'*'$!4-%-(!-!('6#%&()%!4012#.)%!4-(-!%'(!.),4-(&#*)%!4)(!*#O'('$&'%!I%I-(#)%D!
L$!2-!'2-1)(-.#5$!*'!I$!]`!%'!V-.'!('O'('$.#-!-!2)%!//!-!2)%!UI'!%'!-.)6'D!
4.2.3. Creación de perfiles de protección
T-!6'$'(-.#5$!*'!I$!//!)!I$!]`!'%!18%#.-,'$&'!I$!4().'%)!*'!-$82#%#%!*'!(#'%6)%!*)$*'!'2!-$-g2#%&-W! V-1#'$*)! *'&'(,#$-*)! '2! *),#$#)! *'2! -$82#%#%! ?'2! `EL! '$! &'(,#$)2)6R-! *'! 33CW! #*'$&#O#.-!-,'$-Q-%!J!*'&'(,#$-W!-!&(-:;%!*'!2)%!#$*#.-*)('%!*'!#,4-.&)!J!(#'%6)W!2-%!%-2:-6I-(*-%!UI'!%'!('UI#'('$D!L$! 2-! &'(,#$)2)6R-! *'!33W! 2-%! %-2:-6I-(*-%! ('UI'(#*-%! %'! *'$),#$-$! requisitos de seguridad J!%'!%I1*#:#*'$!'$!*)%!6(-$*'%!6(I4)%!
requisitos funcionales!*'!%'6I(#*-*!(functional requirements)
!" XUI;!V-J!UI'!V-.'(Y!
!" *'O#$'$!'2!.),4)(&-,#'$&)!OI$.#)$-2!*'2!`EL!
requisitos de garantía!*'!2-!OI$.#)$-2#*-*!*'!2-!%'6I(#*-*!(assurance requirements)
!" X'%&8!'2!`EL!1#'$!.)$%&(I#*)Y!
!" X'%!'O#.-QY!X%-&#%O-.'!'2!)1F'&#:)!4-(-!'2!UI'!%'!('UI#'('Y!
!" X'%!'O#.#'$&'Y!X-2.-$Q-!%I%!)1F'&#:)%!.)$!I$!.)$%I,)!(-Q)$-12'!*'!('.I(%)%Y!
L%! #,4)(&-$&'! *'%&-.-(! UI'! 33! '%&-12'.'! I$! 2'$6I-F'! .),0$! 4-(-! 'M4('%-(! 2)%! )1F'&#:)%!OI$.#)$-2'%! J! *'! -%'6I(-,#'$&)D! L%! $'.'%-(#)! 4I'%! UI'! '2! -$82#%#%! *'! (#'%6)%! I#.'! '%&-!&'(,#$)2)6R-! '$! 2-! %'2'..#5$! *'! %-2:-6I-(*-%D! T-! $)(,-! 33! $)%! 4()4)(.#)$-! '$! %I! 4-(&'! <! '2!.-&82)6)!'%&-$*-(#Q-*)!*'!)1F'&#:)%! OI$.#)$-2'%W!,#'$&(-%!UI'!'$!%I!4-(&'!>!$)%!4()4)(.#)$-!'2!.-&82)6)!'%&-$*-(#Q-*)!*'!)1F'&#:)%!*'!-%'6I(-,#'$&)D!
!
"-6'(#&!:'(%#5$!<! ! L:-2I-.#5$!J!.'(&#O#.-.#5$!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!@<A!?*'!@ABC!
Parte 2: Requisitos funcionales Parte 3: Requisitos de garantía
e+9[!]'.I(#&J!-I*#&!
e3E[!3),,I$#.-&#)$!!
e3][!3(J4&)6(-4V#.!%I44)(&!!
e\/[!9%'(!*-&-!4()&'.&#)$!
eH+[!H*'$&#O#.-&#)$!-$*!-I&V'$&#.-&#)$!!
e"`[!]'.I(#&J!,-$-6','$&!!
e/Z[!/(#:-.J!
e/`[!/()&'.&#)$!)O!&V'!`EL!%'.I(#&J!OI$.&#)$%!
eZ9[!Z'%)I(.'!I#%-&#)$!!
e`+[!`EL!-..'%%!
e`/[!`(I%&'*!4-&V!d!.V-$$'2%!
+3"[!3)$O#6I(-&#)$!,-$-6','$&!
+\E[!\'2#:'(J!-$*!)4'(-&#)$!
+\_[!\':'2)4,'$&!
+^\[!^I#*-$.'!*).I,'$&%!
+T3[!T#O'!.J.2'!%I44)(&!
+`L[!`'%&%!
+_+[!_I2$'(-1#2#&J!-%%'%%,'$&!
+/L[!//!':-2I-&#)$!
+]L[!]`!':-2I-&#)$!
!
!
!
4.2.4. Uso de productos certificados
3I-$*)!I$!`EL!V-!%#*)!.'(&#O#.-*)!*'!-.I'(*)!-!I$!//!)!I$!]`W!%'60$!.)$:'$6-!'$!.-*-!.-%)W!%'!4I'*'!&'$'(!2-!.'(&'Q-!*'!UI'!*#.V)!`EL!%-&#%O-.'!2-%!$'.'%#*-*'%!J!-*',8%!2-%!%-&#%O-.'!.)$!2-!.-2#*-*!('UI'(#*-!?4)(!'F',42)W!L+TBCD!
T-!.'(&#O#.-.#5$!*'!I$!%#%&',-!)!4()*I.&)!$)!'%!6-(-$&R-!.#'6-!*'!#*)$'#*-*[!'%!$'.'%-(#)!.'(.#)g(-(%'!*'!UI'!'2!//!)!]`!('%4'.&)!*'2!UI'!%'!V-$!.'(&#O#.-*)!%-&#%O-.'!2)%!('UI#%#&)%!*'!$I'%&()!%#%g&',-D!L2!-$82#%#%!*'!(#'%6)%!$)%!V-!4'(,#&#*)!'2-1)(-(!'2!//!)!'2!]`!)W!'$!).-%#)$'%W!%'2'..#)$-(!I$!.)$FI$&)!-4()4#-*)!-!$I'%&()!,-4-!*'!(#'%6)%D!/'()!2)!'%'$.#-2!'%!UI'!*'!-$82#%#%!*'!(#'%6)%!%'!V-$!)1&'$#*)!I$)%!('UI#%#&)%!*'!%'6I(#*-*!.IJ-!%-&#%O-..#5$!4'(,#&#(8!,-$&'$'(!#,4-.&)!J!(#'%g6)!('%#*I-2'%!1-F)!.)$&()2D!
L$!2-!,'*#*-!'$!UI'!I$!4()*I.&)!.'(&#O#.-*)!%'!-FI%&-!-!I$!//!)!]`!UI'!%-&#%O-.'!$I'%&(-%!$'.'g%#*-*'%W!2-!6'%$!*'!(#'%6)%!%'!('*I.'!-!-*UI#(#(!'2!4()*I.&)W!#$%&-2-(2)!J!)4'(-(2)!'$!2-%!.)$*#g.#)$'%!-*'.I-*-%D!
L%!#,4)(&-$&'!*'%&-.-(!UI'!&-$&)!2)%!//!.),)!2)%!]`!#$.2IJ'$!I$-!%'..#5$!*'$),#$-*-!jV#45&'g%#%k!(assumptions) '$!2-!UI'!%'!'%&-12'.'$!I$-!%'(#'!*'!4('(('UI#%#&)%!UI'!*'1'!%-&#%O-.'(!'2!'$g&)($)!)4'(-.#)$-2!'$!'2!UI'!%'!#$%&-2-!`ELD!7)!%'!V-.'!%#$)!('.)$).'(!UI'!'2!,'F)(!4()*I.&)W!#$g-*'.I-*-,'$&'!#$%&-2-*)!I!)4'(-*)W!'%!#$.-4-Q!*'!6-(-$&#Q-(!2-!%-&#%O-..#5$!*'!2)%!)1F'&#:)%!62)g1-2'%D!/)(!'22)W!2)%!4()*I.&)%!.'(&#O#.-*)%!%)$!.),4)$'$&'%!,IJ!%52#*)%!*'!I$!%#%&',-h!4'()!-*'g,8%!V-J!UI'!6-(-$&#Q-(!%I!'$&)($)!4-(-!-%'6I(-(!'2!%#%&',-!.),42'&)D!
4.2.5. Terminología
\'1#*)!-!UI'!%I!)1F'&#:)!'%!%'(:#(!*'!('O'('$.#-!#$&'($-.#)$-2!J!%I%&'$&-(!':-2I-.#)$'%!J!.'(&#O#.-g.#)$'%W!2)%!.(#&'(#)%!.),I$'%!*'1'$!%'(!,IJ!4('.#%)%!'$!%I!&'(,#$)2)6R-D!L$!'2!&'M&)!4(':#)!%'!V-$!:'$#*)!#$&()*I.#'$*)!2)%!&;(,#$)%!%'60$!%'!$'.'%#&-1-$h!'%&)%!&;(,#$)%!%'!('.)6'$!O)(,-2,'$&'!-!.)$&#$I-.#5$[!
Assurance (garantía)
f-%'!*'!2-!.)$O#-$Q-!'$!UI'!I$-!'$&#*-*!.I,42'!%I%!)1F'&#:)%!*'!%'6I(#*-*D!
Evaluation (evaluación)
_-2)(-.#5$!*'!I$!//W!]`!)!`EL!O('$&'!-!.(#&'(#)%!*'O#$#*)%D!!
Evaluation Assurance Level (EAL) (nivel de garantía de evaluación)
/-UI'&'!UI'!.)$%#%&'!'$!.),4)$'$&'%!*'!6-(-$&R-!*'!2-!/-(&'!>!J!UI'!('4('%'$&-!I$!$#:'2!'$!2-!'%.-2-!*'!6-(-$&R-!4('*'O#$#*-!*'!33D!!
"-6'(#&!:'(%#5$!<! ! L:-2I-.#5$!J!.'(&#O#.-.#5$!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!@<G!?*'!@ABC!
Evaluation authority (autoridad de evaluación)
E(6-$#%,)!UI'! #,42','$&-! 2)%!33!4-(-!I$-!.),I$#*-*!'%4'.RO#.-!,'*#-$&'!I$!'%UI',-!*'!':-2I-.#5$!4)(!'2!UI'!%'!'%&-12'.'$!2-%!$)(,-%!J!%'!%I4'(:#%-!2-!.-2#*-*!*'!2-%!':-2I-g.#)$'%!('-2#Q-*-%!4)(!)(6-$#%,)%!*'!*#.V-!.),I$#*-*D!
Evaluation scheme (esquema de evaluación)
"-(.)!-*,#$#%&(-&#:)!J!('6I2-*)(!1-F)!'2!UI'!I$-!-I&)(#*-*!*'!':-2I-.#5$!-42#.-!2)%!33!'$!I$-!.),I$#*-*!'%4'.RO#.-D!
Formal
LM4('%-*)! '$! I$! 2'$6I-F'! *'! %#$&-M#%! ('%&(#$6#*-! .)$! I$-! %',8$&#.-! *'O#$#*-! 1-%-*-! '$!.)$.'4&)%!,-&',8&#.)%!1#'$!'%&-12'.#*)%D!
Informal
LM4('%-*)!'$!2'$6I-F'!$-&I(-2D!!
Organisational security policies (Políticas de seguridad organizativas )
9$-!)!,8%!('62-%!*'!%'6I(#*-*W!4().'*#,#'$&)%W!4(8.&#.-%!)!*#('.&(#.'%! #,4I'%&-%!4)(!I$-!)(6-$#Q-.#5$!%)1('!%I%!)4'(-.#)$'%D!
Product (producto)
/-UI'&'!*'!softwareW!firmware!Jd)!hardware!*'!`H!UI'!4()4)(.#)$-!I$-!OI$.#)$-2#*-*!*#%'gc-*)!4-(-!%I!I%)!)!%I!#$.)(4)(-.#5$!'$!I$-!6(-$!:-(#'*-*!*'!%#%&',-%D!
Protection Profile (PP) (perfil de protección)
3)$FI$&)!*'!('UI#%#&)%!*'!%'6I(#*-*W!#$*'4'$*#'$&'!*'!2-!#,42','$&-.#5$W!4-(-!I$-!.-&'6)g(R-!*'!`EL%!UI'!%-&#%O-.'$!I$-%!$'.'%#*-*'%!'%4'.RO#.-%!*'2!.)$%I,#*)(D!
Security objective (objetivo de seguridad)
\'.2-(-.#5$!*'! 2-! #$&'$.#5$!*'!.)$&(-(('%&-(! 2-%!-,'$-Q-%! #*'$&#O#.-*-%!Jd)!*'!.I,42#(! 2-%!4)2R&#.-%!'!V#45&'%#%!*'!%'6I(#*-*!#*'$&#O#.-*-%!*'!2-!)(6-$#Q-.#5$D!
Security Target (ST) (declaración de seguridad)
3)$FI$&)!*'!('UI#%#&)%!*'!%'6I(#*-*!J!'%4'.#O#.-.#)$'%!I#Q-*)%!.),)!1-%'!*'! 2-!':-2I-g.#5$!*'!I$!`EL!#*'$&#O#.-*)D!
Semiformal
LM4('%-*)!'$!I$!2'$6I-F'!*'!%#$&-M#%!('%&(#$6#*-!.)$!%',8$&#.-!*'O#$#*-D!
System (sistema)
H$%&-2-.#5$!'%4'.RO#.-!*'!`HW!.)$!I$!4()45%#&)!J!'$!I$!'$&)($)!4-(&#.I2-('%D!
Target of Evaluation (TOE) (objeto a evaluar)
/()*I.&)!)!%#%&',-!*'!`H!J!%I%!,-$I-2'%!*'!-*,#$#%&(-*)(!J!*'!I%I-(#)!-%).#-*)%!UI'!%'!%),'&'!-!':-2I-.#5$D!
TOE Security Functions (TSF) (funciones de seguridad del TOE)
3)$FI$&)!.),4I'%&)!*'!&)*)!'2!hardwareW!firmware!J!software!*'2!`EL!.)$!'2!UI'!V-J!UI'!.)$&-(!4-(-!2-!.)(('.&-!-42#.-.#5$!*'!2-!`]/D!
TOE Security Policy (TSP) (política de seguridad del TOE)
3)$FI$&)!*'!('62-%!UI'!('6I2-$!.5,)!%'!6'%&#)$-$W!4()&'6'$!J!*#%&(#1IJ'$!2)%!-.&#:)%!'$!'2!`ELD!
4.2.6. Referencias
!" j+(('62)!%)1('!'2!Z'.)$).#,#'$&)!*'!2)%!3'(&#O#.-*)%!*'!3(#&'(#)%!3),I$'%!'$!'2!.-,4)!*'!2-!]'6I(#*-*!*'!2-%!`'.$)2)6R-%!*'!2-!H$O)(,-.#5$kW!"-J)W!<SSSD!
!" 33W!j3),,)$!3(#&'(#-!O)(!H$O)(,-&#)$!`'.V$)2)6J!]'.I(#&J!L:-2I-&#)$kW!_'(%#)$!<D>W!<SSAD!
!" /-(&!@[!H$&()*I.&#)$!-$*!6'$'(-2!,)*'2!
"-6'(#&!:'(%#5$!<! ! L:-2I-.#5$!J!.'(&#O#.-.#5$!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!@<K!?*'!@ABC!
!" /-(&!<[!]'.I(#&J!OI$.&#)$-2!('UI#(','$&%!
!" /-(&!>[!]'.I(#&J!-%%I(-$.'!('UI#(','$&%!
`-,1#;$!4I12#.-*)%!.),)!$)(,-!H]EdHL3!@ABSN[<SSAW!4-(&'%!g@W!g<!J!g>D!
!" H`]L3W! LI()4'-$!3),,#%%#)$W! jH$O)(,-&#)$! `'.V$)2)6J! ]'.I(#&J! L:-2I-&#)$!3(#&'(#-kW! :'(g%#)$!@D<W!@PP@D!
!" `3]L3W! \'4-(&,'$&! )O! \'O'$.'W! j`(I%&'*! 3),4I&'(! ]J%&',! L:-2I-&#)$! 3(#&'(#-kW! \E\!A<SSD<Ng]`\W!\'.D!@PNAD!
"-6'(#&!:'(%#5$!<! ! i'((-,#'$&-%!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!@<N!?*'!@ABC!
Apéndice 5. Herramientas T-! ('-2#Q-.#5$!*'!I$!4()J'.&)!+^Z!%I4)$'! &(-1-F-(!.)$!I$-!.#'(&-!.-$&#*-*!*'!-.&#:)%!UI'!(-(-!:'Q!1-F-!*'! 2-%!*'.'$-%!J!UI'!V-1#&I-2,'$&'!%)$!-26I$)%!.'$&'$-('%D!L2!$0,'()!*'!-,'$-Q-%!&R4#.-,'$&'!'%&8!*'2!)(*'$!*'!2-%!*'.'$-%W!,#'$&(-%!UI'!'2!$0,'()!*'!%-2:-6I-(*-%!'%&8!'$!2)%!,#22-('%D!`)*)!'22)!$)%!#$*#.-!UI'!V-J!UI'!,-$'F-(!,I2&#&I*!*'!*-&)%!J!.),1#$-.#)$'%!'$&('!'22)%W!2)!UI'!22':-!256#.-,'$&'!-!1I%.-(!-4)J)!*'!V'((-,#'$&-%!-I&),8&#.-%D!
3),)!('UI#%#&)%!6'$'(-2'%W!I$-!V'((-,#'$&-!*'!-4)J)!-!2)%!4()J'.&)%!+^Z!*'1'[!
!" 4'(,#&#(!&(-1-F-(!.)$!I$!.)$FI$&)!-,42#)!*'!-.&#:)%W!-,'$-Q-%!J!%-2:-6I-(*-%h!
!" 4'(,#&#(!I$!&(-&-,#'$&)!O2'M#12'!*'2!.)$FI$&)!*'!-.&#:)%!4-(-!-.),)*-(!I$!,)*'2)!.'(.-$)!-!2-!('-2#*-*!*'!2-!E(6-$#Q-.#5$h!
!" %'(!I#Q-*-!-!2)!2-(6)!*'!2)%!&('%!4().'%)%!UI'!.)$%&#&IJ'$!'2!4()J'.&)W!'%4'.#-2,'$&'!.),)!%)4)(&'!-2!4().'%)!/<W!+$82#%#%!*'!Z#'%6)%!J!
!" $)!).I2&-(!-2!-$-2#%&-!'2!(-Q)$-,#'$&)!UI'!22':-!-!2-%!.)$.2I%#)$'%D!
T-%!V'((-,#'$&-%!4I'*'$!V-.'(!I$!&(-&-,#'$&)!.I-2#&-&#:)!)!.I-$&#&-&#:)!*'!2-!#$O)(,-.#5$D!T-!)4g.#5$!'$&('!I$)!J!)&()!42-$&'-,#'$&)!V-!%#*)!,)&#:)!*'!2-(6)!*'1-&'D!T)%!,)*'2)%!.I-2#&-&#:)%!)O('g.'$!('%I2&-*)%!0'%!-$&'%!UI'!2)%!,)*'2)%!.I-$&#&-&#:)%W!%#,42','$&'!4)(UI'!2-!.-4&I(-!*'!*-&)%!.I-2#&-&#:-!'%!,8%!86#2!UI'!2-!.I-$&#&-&#:-AKD!T)%!,)*'2)%!.I-2#&-&#:)%!%)$!'O#.-.'%!('2-&#:#Q-$*)!2)!,8%!#,4)(&-$&'!*'!2)!UI'!$)!'%!&-$!#,4)(&-$&'h!4'()!-6(I4-$!2-%!.)$.2I%#)$'%!'$!6(-$*'%!6(I4)%D!T)%!,)*'2)%!.I-$&#&-&#:)%W!4)(!'2!.)$&(-(#)W!.)$%#6I'$!I$-!I1#.-.#5$!4('.#%-!*'!.-*-!-%4'.&)D!
H,4-.&)!J!(#'%6)!('%#*I-2!4I'*'$!%'(!.I-2#&-&#:)%!V-%&-!UI'!-4-('.'$!6(-$*'%!#$:'(%#)$'%!J!V-J!UI'!*'&'(,#$-(!%I!(-.#)$-2#*-*!'.)$5,#.-[!XUI;!'%!2)!UI'!#$&'('%-!,8%Y!L$!'%&'!4I$&)!%'!$'.'g%#&-$!$0,'()%D!
9$-!)4.#5$!,#M&-!'%!0[!I$!,)*'2)!.I-2#&-&#:)!4-(-!'2!%#%&',-!*'!#$O)(,-.#5$!.),42'&)W!.)$!.-g4-.#*-*!*'!'$&(-(!'$!I$!,)*'2)!.I-$&#&-&#:)!4-(-!-UI'22)%!.),4)$'$&'%!.IJ-!4()&'..#5$!:-!-!('gUI'(#(!OI'(&'%!*'%',1)2%)%D!
`-,1#;$! '%! .#'(&)! UI'! '2!,)*'2)! *'! :-2)(! *'! I$-!E(6-$#Q-.#5$! *'1'! ',42'-(%'! *I(-$&'! 2-(6)!&#',4)W!-2!,'$)%!*I(-$&'!2)%!-c)%!UI'!*I('!'2!42-$!*'!%'6I(#*-*!4-(-!-$-2#Q-(!'2!'O'.&)!*'!2-!'F'g.I.#5$!*'!2)%!4()6(-,-%D!L%!$)&-12','$&'!,8%!*#O#.I2&)%)!6'$'(-(!I$!,)*'2)!*'!:-2)(!*'%*'!.'()!UI'!#(!-*-4&-$*)!I$!,)*'2)!'M#%&'$&'!-!2-!':)2I.#5$!*'!2)%!-.&#:)%!*'2!%#%&',-!J!-!2-!':)2I.#5$!*'!2)%!%'(:#.#)%!UI'!4('%&-!2-!E(6-$#Q-.#5$D!L$!'%&-!':)2I.#5$!.)$&#$I-!4I'*'!-O()$&-(%'!2-!4()6('%#g:-!,#6(-.#5$!*'!I$!,)*'2)!.I-2#&-&#:)!#$#.#-2!V-.#-!I$!,)*'2)!.-*-!:'Q!,8%!.I-$&#&-&#:)D!!
L%!*'!*'%&-.-(!UI'!2)%!*-&)%!*'!.-(-.&'(#Q-.#5$!*'!2-%!4)%#12'%!-,'$-Q-%!%)$!*-&)%!&'$&-&#:)%!'$!2)%!4(#,'()%!,)*'2)%h!4'()!2-!'M4'(#'$.#-!4'(,#&'!#(!-FI%&-$*)!2-%!:-2)(-.#)$'%!-!2-!('-2#*-*D!
]'-$!V'((-,#'$&-%!.I-2#&-&#:-%!)!.I-$&#&-&#:-%W!'%&-%!*'1'$[!
!" "-$'F-(!I$!.-&82)6)!(-Q)$-12','$&'!.),42'&)!*'!)%!*'!-.&#:)%D!L$!'%&-!2R$'-!%'!)(#'$&-!'2!.-4R&I2)!<!*'2!m3-&82)6)!*'!L2','$&)%mD!
!" "-$'F-(!I$!.-&82)6)!(-Q)$-12','$&'!.),42'&)!*'!*#,'$%#)$'%!*'!:-2)(-.#5$D!L$!'%&-!2R$'-!%'!)(#'$&-!'2!.-4R&I2)!>!*'2!m3-&82)6)!*'!L2','$&)%mD!
!" +JI*-(!-! :-2)(-(! 2)%!-.&#:)%!)O('.#'$*)!.(#&'(#)%!*'!:-2)(-.#5$D!L$!'%&-! 2R$'-!%'!)(#'$&-!'2!.-4R&I2)!B!*'2!m3-&82)6)!*'!L2','$&)%mD!
!" "-$'F-(!I$!.-&82)6)!(-Q)$-12','$&'!.),42'&)!*'!-,'$-Q-%D!L$!'%&-!2R$'-!%'!'$.-,#$-!'2!.-4R&I2)!A!*'2!m3-&82)6)!*'!L2','$&)%mD!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
AK!i-J!UI'!:-2)(-(!-.&#:)%!J!'%&-!'%!I$-!&-('-!*'!.)$%'$%)D!`-$&)!2-!:-2)(-.#5$!.),)!2-!10%UI'*-!*'2!.)$g%'$%)!%)$!$)&-12','$&'!,8%!(84#*-%!%#!V-J!UI'!*'&'(,#$-(!I$!)(*'$!*'!,-6$#&I*!UI'!%#!V-J!UI'!*'&'(g,#$-(!I$!$0,'()!-1%)2I&)D!
"-6'(#&!:'(%#5$!<! ! i'((-,#'$&-%!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!@<P!?*'!@ABC!
!" "-$'F-(!I$!.-&82)6)!(-Q)$-12','$&'!.),42'&)!*'!%-2:-6I-(*-%D!L$!'%&-!2R$'-!%'!)(#'$&-!'2!.-4R&I2)!G!*'2!m3-&82)6)!*'!L2','$&)%mD!
!" L:-2I-(!'2!#,4-.&)!J!'2!(#'%6)!('%#*I-2'%D!
L%!#$&'('%-$&'!UI'!2-%!V'((-,#'$&-%!4I'*-$!#,4)(&-(!J!'M4)(&-(!2)%!*-&)%!UI'!,-$'F-$!'$!O)(,-g&)%!O8.#2,'$&'!4().'%-12'%!4)(!)&(-%!V'((-,#'$&-%W!.-1#'$*)!.#&-(!
!" n"T!b!LM&'$*'*!"-(rI4!T-$6I-6'!
UI'!'%!2-!)4.#5$!&),-*-!'$!'%&-!6IR-W!UI'!'%&-12'.'!O)(,-&)%!n"T!*'!#$&'(.-,1#)!
!" 3]_!b!3),,-!]'4-(-&'*!_-2I'%!
5.1. PILAR /HT+ZW! -.(5$#,)! *'! j/().'*#,#'$&)! H$O)(,8&#.)gT56#.)! 4-(-! '2! +$82#%#%! *'! Z#'%6)%k! '%! I$-!V'((-,#'$&-!*'%-(()22-*-!1-F)!'%4'.#O#.-.#5$!*'2!3'$&()!7-.#)$-2!*'!H$&'2#6'$.#-!4-(-!%)4)(&-(!'2!-$82#%#%!*'!(#'%6)%!*'!%#%&',-%!*'!#$O)(,-.#5$!%#6I#'$*)!2-!,'&)*)2)6R-!"-6'(#&D!
T-!V'((-,#'$&-!%)4)(&-!&)*-%!2-%!O-%'%!*'2!,;&)*)!"-6'(#&[!
!" 3-(-.&'(#Q-.#5$!*'!2)%!-.&#:)%[!#*'$&#O#.-.#5$W!.2-%#O#.-.#5$W!*'4'$*'$.#-%!J!:-2)(-.#5$!
!" 3-(-.&'(#Q-.#5$!*'!2-%!-,'$-Q-%!
!" L:-2I-.#5$!*'!2-%!%-2:-6I-(*-%!
T-!V'((-,#'$&-!#$.)(4)(-!2)%!.-&82)6)%!*'2!m3-&82)6)!*'!L2','$&)%m!4'(,#&#'$*)!I$-!V),)6'$'#g*-*!'$!2)%!('%I2&-*)%!*'2!-$82#%#%[!
!" )%!*'!-.&#:)%!
!" *#,'$%#)$'%!*'!:-2)(-.#5$!
!" .(#&'(#)%!*'!:-2)(-.#5$!
!" .-&82)6)!*'!-,'$-Q-%!
/-(-!#$.)(4)(-(!'%&'!.-&82)6)W!/HT+Z!*#O'('$.#-!'$&('!'2!,)&)(!*'!.82.I2)!*'!(#'%6)%!J!2-!1#12#)&'.-!*'!'2','$&)%W!UI'!4I'*'!%'(!('',42-Q-*-!4-(-!%'6I#(!'2!4-%)!*'!2-!':)2I.#5$!'$!'2!&#',4)!*'!2)%!.-&82)6)%!*'!'2','$&)%D!
T-!V'((-,#'$&-!':-20-!'2! #,4-.&)!J!'2!(#'%6)W!-.I,I2-*)!J!('4'(.I&#*)W!4)&'$.#-2!J!('%#*I-2W!4('g%'$&8$*)2)!*'!O)(,-!UI'!4'(,#&-!'2!-$82#%#%!*'!4)(!UI;!%'!*-!.#'(&)!#,4-.&)!)!.#'(&)!(#'%6)D!
T-%!%-2:-6I-(*-%!%'!.-2#O#.-$!4)(!O-%'%W!4'(,#&#'$*)!2-!#$.)(4)(-.#5$!-!I$!,#%,)!,)*'2)!*'!*#O'g('$&'%! %#&I-.#)$'%! &',4)(-2'%D! `R4#.-,'$&'! %'! 4I'*'! #$.)(4)(-(! '2! ('%I2&-*)! *'! 2)%! *#O'('$&'%!4()6(-,-%!*'!%'6I(#*-*!-!2)!2-(6)!*'!2-!'F'.I.#5$!*'2!42-$!*'!%'6I(#*-*W!,)$#&)(#Q-$*)!2-!,'F)(-!*'2!%#%&',-D!
T)%!('%I2&-*)%!%'!4('%'$&-$!'$!:-(#)%!O)(,-&)%[!#$O)(,'%!Z`eW!6(8O#.-%!J!&-12-%!4-(-!#$.)(4)(-(!-!V)F-%!*'!.82.I2)D!\'!'%&-!O)(,-!'%!4)%#12'!'2-1)(-(!*#O'('$&'%!)%!*'!#$O)(,'%!J!4('%'$&-.#)$'%!*'!2)%!('%I2&-*)%D!
/)(!02&#,)W! 2-!V'((-,#'$&-!.-2.I2-!.-2#O#.-.#)$'%!*'!%'6I(#*-*!%#6I#'$*)!2)%!'4R6(-O'%!*'!$)(,-%!de iure!)!de facto!*'!I%)!V-1#&I-2D!3-1'$!.#&-(%'[!
!" 3(#&'(#)%!*'!]'6I(#*-*W!$)(,-2#Q-.#5$!J!.)$%'(:-.#5$!
!" 97LgH]EdHL3!@KKPP[<SS<[!%#%&',-%!*'!6'%$!*'!2-!%'6I(#*-*!
!" Z\!PPBd@PPP[!*-&)%!*'!.-(8.&'(!4'(%)$-2!
/)(!02&#,)!V-J!UI'!*'%&-.-(!UI'!/HT+Z!#$.)(4)(-!&-$&)!2)%!,)*'2)%!.I-2#&-&#:)!.),)!.I-$&#&-&#:)W!4I*#'$*)!-2&'($-(%'!'$&('!I$)!J!)&()!4-(-!'M&(-'(!'2!,8M#,)!1'$'O#.#)!*'!2-%!4)%#1#2#*-*'%!&'5(#.-%!*'!.-*-!I$)!*'!'22)%D!
"-6'(#&!:'(%#5$!<! ! i'((-,#'$&-%!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!@>S!?*'!@ABC!
5.2. Referencias CARVER!
j3(#&#.-2#&JW!+..'%%#1#2#&JW!Z'.I4'(-1#2#&JW!_I2$'(-1#2#&JW!LOO'.&W!-$*!Z'.)6$#Q-1#2#&JkW!7-&#)$-2!H$gO(-%&(I.&I('!H$%&#&I&'~%!3'$&'(!O)(!H$O(-%&(I.&I('!LM4'(&#%'W!9]+D!
COBRA!j]'.I(#&J!Z#%r!+$-2J%#%!�!+%%'%%,'$&W!-$*!H]E!@KKPP!d!f]KKPP!3),42#-$.'kW!3�+!]J%&',%!]'.I(#&J!T&*W!9uD!
CRAMM!j33`+!Z#%r!+$-2J%#%!-$*!"-$-6','$&!"'&V)*kD!H$%#6V&!3)$%I2&#$6D!9uD!
`V'! 3Z+""! Z#%r! +$-2J%#%! -$*! "-$-6','$&! "'&V)*! #%! )y$'*W! -*,#$#%&'('*! -$*! ,-#$g&-#$'*!1J!&V'!]'.I(#&J!]'(:#.'!)$!1'V-2O!)O!&V'!9u!^):'($,'$&D!!
EBIOS!j";&V)*'!4)I(! 2~LM4('%%#)$!*'%!f'%)#$%!'&! 2~H*'$&#O#.-&#)$!*'%!E1F'.&#O%!*'!];.I(#&;kD!]'(:#.'!3'$&(-2!*'!2-!];.I(#&;!*'%!]J%&�,'%!*�H$O)(,-&#)$D!e(-$.'D!
RIS2K!])4)(&'!*'!"-6'(#&!:@DSD!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%D!L%4-c-D!
PILAR!j/().'*#,#'$&)!H$O)(,8&#.)gT56#.)!4-(-!'2!+$82#%#%!*'!Z#'%6)%kD!3'$&()!7-.#)$-2!*'!H$&'2#6'$g.#-D!"#$#%&'(#)!*'!\'O'$%-D!L%4-c-D!
"-6'(#&!:'(%#5$!<! ! L:)2I.#5$!*'!"-6'(#&!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!@>@!?*'!@ABC!
Apéndice 6. Evolución de Magerit versión 1.0 T-!:'(%#5$!@DS!*'!"-6'(#&W!4I12#.-*-!'$!@PPK!V-!('%#%&#*)!'$!%I!,-J)(!4-(&'!'2!4-%)!*'2!&#',4)W!(-&#O#.8$*)%'! '$! 2)! OI$*-,'$&-2D! 7)! )1%&-$&'W! '2! &#',4)! 4-%-*)! 4'(,#&'! ,'F)(-(! $)&-12','$&'!-UI'22-!4(#,'(-!:'(%#5$D!L%&-!%'6I$*-!:'(%#5$!$)!4-(&'!.)$!8$#,)!*'!(I4&I(-W!%#$)!UI'!%'!42-$&'-!.)$! 8$#,)! *'! ,'F)(-W! -*-4&8$*)2-! -2! &#',4)! 4('%'$&'! '! #$.)(4)(-$*)! 2-! 'M4'(#'$.#-! *'! '%&)%!-c)%D!
T-%!%#6I#'$&'%!%'..#)$'%!%'(:#(8$!*'!6IR-!*'$&()!*'!2-!:'(%#5$!<!-!2)%!4()O'%#)$-2'%!O-,#2#-(#Q-*)%!.)$!2-!:'(%#5$!@D!
6.1. Libro I. Guía de aproximación a la seguridad de los sistemas de in-formación L$!'%&)%!-c)%!2-!.)$%.#'$.#-!*'!2-!$'.'%#*-*!*'!2-!%'6I(#*-*!V-!-:-$Q-*)!'$)(,','$&'!J!J-!$)!%'!V-!.)$%#*'(-*)!$'.'%-(#)!I$-!-4()M#,-.#5$!&-$!6'$'(-2D!T-!#$&()*I..#5$!'%!,8%!%I.#$&-!J!&)*-!2-!6IR-!%'!.'$&(-!'$!'2!-$82#%#%!J!6'%$!*'!(#'%6)%D!
T-!^IR-!*'!+4()M#,-.#5$!%'c-2-1-!I$-!%'(#'!*'!%-2:-6I-(*-%W!*'$),#$-*-%!,R$#,-%W!UI'!%#6I'$!:#6'$&'%[!
@D! \).I,'$&-.#5$!*'!2-!4)2R&#.-!*'!%'6I(#*-*!
<D! +%#6$-.#5$!*'!OI$.#)$'%!J!('%4)$%-1#2#*-*'%!
>D! Z'%4)$%-1#2#*-*'%!*'2!I%I-(#)!'$!'2!-..'%)!
BD! /().'%)!*'!%'2'..#5$!
AD! 3),4)(&-,#'$&)!-$&'!#$.#*'$&'%!
GD! 3)$&()2'%!OR%#.)%!*'!%'6I(#*-*!
KD! ]'6I(#*-*!*'2!'UI#4-,#'$&)!
ND! 3I,42#,#'$&)!*'!)12#6-.#)$'%!FI(R*#.-%!
PD! /()&'..#5$W!&(-$%4)(&'!J!*'%&(I..#5$!
@SD!^'%$!'M&'($-!*'!%'(:#.#)%!
`)*)%!'22)%!('.)6#*)%!'$!'2!.-&82)6)!*'!%-2:-6I-(*-%!UI'!%'!#$.2IJ'!'$!'2!m3-&82)6)!*'!L2','$g&)%mD!L%&-!6IR-!$)!4('&'$*'!'$!.-,1#)!'M&'$*'(%'!'$!'%&-%!%-2:-6I-(*-%W!%#$)!UI'!4('O#'('!('O'(#(!-2!2'.&)(!-!2-!-1I$*-$&'!1#12#)6(-OR-!*#%4)$#12'W!&-$&)!&;.$#.-!.),)!*'!)(6-$#%,)%!#$&'($-.#)$-2'%!*'!$)(,-2#Q-.#5$D!
6.2. Libro II. Guía de procedimientos L2!%I1,)*'2)!*'!'2','$&)%!%'!('%4'&-!'$!%I!,-J)(!4-(&'W!-I$UI'!%'!':#&-!2-!:)Q!%I1,)*'2)!'$!1'$'O#.#)!*'!I$-!&'(,#$)2)6R-!,8%!*#('.&-D!
L2!&;(,#$)!j:I2$'(-1#2#*-*k!?*'!2)%!-.&#:)%!O('$&'!-!2-%!-,'$-Q-%CW!)(#6'$!*'!-26I$-%!.)$OI%#)$'%W!%'!V-!%I%&#&I#*)!4)(!I$-!*'$),#$-.#5$!6'$;(#.-!*'!j:-2)(-.#5$!*'!2-%!-,'$-Q-%k!UI'W!.),)!-$g&'%W!%'!&(-*I.'!'$!*)%!,'*#*-%[!O('.I'$.#-!*'!).I(('$.#-!J!*'6(-*-.#5$!*'2!-.&#:)D!
L2!.)$.'4&)!*'!#,4-.&)!('.#1'!I$!&(-&)!*'!4(#,'(!(-$6)W!4-(-2'2)!-2!*'!(#'%6)D!
T)%!)%!*'!-.&#:)%!V-$!,'('.#*)!.-4R&I2)!R$&'6()!'$!'2!j3-&82)6)!*'!L2','$&)%kD!L$!4-(&#.I2-(!%'!('.),#'$*-!$)!#$&()*I.#(!.),)!-.&#:)%!2)%!:-2)('%!#$&-$6#12'%!*'!2-!E(6-$#Q-.#5$!UI'!%'!#$.)(4)g(-(8$!-2!,)*'2)!.),)!.(#&'(#)%!*'!:-2)(-.#5$!?&-,1#;$!'$!.-4R&I2)!R$&'6()!'$!'2!j3-&82)6)!*'!L2'g,'$&)%kC!
"-6'(#&!:'(%#5$!<! ! L:)2I.#5$!*'!"-6'(#&!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!@><!?*'!@ABC!
:-2)(:-2)(
-.&#:)%-.&#:)% -,'$-Q-%-,'$-Q-%
#,4-.&)#,4-.&)
(#'%6)(#'%6)
*'6(-*-.#5$*'6(-*-.#5$
O('.I'$.#-O('.I'$.#-
%-2:-6I-(*-%%-2:-6I-(*-%
(#'%6)!('%#*I-2(#'%6)!('%#*I-2
%'!,-&'(#-2#Q-$!%)1('!2)%,#*'!'2!#$&'(;%!*'!2)%
%IO('$!I$-
.-I%-$!I$-!.#'(&-
).I(('$!.)$I$-!.#'(&-
4'(,#&'$!'%&#,-(!'2
4'(,#&'$!'%&#,-(!'2
,#-$!'2
2#,#&-$'2!4'(FI#.#)
('*I.'$2-!).I(('$.#-?4(':'$&#:-%C
2#,#&-$!'2!(#'%6)!-!I$!:-2)(
!
!
L2!%I1,)*'2)!*'!4().'%)%!%'!V-!('*'$),#$-*)!j-4()M#,-.#5$!O)(,-2kD!T-%!'&-4-%!*'! 2-!:'(%#5$!@DS!V-$!':)2I.#)$-*)!-!4().'%)%!'$!'%&-!:'(%#5$!<D!
T-!L&-4-!@W!j/2-$#O#.-.#5$!*'2!-$82#%#%!J!6'%$!*'!(#'%6)%kW!%'!('4()*I.'!'$!'2!4().'%)!/@W!,-$g&'$#'$*)!2-!'%&(I.&I(-!*'!-.&#:#*-*'%!J!&-('-%D!
T-!L&-4-!<W!j+$82#%#%!*'!(#'%6)%kW!%'!V-!(')(*'$-*)!'$!'2!4().'%)!/<W!.)$!I$-!'%&(I.&I(-.#5$!,8%!%#%&',8&#.-D!L%!'M42R.#&)!'2!-$82#%#%!*'!2-%!%-2:-6I-(*-%!'M#%&'$&'%D!]'!'2':-!2-!,'*#*-!*'!#,4-.&)!*'!,'()!4-%)!#$&'(,'*#)!-!('%I2&-*)!O#$-2D!]'!O)(,-2#Q-$!2)%!#$O)(,'%!',#&#*)%D!
\'!2-!L&-4-!>W!j^'%$!*'2!(#'%6)kW!2-!4(#,'(-!&-('-W!jH$&'(4('&-.#5$!*'2!(#'%6)kW!4-%-!-!%'(!'2!.)2)gO5$!*'2!4().'%)!/<W!*#O'('$.#8$*)2-!*'!2-!&-('-!*'!j3-2#O#.-.#5$!*'!2)%!(#'%6)%k!UI'!%#!'%!4-(&'!*'2!4().'%)!/>D!
T-%!'&-4-%!L>W!j^'%$!*'2!(#'%6)kW!J!LBW!j]'2'..#5$!*'!%-2:-6I-(*-%k!%'!V-$!.)$*'$%-*)!'$!'2!4().'%)!/>!UI'!%'!:'(&'1(-!-2('*'*)(!*'!2-!6'$'(-.#5$!*'!I$!j/2-$!*'!]'6I(#*-*kW!('.)$).#'$*)!UI'!2-!%'2'..#5$!'!#,42-$&-.#5$!*'!,'.-$#%,)%!*'!%'6I(#*-*!'%!O('.I'$&','$&'!)1F'&)!*'!4()J'.g&)%! *'! '$:'(6-*I(-! UI'! .)$:#'$'! %#$6I2-(#Q-(! *'$&()! *'! I$!,-(.)! '%&(-&;6#.)! UI'! 6-(-$&#.'! 2-!I$#*-*!*'!)1F'&#:)D!
^2)1-2,'$&'W!'2!4().'%)!/<!%'!.)$:#'(&'!'$!%I1%#*#-(#)!*'2!4().'%)!/>W!UI'!('.I((#(8!-!-UI'2!4-(-!&)*)%!2)%!('42-$&'-,#'$&)!':)2I&#:)%h!)!%'-W!('.82.I2)!*'!2)%!:-2)('%!('%#*I-2'%!*'!#,4-.&)!J!(#'%g6)D!
6.3. Libro III. Guía de técnicas ]'!V-!-2#6'(-*)!$)&-12','$&'W!,-$&'$#;$*)%'! 2)%!4().'%)%!\'24V#!*'!:-2)(-.#5$!'$!'%.'$-(#)%!*'!#$.'(&#*I,1('W!2-%!&;.$#.-%!6(8O#.-%!J!2)%!,)*'2)%!*'!.82.I2)!,'*#-$&'!&-12-%!J!-26)(#&,)%W!UI'!%'!'M4)$'$!.)$!,8%!*'&-22'!4)(!%'(!&;.$#.-%!'%4'.RO#.-%!*'!2)%!4()J'.&)%!*'!-$82#%#%!J!6'%$!*'!(#'%6)%D!
]'!4('%'$&-$!.),)!2#1()!-$'F)D!
6.4. Libro IV. Guía para desarrolladores de aplicaciones L2!4-%)!*'!";&(#.-! :<D@!-!";&(#.-! :>DS!V-!%I4I'%&)!I$-!.),42'&-! (':#%#5$!*'!'%&'!4I$&)D!+UIR!-4-('.'!'$!'2!.-4R&I2)!*'!j\'%-(()22)!*'!]#%&',-%!H$O)(,8&#.)%kW!'$O-&#Q-$*)!4(#,'()!'2!*'%-(()22)!*'!-42#.-.#)$'%!-#%2-*-%!J!2I'6)!'2!4().'%)!*'!*'%-(()22)!*'!%#%&',-%!*'!#$O)(,-.#5$!.),42'&)%D!
"-6'(#&!:'(%#5$!<! ! L:)2I.#5$!*'!"-6'(#&!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!@>>!?*'!@ABC!
6.5. Libro V. Guía para responsables del dominio protegible `)*-!'%&-!#$O)(,-.#5$!%'!V-!*#%&(#1I#*)!'$!2-!$I':-!'%&(I.&I(-.#5$D!i-J!4-(&'%!'$!2-!-4()M#,-.#5$!#$O)(,-2W!'$!'2!,;&)*)!O)(,-2W!'$!2)%!.)$%'F)%!4(8.&#.)%!J!'$!'2!m3-&82)6)!*'!L2','$&)%mD!
6.6. Libro VI. Arquitectura de la información y especificaciones de la in-terfaz para el intercambio de datos ]'!4('%'$&-1-!I$!,)*'2)!*'!*-&)%!)(#'$&-*)!-!I$-!V'((-,#'$&-W!2)!UI'!%'!V-!.)$%#*'(-*)!'M.'%#g:)!*'&-22'!4-(-!I$-!6IR-!,'&)*)256#.-D!!
T)!UI'!%#!%'! #$.2IJ'!'$!'%&-!$I':-!:'(%#5$!'%!I$-!%'(#'!*'!'%4'.#O#.-.#)$'%!n"T!4-(-!'2! #$&'(g.-,1#)!*'!#$O)(,-.#5$D!L%&-!6IR-!#$.2IJ'!2-!'%&(I.&I(-!4-(-!.),4-(&#(!,)*'2)%!*'!:-2)(!?-.&#:)%C!J!'2!m3-&82)6)!*'!L2','$&)%m!#$.2IJ'!'%&(I.&I(-%!4-(-!.),4-(&#(!)&()%!)%!*'!#$O)(,-.#5$D!
6.7. Libro VII. Referencia de normas legales y técnicas +.&I-2#Q-*-W!4-%-!-2!-4;$*#.'!>!*'!'%&-!6IR-D!
"-6'(#&!:'(%#5$!<! ! 3-%)!4(8.&#.)!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!@>B!?*'!@ABC!
Apéndice 7. Caso práctico +!&R&I2)!*'!'F',42)W!'%&'!-4;$*#.'!-$-2#Q-!'2!.-%)!*'!I$-!I$#*-*!-*,#$#%&(-&#:-!UI'!I#Q-!%#%&'g,-%! *'! #$O)(,-.#5$! 4()4#)%! J! *'! &'(.'()%! 4-(-! %I%! &-('-%! #$&'($-%! J! 4-(-! 4('%&-(! %'(:#.#)%! *'!-&'$.#5$!-!2)%!.#I*-*-$)%!?-*,#$#%&(-.#5$!'2'.&(5$#.-CD!!
L2!'F',42)!%52)!4('&'$*'!%'(! #2I%&(-&#:)W!%#$!UI'!'2! 2'.&)(!*'1-!*'(#:-(!,-J)('%!.)$%'.I'$.#-%!)!.)$.2I%#5$!-26I$-!*'!)12#6-*)!.I,42#,#'$&)D!H$.2I%)!-$&'!2)%!,#%,)%!#,4-.&)%!J!(#'%6)%W!2-%!%)g2I.#)$'%!4I'*'$!%'(!*#O'('$&'%W!%#$!4)*'(!'M&(-4)2-(%'!.#'6-,'$&'!*'!I$-!-!)&(-!.#(.I$%&-$.#-D!L$!4-(&#.I2-(!V-J!UI'!*'%&-.-(!'2!4-4'2!*'!2-!\#('..#5$!*'!2-!E(6-$#Q-.#5$!.),)!02&#,)!4I$&)!*'!*'.#g%#5$!('%4'.&)!*'!UI;!4)2R&#.-!-*)4&-(!4-(-!,-$&'$'(!#,4-.&)%!J!(#'%6)%!1-F)!.)$&()2D!
fI'$-!4-(&'!*'2! &'M&)!UI'!%#6I'!4('%'$&-! 2-!%#&I-.#5$!'$!4-2-1(-%!j$)(,-2'%kW! &-2!J!.),)!4I'*'!22'6-(2'!-2!'UI#4)!*'!&(-1-F)!-!2)! 2-(6)!*'!2-%!'$&(':#%&-%D!L%!2-!,#%#5$!*'!'%&'!'UI#4)!&(-*I.#(!'2!.)$).#,#'$&)!-*UI#(#*)!-!2)%!&;(,#$)%!O)(,-2'%!*'O#$#*)%!4)(!'%&-!,'&)*)2)6R-D!
7.1. La historia T-!I$#*-*!)1F'&)!*'!'%&I*#)!$)!'%!*'!$I':-!.('-.#5$W!%#$)!UI'!22':-!-c)%!&(-,#&-$*)!'M4'*#'$&'%!*'!O)(,-!2).-2W!-$&'%!,-$I-2,'$&'W!-V)(-!4)(!,'*#)!*'!I$!%#%&',-!#$O)(,8&#.)!4()4#)D!+!'%&'!%#%g&',-!#$O)(,8&#.)!%'!2'!V-!-c-*#*)!('.#'$&','$&'!I$-!.)$'M#5$!-!I$!-(.V#:)!.'$&(-2!UI'!OI$.#)$-!.),)!j,',)(#-!V#%&5(#.-k[!4'(,#&'!('.I4'(-(!*-&)%!J!.)$%'(:-(!2)%!'M4'*#'$&'%!.'((-*)%D!T-!02&#g,-!$):'*-*!.)$%#%&'!'$!)O('.'(!I$!%'(:#.#)!4()4#)!*'!2-!-*,#$#%&(-.#5$!'2'.&(5$#.-W!'$!'2!UI'!2)%!I%I-(#)%!4I'*'$!('-2#Q-(!%I%!&(-,#&-.#)$'%!:R-!y'1W!I%-$*)!%I!7He!.),)!#*'$&#O#.-.#5$W!,-%!I$-!.)$&(-%'c-!4'(%)$-2D!L2!,#%,)!%#%&',-!*'!&(-,#&-.#5$!'%!I%-*)!2).-2,'$&'!4)(!I$!OI$.#)$-(#)!UI'!-&#'$*'!-!2)%!.#I*-*-$)%!UI'!%'!4'(%)$-$!'$!2-%!*'4'$*'$.#-%!*'!2-!I$#*-*D!
L2!('%4)$%-12'!*'2!4()J'.&)!*'!-*,#$#%&(-.#5$!'2'.&(5$#.-W!-2-(,-*)!4)(!2-%!$)&#.#-%!-4-('.#*-%!'$!2)%!,'*#)%!%)1('!2-!#$%'6I(#*-*!*'!H$&'($'&W!J!%-1#'$*)!UI'!I$!O-22)!'$!'2!%'(:#.#)!.)$22':-(R-!I$!%'(#)!*-c)!-!2-!#,-6'$!*'!%I!I$#*-*W!-%I,'!'2!4-4'2!*'!4(),)&)(D!L$!'%&'!4-4'2!'%.(#1'!I$!#$O)(g,'!#$&'($)ANW!*#(#6#*)!-2!*#('.&)(!*'!2-!I$#*-*W!'$!'2!UI'!*-!.I'$&-!*'!!
!" 2)%!,'*#)%!#$O)(,8&#.)%!.)$!UI'!%'!'%&8!&(-1-F-$*)!J!2)%!UI'!%'!:-$!-!#$%&-2-(!
!" 2-%!#$.#*'$.#-%!-.-'.#*-%!*'%*'!UI'!2-!I$#*-*!'M#%&'!
!" 2-%!#$.'(&#*I,1('%!UI'!2'!.-I%-!'2!I%)!*'!H$&'($'&!4-(-!2-!4('%&-.#5$!*'2!%'(:#.#)!
L$!1-%'!-!*#.V)!#$O)(,'!-(6I,'$&-!2-!.)$:'$#'$.#-!*'!2-$Q-(!I$!4()J'.&)!+^ZD!
T-!*#('..#5$W!.)$:'$.#*-!*'!2-!$'.'%#*-*!*'!&),-(!,'*#*-%!-$&'%!*'!UI'!).I((-!I$-!*'%6(-.#-W!.('-!I$!.),#&;!*'!%'6I#,#'$&)!O)(,-*)!4)(!2)%!('%4)$%-12'%!*'!2)%!%'(:#.#)%!#$:)2I.(-*)%[!-&'$g.#5$!-!I%I-(#)%W!-%'%)(R-!FI(R*#.-W!%'(:#.#)%!#$O)(,8&#.)%!J!%'6I(#*-*!OR%#.-D!
]'!*'&'(,#$-!UI'!'2!-2.-$.'!*'2!4()J'.&)!?-.&#:#*-*!+@D<C!%'(8!'2!%'(:#.#)!*'!&(-,#&-.#5$!'2'.&(5$#g.-W!4('%'$.#-2!J!(',)&)D!`-,1#;$!%'!'%&I*#-(8!2-!%'6I(#*-*!*'!2-!#$O)(,-.#5$!UI'!%'!,-$'F-[!'Mg4'*#'$&'%D!Z'%4'.&)!*'2!'UI#4-,#'$&)W!%'!-$-2#Q-(8$!'UI#4)%!J!('*'%!*'!.),I$#.-.#)$'%D!]'!&)g,-! 2-!*'.#%#5$!*'!*'F-(! OI'(-!*'2!'%&I*#)!'2','$&)%!UI'!4I*#'(-$!%'(! ('2':-$&'%!'$!I$!-$82#%#%!,8%!*'&-22-*)!.),)!4I*#'(-$!%'(!2)%!*-&)%!*'!#*'$&#O#.-.#5$!J!-I&'$&#.-.#5$!*'!2)%!I%I-(#)%!*'!2)%!%#%&',-%W!2-%!8('-%!*'!&(-1-F)!*'2!4'(%)$-2!UI'!2)%!,-$'F-W!2-!%-2-!*'!'UI#4)%!?.'$&()!*'!4().'%)!*'!*-&)%C!J!2-%!4'(%)$-%!('2-.#)$-*-%!.)$!'2!4().'%)D!L%&-!4(':#%&)!2-$Q-(!I$!OI&I()!4()J'.&)!+^Z!,8%!*'&-22-*)!UI'!4()OI$*#.'!'$!*#.V)%!-%4'.&)%D!
LM42R.#&-,'$&'!%'!'M.2I#(8!2-!':-2I-.#5$!*'!2-!%'6I(#*-*!*'!2)%!%'(:#.#)%!%I1%#*#-(#)%!UI'!%'!',g42'-$D!L2! -$82#%#%!'%! 2).-2W! .#(.I$%.(#&)!-! 2-!I$#*-*!UI'!$)%!).I4-D!\#.V)%!%'(:#.#)%! (',)&)%!%'!.)$%#*'(-$W!-!'O'.&)%!*'!'%&'!-$82#%#%W!j)4-.)%kh!'%!*'.#(W!UI'!$)!'$&(-(',)%!'$!-$-2#Q-(!.5,)!%'!4('%&-$D!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
AN!3),)!'%!V-1#&I-2W!'$!'%&-%!O-%'%!#$#.#-2'%!'2!4()J'.&)!$)!'%&;!O)(,-2#Q-*)h!$)!)1%&-$&'W!%'!'%&8!('-2#Q-$g*)!'2!jH$O)(,'!/('2#,#$-(k!('%I2&-*)!*'!2-!-.&#:#*-*!j+@D@D!L%&I*#)!*'!)4)(&I$#*-*kD!
"-6'(#&!:'(%#5$!<! ! 3-%)!4(8.&#.)!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!@>A!?*'!@ABC!
L2!2-$Q-,#'$&)!*'2!4()J'.&)!?-.&#:#*-*!+@DBC!#$.2IJ'!I$-!('I$#5$!*'!2-!*#('..#5$!.)$!'2!.),#&;!*'!%'6I#,#'$&)!'$!2-!UI'!%'!'M4)$'$!2)%!4I$&)%!4(#$.#4-2'%!*'2!-$82#%#%!%),'()!('-2#Q-*)!4)(!'2!4()g,)&)(!UI'!UI'*-!V-1#2#&-*)!.),)!*#('.&)(!*'2!4()J'.&)!+^Z!'$!'2!UI'!4-(&#.#4-(-$!*)%!4'(%)$-%!*'!%I!'UI#4)!FI$&)!.)$!I$!.)$&(-&)!*'!-%'%)(R-!'%&-12'.#*)!.)$!I$-!',4('%-!.)$%I2&)(-!'M&'($-D!9$)!*'!2)%!,#',1()%!*'2!'UI#4)!#$&'($)!&'$*(8!I$!4'(O#2!&;.$#.)[!#$6'$#'()!*'!%#%&',-%D!+!2-!.)$g%I2&)(-!'M&'($-!%'!2'!'M#6'!#*'$&#O#.-(!$),#$-2,'$&'!-!2-%!4'(%)$-%!UI'!:-$!-!4-(&#.#4-(!J!O#(,-(!I$!-.I'(*)!*'!.)$O#*'$.#-2#*-*D!
L2!4()J'.&)!%'!-$I$.#-!#$&'($-,'$&'!,'*#-$&'!.),I$#.-.#5$!6'$'(-2!-!&)*)!'2!4'(%)$-2!*'!2-!I$#g*-*!J!$)&#O#.-.#5$!4'(%)$-2!-!-UI'22-%!4'(%)$-%!UI'!%'!:'(8$!*#('.&-,'$&'!-O'.&-*-%D!L$!'%&-%!.),I$#.-.#)$'%!%'!#*'$&#O#.-$!2-%!4'(%)$-%!('%4)$%-12'%!*'2!4()J'.&)D!
7.2. Proceso P2: Análisis de riesgos T-!O-%'!*'!-$82#%#%!*'!(#'%6)%!-((-$.-!.)$!I$-!%'(#'!*'!'$&(':#%&-%!-!2)%!('%4)$%-12'%!*'%#6$-*)%!4)(!'2!.),#&;!*'!%'6I#,#'$&)W!'$&(':#%&-%!'$!2-%!UI'!4-(&#.#4-$!
!" 2-!4'(%)$-!*'!'$2-.'W!.),)!#$&()*I.&)(!
!" '2!4'(%)$-2!*'!2-!.)$%I2&)(-!'M&'($-!.),)!*#('.&)(!*'!2-!'$&(':#%&-!
!" '2!4'(%)$-2!4()4#)!.),)!%'.('&-(#)[!-.&-!*'!2-!('I$#5$!J!('.)4#2-.#5$!*'!*-&)%!
Servicio de tramitación
L2!%'(:#.#)!*'!&(-,#&-.#5$!%'!4('%&-!4)(!,'*#)!*'!I$-!-42#.-.#5$!#$O)(,8&#.-!*'%-(()22-*-!'$!'2!4-g%-*)!%)1('!I$-!1-%'!*'!*-&)%D!+!'%&-!-42#.-.#5$!%'!-..'*'!-!&(-:;%!*'!I$-!#*'$&#O#.-.#5$!2).-2!*'2!I%I-(#)!UI'!.)$&()2-!%I%!4(#:#2'6#)%!*'!-..'%)D!L$!2-!O-.'&-!*'!&(-,#&-.#5$!4('%'$.#-2W!'%!2-!4'(%)g$-!UI'!'%&8!-&'$*#'$*)!-2!I%I-(#)!O#$-2!2-!UI'!%'!#*'$&#O#.-!O('$&'!-2!%#%&',-D!L$!'2!.-%)!*'!2-!&(-g,#&-.#5$!(',)&-W!'2!'2!4()4#)!-*,#$#%&(-*)!UI#'$!%'!#*'$&#O#.-D!
`)*-!2-!&(-,#&-.#5$!#$.2IJ'!I$-!O-%'!*'!%)2#.#&I*!?J!'$&(-*-!*'!*-&)%C!J!I$-!O-%'!*'!('%4I'%&-!?J!'$&('6-!*'!*-&)%CD!L2!I%I-(#)!('-2#Q-!%I!%)2#.#&I*!J!'%4'(-!I$-!$)&#O#.-.#5$!4-(-!('.)6'(!2-!('%4I'%g&-D!T-!$)&#O#.-.#5$!'%!4)(!.)((')W!.'(&#O#.-*)!'$!'2!.-%)!*'!&(-,#&-.#5$!4('%'$.#-2W!J!'2'.&(5$#.)!'$!'2!.-%)!*'!&(-,#&-.#5$!'2'.&(5$#.-D!
H$#.#-(! I$-! &(-,#&-.#5$! %I4)$'! -1(#(! I$! 'M4'*#'$&'! UI'! %'! -2,-.'$-! 2).-2,'$&'! '$! 2-! )O#.#$-D!`-,1#;$!%I4)$'!('.-1-(!I$-!%'(#'!*'!*-&)%!*'2!-(.V#:)!.'$&(-2!*'!#$O)(,-.#5$W!*-&)%!UI'!%'!.)g4#-$!2).-2,'$&'D!+2!.#'(('!*'2!'M4'*#'$&'W!2)%!*-&)%!J!I$!#$O)(,'!*'!2-%!-.&I-.#)$'%!('-2#Q-*-%!%'!(',#&'$!-2!-(.V#:)!.'$&(-2!4-(-!%I!.I%&)*#-W!'2#,#$8$*)%'!2-!#$O)(,-.#5$!*'!2)%!'UI#4)%!2).-2'%D!
L2!4'(%)$-2!*'!2-!I$#*-*!%'!#*'$&#O#.-!4)(!,'*#)!*'!%I!.I'$&-!*'!I%I-(#)W!,#'$&(-%!UI'!2)%!I%I-g(#)%!(',)&)%!%'!#*'$&#O#.-$!4)(!%I!7HeD!L$!-,1)%!.-%)%!'2!%#%&',-!('UI#'('!I$-!.)$&(-%'c-!4-(-!-I&'$&#.-(2)%D!
/)(!02&#,)W!V-J!UI'!*'%&-.-(!'2!4-4'2!UI'!4('%&-!2-!,'$%-F'(R-!'2'.&(5$#.-!'$!&)*)!'2!4().'%)!*'!&(-,#&-.#5$W! I%-*)! &-$&)! .),)!,'*#)! #$&'($)!*'!.),I$#.-.#5$!'$&('!'2! 4'(%)$-2W! J! .),)!,'.-g$#%,)!*'!$)&#O#.-.#5$!-!2)%!I%I-(#)%!'M&'($)%D!3),)!$)(,-W!$)!%'!*'1'!',42'-(!'2!.)((')!.),)!&(-$%4)(&'!*'!*).I,'$&)%h!'%&)%!%#',4('!%'(8$!%'(:#*)%!4)(!,'*#)!*'!-..'%)%!y'1D!
Servicio de archivo central
L$!O)(,-!*'!#$&(-$'&W!%'!4('%&-!I$!%'(:#.#)!.'$&(-2#Q-*)!*'!-(.V#:)!J!('.I4'(-.#5$!*'!*).I,'$&)%D!T)%!I%I-(#)%!-..'*'$!4)(!,'*#)!*'!I$-!#$&'(O-Q!y'1!2).-2W!UI'!%'!.)$'.&-!4)(!,'*#)!*'!I$-!('*!4(#:-*-!:#(&I-2!.)$!'2!%'(:#*)(!(',)&)W!#*'$&#O#.8$*)%'!4)(!,'*#)!*'!%I!7HeD!L%&'!%'(:#.#)!%52)!'%&8!*#%4)$#12'!4-(-!'2!4'(%)$-2!*'!2-!I$#*-*!J!4-(-!'2!',42'-*)!:#(&I-2!UI'!4('%&-!'2!%'(:#.#)!*'!&(-,#g&-.#5$!(',)&-D!
Equipamiento informático
T-!I$#*-*!*#%4)$'!*'!:-(#)%!'UI#4)%!4'(%)$-2'%!*'!)!/3!%#&I-*)%!*'$&()!*'!2)%!2).-2'%D!L%&)%!'UI#4)%!*#%4)$'$!*'!I$!$-:'6-*)(!y'1W!*'!I$!.2#'$&'!*'!.)((')!'2'.&(5$#.)!%#$!-2,-.'$-,#'$&)!2).-2!*'!2)%!,'$%-F'%!J!I$!4-UI'&'!)O#,8&#.)!'%&8$*-(!?4().'%-*)(!*'!&'M&)%!J!V)F-!*'!.82.I2)CD!
"-6'(#&!:'(%#5$!<! ! 3-%)!4(8.&#.)!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!@>G!?*'!@ABC!
LM#%&'!I$-!.-4-.#*-*!*'!-2,-.'$-,#'$&)!2).-2!*'!#$O)(,-.#5$!'$!'2!*#%.)!*'2!/3W!*'2!UI'!$)!%'!('-2#Q-$!.)4#-%!*'!%'6I(#*-*h!'%!,8%W!'M#%&'!I$!4().'*#,#'$&)!*'!#$%&-2-.#5$!d!-.&I-2#Q-.#5$!UI'!1)((-!'2!*#%.)!2).-2!J!('#$%&-2-!'2!%#%&',-!R$&'6()D!
T)%! 'UI#4)%! $)! *#%4)$'$!*'!I$#*-*'%!*'!*#%.)! (',):#12'! *'! $#$60$! )[! *#%UI'&'%W!3\W!\_\W!9]fW!'&.D!!
]'!*#%4)$'!*'!I$!%'(:#*)(!*'!&-,-c)!,'*#)W!*'!4()45%#&)!6'$'(-2W!*'*#.-*)!-!2-%!&-('-%!*'[!
!" %'(:#*)(!*'!O#.V'()%!
!" %'(:#*)(!*'!,'$%-F'(R-!'2'.&(5$#.-W!.)$!-2,-.'$-,#'$&)!2).-2!J!-..'%)!:R-!y'1!
!" %'(:#*)(!*'!1-%'%!*'!*-&)%[!'M4'*#'$&'%!'$!.I(%)!'!#*'$&#O#.-.#5$!*'!I%I-(#)%!
!" %'(:#*)(!y'1!4-(-!2-!&(-,#&-.#5$!(',)&-!J!4-(-!2-!#$&(-$'&!2).-2!
Comunicaciones
]'!*#%4)$'!*'!I$-!('*!*'!8('-!2).-2!UI'!.I1('!2-%!*'4'$*'$.#-%!*'!&(-1-F)!J!2-!%-2-!*'!'UI#4)%D!L%&8!'M42R.#&-,'$&'!4()V#1#*-! 2-! #$%&-2-.#5$!*'!,5*',%!*'!-..'%)!(',)&)!J!('*'%! #$-28,1(#.-%W!'M#%&#'$*)!I$!4().'*#,#'$&)!(I&#$-(#)!*'!#$%4'..#5$D!
LM#%&'!I$-!.)$'M#5$!-!H$&'($'&W!*'!+\]TW!.)$&(-&-*-!-!I$!)4'(-*)(!.),'(.#-2D!])1('!'%&'!'$2-.'!%'!4('%&-$!,02*'%!%'(:#.#)%!
!" %'(:#.#)!?4()4#)C!*'!&(-,#&-.#5$!(',)&-!
!" %'(:#.#)!*'!.)((')!'2'.&(5$#.)!?.),)!4-(&'!*'2!%'(:#.#)!*'!&(-,#&-.#5$!(',)&-C!
!" %'(:#.#)!?4()4#)C!*'!-..'%)!-!#$O)(,-.#5$!
!" ('*!4(#:-*-!:#(&I-2!.)$!'2!-(.V#:)!.'$&(-2!
T-!.)$'M#5$!-!H$&'($'&!%'!('-2#Q-!0$#.-!J!'M.2I%#:-,'$&'!-!&(-:;%!*'!I$!.)(&-OI'6)%!UI'!2#,#&-!2-%!.),I$#.-.#)$'%!-!$#:'2!*'!('*W!4'(,#&#'$*)!0$#.-,'$&'[!
!" '2!#$&'(.-,1#)!*'!.)((')!'2'.&(5$#.)!.)$!'2!%'(:#*)(!*'!.)((')!
!" '2!#$&'(.-,1#)!y'1!.)$!'2!%'(:#*)(!y'1!
T-!('*!4(#:-*-!:#(&I-2!.)$!'2!-(.V#:)!.'$&(-2!I#Q-!I$-!-42#.-.#5$!#$O)(,8&#.-!softwareD!T-!('*!%'!'%&-12'.'!-2!#$#.#)!*'!2-!F)($-*-W!.)(&8$*)%'!-I&),8&#.-,'$&'!-!2-!V)(-!*'!.#'(('D!L$!'2!'%&-12'.#g,#'$&)!2)%!'UI#4)%!&'(,#$-2'%!%'!('.)$).'$!,I&I-,'$&'!J!'%&-12'.'$!I$-!.2-:'!*'!%'%#5$!4-(-!2-!F)($-*-D!7)!V-J!#$&'(:'$.#5$!*'!$#$60$!)4'(-*)(!2).-2D!
i-J!I$-!%'$%-.#5$!*'!UI'!,I.V)%!%'(:#.#)%!*'4'$*'$!*'!2-!.)$'M#5$!-!H$&'($'&D!+*',8%W!'$!'2!4-%-*)!V-!V-1#*)!#$.#*'$.#-%!&-2'%!.),)!.)(&'%!*'!%'(:#.#)!*'1#*)%!-!)1(-%!,I$#.#4-2'%!J!-!I$-!*'O#.#'$&'!4('%&-.#5$!*'2!%'(:#.#)!4)(!4-(&'!*'2!4():''*)(D!/)(!&)*)!'22)[!
@D! %'!V-!'%&-12'.#*)!I$!.)$&(-&)!*'!%'(:#.#)!UI'!'%&-12'.'!I$!.#'(&)!$#:'2!*'!.-2#*-*W!4)(!'$.#g,-!*'2!.I-2!'2!)4'(-*)(!*'1'!-1)$-(!I$-%!#$*',$#Q-.#)$'%!4-.&-*-%!*'!-$&',-$)!'$!4()g4)(.#5$!-2!4'(#)*)!*'!#$&'((I4.#5$!)!-!2-!2'$&#&I*!?#$%IO#.#'$&'!:)2I,'$!*'!*-&)%!&(-$%,#&#*)%!'$!4'(#)*)%!*'&'(,#$-*)%!*'!&#',4)C!*'2!'$2-.'D!
<D! %'!V-!.)$&(-&-*)!.)$!)&()!4():''*)(!I$!'$2-.'!*#6#&-2!?Z\]HC!*'!('%4-2*)W!'$2-.'!UI'!V-1#g&I-2,'$&'!$)!'%&8!'%&-12'.#*)W!4'()!UI'!%'!-.&#:-!-I&),8&#.-,'$&'!.I-$*)!'2!'$2-.'!+\]T!%'!#$&'((I,4'!*I(-$&'!,8%!*'!@S!,#$I&)%!
\I(-$&'!2-!'$&(':#%&-!%'!*'%.I1('!UI'!'%&)%!'$2-.'%!%'!4('%&-$!%)1('!2-!,#%,-!-.),'&#*-!*'!('*!&'2'O5$#.-!UI'!4('%&-!2)%!%'(:#.#)%!*'!:)Q!*'!2-!I$#*-*D!
Seguridad física
L2!4'(%)$-2!&(-1-F-!'$!2)%!2).-2'%!*'!2-!I$#*-*W!4(#$.#4-2,'$&'!'$!Q)$-%!#$&'(#)('%W!%-2:)!I$-!%'(#'!*'!&'(,#$-2'%!'$!2)%!4I$&)%!*'!-&'$.#5$!-2!4012#.)D!L2!-..'%)!-!2-%!Q)$-%!#$&'(#)('%!'%&8!2#,#&-*)!-!2-%!V)(-%!*'!)O#.#$-W!UI'*-$*)!.'((-*)!.)$!22-:'!OI'(-!*'!*#.V)!V)(-(#)D!L$!V)(-%!*'!)O#.#$-!V-J!I$!.)$&()2!*'!'$&(-*-!UI'!#*'$&#O#.-!-!2)%!',42'-*)%!J!('6#%&(-!%I!V)(-!*'!'$&(-*-!J!*'!%-2#*-D!!
"-6'(#&!:'(%#5$!<! ! 3-%)!4(8.&#.)!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!@>K!?*'!@ABC!
T-!%-2-!*'!'UI#4)%!'%!%#,42','$&'!I$-!V-1#&-.#5$!#$&'(#)(!UI'!4'(,-$'.'!.'((-*-!.)$!22-:'W!*'!2-!UI'!'%!.I%&)*#)!'2!-*,#$#%&(-*)(!*'!%#%&',-%D!T-!%-2-!*#%4)$'!*'!I$!%#%&',-!*'!*'&'..#5$!J!'M&#$g.#5$!*'!#$.'$*#)%!UI'!%'!(':#%-!-$I-2,'$&'D!L%&-!%-2-!*#%&-!AS!,'&()%!*'!2-!.-$-2#Q-.#5$!*'!-6I-!,8%!.'(.-$-D!
T)%!2).-2'%!*'!2-!I$#*-*!).I4-$!R$&'6(-,'$&'!2-!42-$&-!B�!*'!I$!'*#O#.#)!*'!)O#.#$-%!*'!@<!42-$&-%D!T)%!.)$&()2'%!*'!-..'%)!%)$!4()4#)%!*'!2-!I$#*-*W!$)!*'2!'*#O#.#)W!UI'!'%!*'!I%)!.),4-(&#*)!.)$!)&(-%!-.&#:#*-*'%D!7)!V-J!$#$60$!.)$&()2!%)1('!UI;!V-J!'$!'2!4#%)!*'!-((#1-!)!'$!'2!4#%)!*'!-1-F)D!
7.2.1. Tarea T2.1.1. Identificación de activos
Z'%I2&-*)!*'! 2-%!-$&'(#)('%!'$&(':#%&-%!%'!*'&'(,#$-!&(-1-F-(AP!.)$!'2!%#6I#'$&'!.)$FI$&)!*'!-.&#g:)%GS[!
!
!
!
L2!%#%&',-!*'%.(#&)!'%W!':#*'$&','$&'W!,8%!.),42'F)h!4'()!'2!$0,'()!*'!-.&#:)%!%#6$#O#.-&#:)%!%'!V-! ('*I.#*)!*(8%&#.-,'$&'!4-(-!UI'!'2!'F',42)!%'-! ('-2,'$&'!%#,42'W!.'$&(-*)!'$! 2-!.-%IR%&#.-!&R4#.-!UI'!%'!*'%'-!#2I%&(-(D!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
AP!!L$!'%&'!-4;$*#.'!%'!I#Q-(8!2-!V'((-,#'$&-!/HT+Z!'$!%I!:'(%#5$!*'!-$82#%#%!.I-2#&-&#:)D!GS!T-!('2-.#5$!*'!-.&#:)%!-6(I4-!-!'%&)%!'$!&('%!.-4-%!?'$!$'6(#&-CD!T-!'%&(I.&I(-.#5$!'$!.-4-%!'%!,'()!-(&#g2I6#)!*'!)(*'$-.#5$!*'!2-!#$O)(,-.#5$D!L$!.-*-!.-4-!%'!#$*#.-$!UI;!-.&#:)%!V-J!*'!.-(-!)D!]'!V-!',g42'-*)!2-!('2-.#5$!*'2!j3-&82)6)!*'!L2','$&)%kW!.-4R&I2)!j<D!`#4)%!*'!-.&#:)%kD!
"-6'(#&!:'(%#5$!<! ! 3-%)!4(8.&#.)!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!@>N!?*'!@ABC!
7.2.2. Tarea T2.1.2: Dependencias
`'$#'$*)!'$!.I'$&-!2-%!*'4'$*'$.#-%!4-(-!)4'(-(!?*#%4)$#1#2#*-*C!J!*'!-2,-.'$-,#'$&)!*'!*-&)%!?#$&'6(#*-*!J!.)$O#*'$.#-2#*-*CW!%'!V-!*'&'(,#$-*)!2-!%#6I#'$&'!,-&(#Q!*'!*'4'$*'$.#-%!'$&('!-.&#g:)%[!
!
p]�`�4('%'$.#-2q!
p]�`�(',)&-q!!
p\�'M4q!!
p',-#2q!!
p-(.V#:)q!!
p]|�'M4q!
p/3q!!
p]Z_q!!
pO#('y-22q!!
pT+7q!
p+\]Tq!
p]�`�4('%'$.#-2q! ! ! "! "! "! "! "! "! ! "! !
p]�`�(',)&-q! ! ! "! "! "! "! ! "! "! "! "!
p\�'M4q! ! ! ! ! "! "! "! "! ! "! !
p',-#2q! ! ! ! ! ! ! ! "! "! "! "!
p-(.V#:)q! ! ! ! ! ! ! ! "! "! ! "!
p]|�'M4q! ! ! ! ! ! ! ! ! ! ! !
p/3q! ! ! ! ! ! ! ! ! ! ! !
p]Z_q! ! ! ! ! ! ! ! ! ! ! !
pO#('y-22q! ! ! ! ! ! ! ! ! ! ! !
pT+7q! ! ! ! ! ! ! ! ! ! ! !
p+\]Tq! ! ! ! ! ! ! ! ! ! ! !
!
L%&-%! &-12-%! %'! 4I'*'$! ('4('%'$&-(! 6(8O#.-,'$&'W! .I#*-$*)! *'! UI'! $)! V-J-! I$-! %-&I(-.#5$! *'!*'4'$*'$.#-%h!'%!*'.#(W! (-(-!:'Q!%'!4I'*'!4('%'$&-(! &)*)!'2!%#%&',-!'$!I$!%52)!6(8O#.)D!/-(-!'2!.-%)!*'!2)%!*-&)%!*'!'M4'*#'$&'%!'$!.I(%)W!'2!6(8O#.)!*'!*'4'$*'$.#-%!UI'*-!-%R[!
!
!
!
"-6'(#&!:'(%#5$!<! ! 3-%)!4(8.&#.)!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!@>P!?*'!@ABC!
7.2.3. Tarea T2.1.3: Valoración
T-!*#('..#5$!'%&8!4(').I4-*-!4)(!'2!4)&'$.#-2!-1I%)!*'! 2)%!4().'%)%!*'!&(-,#&-.#5$W!-26I$)%!*'!2)%!.I-2'%!4I'*'$!#$.2I#(!'2!-1)$)!*'!.-$&#*-*'%!'.)$5,#.-%!#,4)(&-$&'%W!1#'$!-!1'$'O#.#)!*'!2-!E(6-$#Q-.#5$W!1#'$!-!1'$'O#.#)!*'!2)%!I%I-(#)%D!T-!'M#%&'$.#-!*'!I$!,5:#2!'.)$5,#.)!4I'*'!#$.#&-(!-2!-1I%)!&-$&)!-2!4'(%)$-2!#$&'($)!.),)!-!2)%!I%I-(#)%!(',)&)%W!'M#%&#'$*)!I$-!'%4'.#-2!#$.),)*#g*-*!('2-.#)$-*-!.)$! 2-! #,4I$#*-*!*'!-&-.-$&'%!UI'!4I*#'(-$!4'(4'&(-(!-&-UI'%!*'%*'!.I-2UI#'(!(',)&)!4I$&)!*'2!42-$'&-D!
`-,1#;$!V-J!I$-!'%4'.#-2!%'$%#1#2#*-*! ('2-&#:-!-! 2-!*#%4)$#1#2#*-*!*'! 2)%!%'(:#.#)%D!L$!4-(&#.I2-(!V-J!4(').I4-.#5$!4)(UI'!$)!%'!4I*#'(-!-&'$*'(!I$-!*',-$*-!4('%'$.#-2D!
T)%!%'(:#.#)%!y'1!-!I%I-(#)%!'M&'($)%W!%'!.)$%#*'(-$!j',12',8&#.)%k!J!%'!UI#'('$!.I#*-(!.)$!'%g,'()!4-(-!*-(!I$-!#,-6'$!*'!,)*'($#*-*W!'O#.-.#-!J!:).-.#5$!*'!%'(:#.#)D!`)*)!2)!UI'!%I4)$6-!*-(!I$-!,-2-!#,-6'$W!1#'$!4)(UI'!$)!'%&8!*#%4)$#12'!'2!%'(:#.#)W!1#'$!4)(UI'!%'!4('%&-!*'!O)(,-!'((5$'-W!1#'$!4)(UI'!2-%!#$.#*'$.#-%!$)!%)$!-&'$*#*-%!.)$!4('%&'Q-W!DDDW!&)*-%!'%&-%!%#&I-.#)$'%!%'!UI#'('$!':#&-(!'$!2-!,'*#*-!*'!2)!4)%#12'D!
T-%!1-%'%!*'!*-&)%!2).-2'%!V)%4'*-$!#$O)(,-.#5$!('2-&#:-!-!4'(%)$-%!UI'!UI'*-(8$!-*%.(#&)%!-2!$#:'2!,'*#)!*'$&()!*'!2-!.-2#O#.-.#5$!*'!*-&)%!*'!.-(8.&'(!4'(%)$-2D!
L$!:#%&-!*'!&)*)!'22)W!%'!V-!.)$%'$%I-*)!2-!%#6I#'$&'!:-2)(-.#5$G@!*'!2)%!-.&#:)%!*'2!%#%&',-D!]52)!%'!V-$!:-2)(-*)!'M42R.#&-,'$&'!2)%!-.&#:)%!%I4'(#)('%!*'2!8(1)2!*'!*'4'$*'$.#-%W!UI'!UI'*-$!*'!2-!%#6I#'$&'!,-$'(-[!
dimensiones de seguridad
-.&#:)! p\q! pHq! p3q! p+�]q p+�\q! p`�]q! p`�\q
p]�`�4('%'$.#-2q!`(-,#&-.#5$!4('%'$.#-2 pAq?@C ! ! pKq?<C! ! pGq?>C! !
p]�`�(',)&-q!`(-,#&-.#5$!(',)&-! p>q?BC ! ! pKq?AC! ! pGq?GC! !
p\�'M4q!LM4'*#'$&'%!'$!.I(%)! ! pAq?KC pGq?NC ! pAq?PC! ! pAq?@SC!
!
3)$.('&-,'$&'W!2)%!$#:'2'%!%'!V-$!-%#6$-*)!4)(!2-%!%#6I#'$&'%!(-Q)$'%!?22-,-*-%!'$!2-!&-12-!-$&'g(#)(C[!
?@C! pAD*-q!/()1-12','$&'!.-I%'!2-!#$&'((I4.#5$!*'!-.&#:#*-*'%!4()4#-%!*'!2-!E(6-$#Q-.#5$!.)$!#,4-.&)!'$!)&(-%!)(6-$#Q-.#)$'%!
?<C! pKD*-q!/()1-12','$&'!.-I%'!I$-!#$&'((I4.#5$!%'(#-!*'!2-%!-.&#:#*-*'%!4()4#-%!*'!2-!E(g6-$#Q-.#5$!.)$!I$!#,4-.&)!%#6$#O#.-&#:)!'$!)&(-%!)(6-$#Q-.#)$'%!pAD2()q!E12#6-.#)$'%!2'6-2'%[!4()1-12','$&'!%'-!.-I%-!*'!#$.I,42#,#'$&)!*'!I$-!2'J!)!('6I2-.#5$!
?>C! pGD4#<q!H$O)(,-.#5$!4'(%)$-2[!4()1-12','$&'!UI'1(-$&'!%'(#-,'$&'!2-!2'J!)!-260$!('g62-,'$&)!*'!4()&'..#5$!*'!#$O)(,-.#5$!4'(%)$-2!
?BC! p>D*-q!/()1-12','$&'!.-I%'!2-!#$&'((I4.#5$!*'!-.&#:#*-*'%!4()4#-%!*'!2-!E(6-$#Q-.#5$!?AC! pKD*-q!/()1-12','$&'!.-I%'!I$-!#$&'((I4.#5$!%'(#-!*'!2-%!-.&#:#*-*'%!4()4#-%!*'!2-!E(g
6-$#Q-.#5$!.)$!I$!#,4-.&)!%#6$#O#.-&#:)!'$!)&(-%!)(6-$#Q-.#)$'%!pGD4#@q!H$O)(,-.#5$!4'(%)$-2[!4()1-12','$&'!-O'.&'!6(-:','$&'!-!I$!6(I4)!*'!#$*#:#g*I)%!pAD2()q!E12#6-.#)$'%!2'6-2'%[!4()1-12','$&'!%'-!.-I%-!*'!#$.I,42#,#'$&)!*'!I$-!2'J!)!('6I2-.#5$!
?GC! pGD4#<q!H$O)(,-.#5$!4'(%)$-2[!4()1-12','$&'!UI'1(-$&'!%'(#-,'$&'!2-!2'J!)!-260$!('g62-,'$&)!*'!4()&'..#5$!*'!#$O)(,-.#5$!4'(%)$-2!
?KC! pAD*-q!/()1-12','$&'!.-I%'!2-!#$&'((I4.#5$!*'!-.&#:#*-*'%!4()4#-%!*'!2-!E(6-$#Q-.#5$!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
G@!/-(-!.-*-!-.&#:)!%'!#$*#.-!%I!:-2)(-.#5$!'$!.-*-!*#,'$%#5$!*'!%'6I(#*-*D!!3),)!.(#&'(#)%!*'!:-2)(-.#5$!%'!V-!',42'-*)!'2!.-4R&I2)!jBD!3(#&'(#)%!*'!:-2)(-.#5$k!*'2!j3-&82)6)!*'!L2'g,'$&)%kD!3),)!*#,'$%#)$'%!*'!%'6I(#*-*!%'!V-!',42'-*)!2-!('2-.#5$!*'2!.-4R&I2)!j>D!\#,'$%#)$'%!*'!:-2)(-.#5$k!*'2!j3-&82)6)!*'!L2','$&)%kD!
"-6'(#&!:'(%#5$!<! ! 3-%)!4(8.&#.)!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!@BS!?*'!@ABC!
.)$!#,4-.&)!'$!)&(-%!)(6-$#Q-.#)$'%!?NC! pGD4#<q!H$O)(,-.#5$!4'(%)$-2[!4()1-12','$&'!UI'1(-$&'!%'(#-,'$&'!2-!2'J!)!-260$!('g
62-,'$&)!*'!4()&'..#5$!*'!#$O)(,-.#5$!4'(%)$-2!?PC! pAD2()q!E12#6-.#)$'%!2'6-2'%[!4()1-12','$&'!%'-!.-I%-!*'!#$.I,42#,#'$&)!*'!I$-!2'J!)!
('6I2-.#5$!?@SC! pAD2()q!E12#6-.#)$'%!2'6-2'%[!4()1-12','$&'!%'-!.-I%-!*'!#$.I,42#,#'$&)!*'!I$-!2'J!)!
('6I2-.#5$!!
3I-$*)!'%&-!:-2)(-.#5$!%'!4()4-6-!-!&(-:;%!*'2!8(1)2!*'!*'4'$*'$.#-%G<W!('%I2&-!2-!%#6I#'$&'!&-12-!*'!:-2)(!-.I,I2-*)!'$!.-*-!I$)!*'!2)%!-.&#:)%!*'2!%#%&',-!?%'!,I'%&(-!%)1('!O)$*)!12-$.)!2)!UI'!'%!:-2)(!4()4#)W!J!%)1('!O)$*)!*'!.)2)(!2)!UI'!'%!-.I,I2-*)C[!
dimensiones de seguridad
-.&#:)! p\q! pHq! p3q! p+�]q p+�\q! p`�]q! p`�\q
p]�`�4('%'$.#-2q!`(-,#&-.#5$!4('%'$.#-2 pAq! ! ! pKq! ! pGq! !
p]�`�(',)&-q!`(-,#&-.#5$!(',)&-! p>q! ! ! pKq! ! pGq! !
p\�'M4q!LM4'*#'$&'%!'$!.I(%)! pAq! pAq! pGq! pKq! pAq! pGq! pAq!
p',-#2q!"'$%-F'(R-!'2'.&(5$#.-! pAq! ! ! pKq! ! pGq! !
p-(.V#:)q!+(.V#:)!V#%&5(#.)!.'$&(-2! pAq! pAq! pGq! pKq! pAq! pGq! pAq!
p]|�'M4q!`(-,#&-.#5$!*'!'M4'*#'$&'%! pAq! pAq! pGq! pKq! pAq! pGq! pAq!
p/3q!/I'%&)%!*'!&(-1-F)! pAq! pAq! pGq! pKq! pAq! pGq! pAq!
p]Z_q!]'(:#*)(! pAq! pAq! pGq! pKq! pAq! pGq! pAq!
pO#('y-22q!3)(&-OI'6)%! pAq! pAq! pGq! pKq! pAq! pGq! pAq!
pT+7q!Z'*!2).-2! pAq! pAq! pGq! pKq! pAq! pGq! pAq!
p+\]Tq!3)$'M#5$!-!H$&'($'&! pAq! pAq! pGq! pKq! pAq! pGq! pAq!
!
L$!'%&'!4I$&)!%'!)1&#'$'!'2!j")*'2)!*'!_-2)(kG>!*'!2-!)(6-$#Q-.#5$D!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
G<!_'(!j^IR-!*'!`;.$#.-%k!%'..#5$!j<D<D@D!")*'2)!.I-2#&-&#:)kD!G>!_'(!j+4;$*#.'!BD@D!")*'2)!*'!:-2)(k!*'2!j3-&82)6)!*'!L2','$&)%kD!
"-6'(#&!:'(%#5$!<! ! 3-%)!4(8.&#.)!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!@B@!?*'!@ABC!
7.2.4. Actividad A2.2: Caracterización de las amenazas
]#'$*)!*#OR.#2W!4)(!$)!*'.#(!#,4)%#12'W!.-(-.&'(#Q-(!2)!UI'!4)*(R-!).I((#(2'!-!2)%!-.&#:)%!%#!$)!VI1#'(-!%-2:-6I-(*-%!*'%42'6-*-%W!%'!('.I(('!-!I$-!.-2#O#.-.#5$!'%&8$*-(!*'!2-%!-,'$-Q-%!&R4#.-%!%)1('!2)%!-.&#:)%!&'$#'$*)!'$!.I'$&-!%I!$-&I(-2'Q-!J!%I!:-2)(D!!
3)$!&)*-%!'%&-%!.)$%#*'(-.#)$'%W!J!-!&R&I2)!#2I%&(-&#:)W! 2-!%#6I#'$&'!&-12-GB!,I'%&(-!2-%!-,'$-Q-%!UI'!%'!V-$!.)$%#*'(-*)!&R4#.-%!4-(-!'2!.-%)!*'!2)%!'M4'*#'$&'%!-*,#$#%&(-&#:)%D!!
!
! ! *#,'$%#)$'%!*'!%'6I(#*-*!
-.&#:)!d!-,'$-Q-! O('.I'$.#- \! H! 3! +�]! +�\! `�]! `�\
!!!!p\�'M4q!LM4'*#'$&'%!'$!.I(%)! ! ASt ASt @SSt @SSt! @SSt! @SSt @SSt
!!!!!!!!pLD@q!L(()('%!*'!2)%!I%I-(#)%! @S! @St @St ! ! ! ! !
!!!!!!!!pLD<q!L(()('%!*'2!-*,#$#%&(-*)(! @! <St <St @St @St! @St! <St <St
!!!!!!!!pLD>q!L(()('%!*'!,)$#&)(#Q-.#5$!?2)6C! @! ! ! ! ! ! ASt ASt
!!!!!!!!pLDBq!L(()('%!*'!.)$O#6I(-.#5$! SWA! ASt @St @St ASt! ASt! ASt ASt
!!!!!!!!pLD@Bq!L%.-4'%!*'!#$O)(,-.#5$! @! ! ! @t! ! ! ! !
!!!!!!!!pLD@Aq!+2&'(-.#5$!*'!2-!#$O)(,-.#5$! @S! ! @t! ! ! ! ! !
!!!!!!!!pLD@Gq!H$&()*I..#5$!*'!O-2%-!#$O)(,-.#5$! @SS! ! @t! ! ! ! ! !
!!!!!!!!pLD@Kq!\'6(-*-.#5$!*'!2-!#$O)(,-.#5$! @S! ! @t! ! ! ! ! !
!!!!!!!!pLD@Nq!\'%&(I..#5$!*'!2-!#$O)(,-.#5$! @S! @t! ! ! ! ! ! !
!!!!!!!!pLD@Pq!\#:I26-.#5$!*'!#$O)(,-.#5$! @! ! ! @St ! ! ! !
!!!!!!!!p+DBq!"-$#4I2-.#5$!*'!2-!.)$O#6I(-.#5$! SW@! ASt @St ASt @SSt! @SSt! @SSt @SSt
!!!!!!!!p+D@@q!+..'%)!$)!-I&)(#Q-*)! @SS! ! @St ASt ASt! ! ! !
!!!!!!!!p+D@Bq!H$&'(.'4.#5$!*'!#$O)(,-.#5$!?'%.I.V-C @S! ! ! ASt ! ! ! !
!!!!!!!!p+D@Aq!")*#O#.-.#5$!*'!#$O)(,-.#5$! @S! ! ASt ! ! ! ! !
!!!!!!!!p+D@Gq!H$&()*I..#5$!*'!O-2%-!#$O)(,-.#5$! <S! ! ASt ! ! ! ! !
!!!!!!!!p+D@Kq!3)((I4.#5$!*'!2-!#$O)(,-.#5$! @S! ! ASt ! ! ! ! !
!!!!!!!!p+D@Nq!\'%&(I..#5$!*'!2-!#$O)(,-.#5$! @S! ASt ! ! ! ! ! !
!!!!!!!!p+D@Pq!\#:I26-.#5$!*'!#$O)(,-.#5$! @S! ! ! @SSt ! ! ! !
!
75&'%'!UI'!V-J!I$-!*#O'('$.#-!'$&('!2-!4'(.'4.#5$!*'2!I%I-(#)!J!2-%!-,'$-Q-%!4)&'$.#-2'%!'$!'2!%#%&',-D!L%&-!*#O'('$.#-!%'!*'1'!-! 2-!'M#%&'$.#-!*'!%-2:-6I-(*-%W!UI'!%'! &'$*(8!'$!.I'$&-!,8%!-*'2-$&'D!
L$!'%&'!4I$&)!%'!)1&#'$'!'2!j"-4-!*'!Z#'%6)%kGA!*'!2-!)(6-$#Q-.#5$D!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
GB!T-!4(#,'(-!.)2I,$-!,I'%&(-! 2-%!-,'$-Q-%! &R4#.-%!%)1('!'2!-.&#:)D!T-!%'6I$*-!.)2I,$-!('.)6'! 2-! O('g.I'$.#-!*'!).I(('$.#-!'M4('%-*-!.),)!&-%-!-$I-2!?#$.#*'$.#-%!4)(!-c)CD!T-%!*',8%!.)2I,$-%!('.)6'$!2-!*'6(-*-.#5$!*'2!-.&#:)!'M4('%-*-!.),)!4)(.'$&-F'!*'!%I!:-2)(D!i-J!I$-!.)2I,$-!4)(!*#,'$%#5$!*'!%'6I(#*-*!?:;-%'!j3-&82)6)!*'!L2','$&)%kW!.-4R&I2)!j>D!\#,'$%#)$'%!*'!:-2)(-.#5$kCD!
GA!_'(!j+4;$*#.'!BD<D!"-4-!*'!(#'%6)%k!*'2!j3-&82)6)!*'!L2','$&)%kD!
"-6'(#&!:'(%#5$!<! ! 3-%)!4(8.&#.)!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!@B<!?*'!@ABC!
7.2.5. Actividad A2.4: Estimación de impacto y riesgo
]#$!&'$'(!&)*-:R-!'$!.I'$&-!2-%!%-2:-6I-(*-%W!%'!*'(#:-$!2-%!%#6I#'$&'%!'%&#,-.#)$'%!*'!#,4-.&)!J!(#'%6)!-.I,I2-*)!%)1('!2)%!*#O'('$&'%!-.&#:)%D!T-%!&-12-%!%#6I#'$&'%!('.)6'$!4-(-!.-*-!-.&#:)!?O#g2-%C!2-!'%&#,-.#5$!*'!#,4-.&)!J!(#'%6)!'$!.-*-!*#,'$%#5$!*'!%'6I(#*-*!?.)2I,$-%CD!
Impacto acumulado66
!
!
Riesgo acumulado67
!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
GG!/-(-!'2!.82.I2)!*'2!#,4-.&)!-.I,I2-*)!%'!%#6I'!2)!#$*#.-*)!'$!2-!%'..#5$!j<D@D>D!/-%)!B[!\'&'(,#$-.#5$!*'2!#,4-.&)kW!*)$*'!%'!&#'$'!'$!.I'$&-!'2!:-2)(!-.I,I2-*)!%)1('!'2!-.&#:)!?'$!2-!.#&-*-!*#,'$%#5$C!J!2-!*'6(-*-.#5$!.-I%-*-!4)(!2-!-,'$-Q-!?'$!2-!.#&-*-!*#,'$%#5$CD!_;-%'!&-,1#;$!2-!%'..#5$!j<D<D@D!")*'2)!.I-2#&-&#:)k!*'!2-!j^IR-!*'!`;.$#.-%kD!
GK!/-(-!'2!.82.I2)!*'2!(#'%6)!-.I,I2-*)!%'!%#6I'!2)!#$*#.-*)!'$!2-!%'..#5$!j<D@DBD!\'&'(,#$-.#5$!*'2!(#'%6)kW!*)$*'!%'!#$.)(4)(-!2-!O('.I'$.#-!'%&#,-*-!*'!).I(('$.#-!*'!2-!-,'$-Q-D!]'!I#Q-!I$!,)*'2)!&-1I2-(!%#g,#2-(!-2!*'%.(#&)!'$!2-!%'..#5$!j<D@D!+$82#%#%!,'*#-$&'!&-12-%k!*'!2-!j^IR-!*'!`;.$#.-%kD!]'!I#Q-!I$-!'%g.-2-!*'!�S�!-!�A�!4-(-!.-2#1(-(!'2!(#'%6)D!
"-6'(#&!:'(%#5$!<! ! 3-%)!4(8.&#.)!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!@B>!?*'!@ABC!
Impacto repercutido68
L$!'%&-%! &-12-%! %'! -$-2#Q-! .-*-! -.&#:)! ?%I4'(#)(C! :-2)(-*)! '$! %R!,#%,)! ?.)$! :-2)(! 4()4#)C! J! %'!V-.'!I$!%'6I#,#'$&)!*'!-UI'22)%!)&()%!-.&#:)%!?#$O'(#)('%C!*'!2)%!UI'!*'4'$*'D!3I-$*)!2-%!-,'g$-Q-%!%'!,-&'(#-2#Q-$!%)1('!2)%!-.&#:)%!#$O'(#)('%W!'2!4'(FI#.#)!('4'(.I&'!%)1('!2)%!%I4'(#)('%D!
!
!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
GN!/-(-!'2!.82.I2)!*'2!#,4-.&)!('4'(.I&#*)!%'!%#6I'!2)!#$*#.-*)!'$!2-!%'..#5$!j<D@D>D!/-%)!B[!\'&'(,#$-.#5$!*'2!#,4-.&)kW!*)$*'!%'!I#Q-!'2!:-2)(!4()4#)!*'2!-.&#:)!%I4'(#)(!J!2-!*'6(-*-.#5$!.-I%-*-!4)(!2-!-,'$-Q-!%)1('!'2!-.&#:)!#$O'(#)(!#$*#.-*)D!
"-6'(#&!:'(%#5$!<! ! 3-%)!4(8.&#.)!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!@BB!?*'!@ABC!
Riesgo repercutido69
!
!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
GP!/-(-!'2!.82.I2)!*'2!(#'%6)!('4'(.I&#*)!%'!%#6I'!2)!#$*#.-*)!'$!2-!%'..#5$!j<D@DBD!\'&'(,#$-.#5$!*'2!(#'%6)kW!*)$*'!%'!#$.)(4)(-!2-!O('.I'$.#-!'%&#,-*-!*'!).I(('$.#-!*'!2-!-,'$-Q-!%)1('!'2!-.&#:)!#$O'(#)(!#$*#.-*)D!!
"-6'(#&!:'(%#5$!<! ! 3-%)!4(8.&#.)!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!@BA!?*'!@ABC!
7.2.6. Actividad A2.3: Caracterización de las salvaguardas
+!2-!V)(-!*'!':-2I-(!'2!'%&-*)!*'!%'6I(#*-*!*'!2-!I$#*-*!1-F)!'%&I*#)W!V-J!UI'!#$*-6-(!I$-!%'(#'!*'!-%4'.&)%!6'$'(-2'%! J!I$-!%'(#'!*'!-%4'.&)%!'%4'.RO#.)%!*'!.-*-!-.&#:)D!L$!'%&-! #$*-6-.#5$!V-J!UI'!&'$'(!'$!.I'$&-!&-$&)! 2-!$-&I(-2'Q-!*'! 2)%!-.&#:)%!.),)!%I!:-2)(!J! 2-%!-,'$-Q-%!-!UI'!'%&8!'M4I'%&)D!
L$!-%4'.&)%!6'$'(-2'%!V-J!UI'!-:'(#6I-(!
!" .5,)!%'!)(6-$#Q-!2-!%'6I(#*-*[!('%4)$%-12'%W!&),-!*'!*'.#%#)$'%W!.)$&-.&)%!'M&'($)%W!'&.D!
!" %#!V-J!I$-!#*'$&#O#.-.#5$!*'!()2'%!*'2!4'(%)$-2W!-%).#-*)%!-!4(#:#2'6#)%!*'!-..'%)!
!" %R!V-J!%'6('6-.#5$!'O'.&#:-!*'!&-('-%!
!" %#!'M#%&'!I$-!4)2R&#.-!*'!%'6I(#*-*!*).I,'$&-*-!J!(':#%-*-!4'(#5*#.-,'$&'!
!" .5,)!%'!6'%&#)$-$!2-%!#$.#*'$.#-%!
!" .5,)!%'!6'%&#)$-$!2)%!('6#%&()%!*'!-.&#:#*-*!
!" %#!'M#%&'!I$!42-$!*'!.)$&#$6'$.#-[!6'%$!*'!','(6'$.#-%W!.)$&#$I#*-*!J!('.I4'(-.#5$!
Z'%4'.&)!*'!2)%!%'(:#.#)%!4('%&-*)%!4)(!2-!E(6-$#Q-.#5$W!V-J!UI'!-:'(#6I-(!
!" %#!'M#%&'!$)(,-&#:-!J!4().'*#,#'$&)%!*'!I%)W!.)$).#*)%!J!',42'-*)%!
!" %#!V-J!I$-!42-$#O#.-.#5$!*'!.-4-.#*-*'%!
!" %#!V-J!,'.-$#%,)%!*'!4(':'$.#5$!*'2!('4I*#)!
!" %#!V-J!,'.-$#%,)%!*'!4(':'$.#5$!*'!-&-UI'%!*'!*'$'6-.#5$!*'!%'(:#.#)!
!" .5,)!%'!6'%&#)$-$!2)%!I%I-(#)%!
!" UI;!('6#%&()!UI'*-!*'!2)!UI'!%'!V-.'!
Z'%4'.&)!*'!2)%!*-&)%!,-$'F-*)%!4)(!2-!E(6-$#Q-.#5$W!V-J!UI'!-:'(#6I-(!
!" %#!V-J!I$!#$:'$&-(#)!*'!O#.V'()%W!.)$!#*'$&#O#.-.#5$!*'!('%4)$%-12'!
!" %#!'M#%&'!$)(,-&#:-!J!4().'*#,#'$&)%!*'!I%)W!.)$).#*)%!J!',42'-*)%!
!" %#!%'!V-.'$!.)4#-%!*'!('%4-2*)!J!.)$!UI;!.-2#*-*!
!" %#!%'!V-$!4(':#%&)!,'.-$#%,)%!4-(-!6-(-$&#Q-(!'2!%'.('&)!
!" %#!%'!V-$!4(':#%&)!,'.-$#%,)%!4-(-!6-(-$&#Q-(!2-!#$&'6(#*-*!
!" %#!%'!V-$!4(':#%&)!,'.-$#%,)%!*'!('6#%&()!*'!-..'%)!
Z'%4'.&)!*'!2)%!-42#.-&#:)%!'$!I%)W!V-J!UI'!-:'(#6I-(!
!" .5,)!%'!6'%&#)$-!%I!,-$&'$#,#'$&)!
!" .5,)!%'!.)$&()2-!%I!.)$O#6I(-.#5$W!'$!4-(&#.I2-(!*'!I%I-(#)%!J!*'('.V)%!*'!-..'%)!
!" %#!%'!V-!#$%4'..#)$-*)!'2!.5*#6)W!'%4'.#-2,'$&'!O('$&'!-!4I'(&-%!&(-%'(-%!*'!-..'%)!
Z'%4'.&)!*'2!%'(:#.#)!*'!,'$%-F'(R-!?emailCW!V-J!UI'!-:'(#6I-(!
!" %#!'M#%&'!$)(,-&#:-!J!4().'*#,#'$&)%!*'!I%)W!.)$).#*)%!J!',42'-*)%!
!" .5,)!%'!6'%&#)$-$!2)%!I%I-(#)%!
!" .5,)!%'!.)$&()2-!'2!.)$&'$#*)!*'!2)%!,'$%-F'%!J!*'!2)%!O#.V'()%!-*FI$&)%!
!" *'%*'!'2!4I$&)!*'!:#%&-!*'!OI6-%!*'!#$O)(,-.#5$!
!" *'%*'!'2!4I$&)!*'!:#%&-!*'!#$J'..#5$!*'!4()6(-,-%!*-c#$)%!?4)(!'F',42)W!:#(I%C!
!" *'%*'!'2!4I$&)!*'!:#%&-!*'!-I&'$&#.#*-*!*'2!)(#6'$!
!" .5,)!%'!-%'6I(-!2-!*#%4)$#1#2#*-*!*'2!%'(:#.#)!
"-6'(#&!:'(%#5$!<! ! 3-%)!4(8.&#.)!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!@BG!?*'!@ABC!
Z'%4'.&)!*'2!%'(:#.#)!*'!-(.V#:)W!V-J!UI'!-:'(#6I-(!
!" %#!'M#%&'!$)(,-&#:-!J!4().'*#,#'$&)%!*'!I%)W!.)$).#*)%!J!',42'-*)%!
!" .5,)!%'!.)$&()2-!UI#;$!-..'*'!-!%I!I%)!
!" .5,)!%'!6-(-$&#Q-!'2!%'.('&)!*'!2)%!*-&)%!UI'!&(-$%4)(&-$!
!" .5,)!%'!6-(-$&#Q-!%I!*#%4)$#1#2#*-*!
Z'%4'.&)!*'2!'UI#4-,#'$&)!#$O)(,8&#.)W!V-J!UI'!-:'(#6I-(!
!" %#!'M#%&'!$)(,-&#:-!J!4().'*#,#'$&)%!*'!I%)W!.)$).#*)%!J!',42'-*)%!
!" .5,)!%'!6'%&#)$-!%I!,-$&'$#,#'$&)!
!" .5,)!%'!.)$&()2-!%I!.)$O#6I(-.#5$W!'$!4-(&#.I2-(!*'!I%I-(#)%!J!*'('.V)%!*'!-..'%)!
!" .5,)!%'!6-(-$&#Q-!%I!*#%4)$#1#2#*-*!
Z'%4'.&)!*'!2-%!.),I$#.-.#)$'%W!V-J!UI'!-:'(#6I-(!
!" %#!'M#%&'!$)(,-&#:-!J!4().'*#,#'$&)%!*'!I%)W!.)$).#*)%!J!',42'-*)%!
!" .5,)!%'!.)$&()2-!UI#;$!-..'*'!-!%I!I%)!
!" .5,)!%'!6-(-$&#Q-!'2!%'.('&)!*'!2)%!*-&)%!UI'!&(-$%4)(&-$!
!" .5,)!%'!6-(-$&#Q-!%I!*#%4)$#1#2#*-*!
`'$6-!'$!.I'$&-!'2! 2'.&)(!UI'!'%&)!'%!%52)!I$!'F',42)!UI'!$)!4('&'$*'!%'(!'MV-I%&#:)D!]'!V-$!('O'('$.#-*)!2)%!-%4'.&)%!,8%!('2':-$&'%h!$)!&)*)%D!L%!'%4'.#-2,'$&'!*'!*'%&-.-(!2-!-I%'$.#-!*'!I$! -$82#%#%! *'! 2-%! #$%&-2-.#)$'%! OR%#.-%! J! *'2! 4'(%)$-2W! UI'! V-$! UI'*-*)! OI'(-! 4)(!,-$&'$'(! '2!'F',42)!('*I.#*)DD!
H$*-6-$*)!%'!-:'(#6I-!UI'[!
!" LM#%&'!I$-!4)2R&#.-!*'!%'6I(#*-*!V'('*-*-!*'! 2-!E(6-$#Q-.#5$!,-&(#Q!*'! 2-!I$#*-*!UI'!$)%!).I4-D!+2!%'(!I$-!I$#*-*!*'!4'UI'c-%!*#,'$%#)$'%W!'M#%&'!I$!('%4)$%-12'!0$#.)!*'!%'6I(#g*-*!UI'!#$O)(,-!*#('.&-,'$&'!-!2-!\#('..#5$!J!'%!'2!.)$&-.&)!O('$&'!-!)&(-%!)(6-$#Q-.#)$'%D!+*',8%!'M#%&'!I$!4().'*#,#'$&)! 2).-2!*'!'%.-2-*)!*'! #$.#*'$.#-%!UI'!4I'*'!4():).-(!I$!'%.-2-*)!,8%!-228!*'!2-!4()4#-!I$#*-*D!
!" L2! %'(:#*)(! .'$&(-2! V)%4'*-!I$-! &-12-! 4-(-! .)$&()2-(! UI;!4(#:#2'6#)%! *'! -..'%)! &#'$'! .-*-!I%I-(#)W!'$!4-(&#.I2-(!*#O'('$.#-$*)! 2-!.-4-.#*-*!-*,#$#%&(-&#:-!4-(-!*-(!.I(%)!-! 2)%!'M4'g*#'$&'%!-!2)!2-(6)!*'!%I!4().'%)D!`)*-!2-!-.&#:#*-*!%'!('6#%&(-!'$!I$!O#.V'()!-2!UI'!%52)!%'!&#'$'!-..'%)!'2!)4'(-*)(!J!UI'!%'!(',#&'!*#-(#-,'$&'!-2!-(.V#:)!.'$&(-2D!
!" T)%!4().'*#,#'$&)%!*'!&(-1-F)!.)$!2)%!%#%&',-%!$)!'%&8$!'%.(#&)%D!]'!.)$OR-!'$!UI'!2-%!4()g4#-%!-42#.-.#)$'%!y'1!-*-4&'$!2-%!-.&#:#*-*'%!UI'!%'!4I'*'$!('-2#Q-(!'$!.-*-!,),'$&)!%'g60$!'2!'%&-*)!*'2!'M4'*#'$&'!'$!.I(%)!J!2)%!4(#:#2'6#)%!*'2!I%I-(#)D!]R!%'!('-2#Q-!I$!('6#%&()!*'!&)*-%!J!.-*-!I$-!*'!2-%!-.&I-.#)$'%!*'2!4'(%)$-2!%)1('!2)%!%'(:#.#)%!y'1D!/-(-!'2!4().'g%)! ,-$I-2! 'M#%&'$! I$-! %'(#'! *'! #,4('%)%! *#%4)$#12'%! .)$! #$%&(I..#)$'%! #$.2I#*-%! %)1('!.I8$*)!I%-(2)%W!UI;!*-&)%!4()4)(.#)$-(!J!.5,)!&(-,#&-(2)%D!
!" 9$-!4'(%)$-!*'! 2-!I$#*-*! &#'$'! 2-%! OI$.#)$'%!*'!)4'(-*)(W!'$.-(68$*)%'!*'! &)*-%! 2-%! &-g('-%!*'!#$%&-2-.#5$W!.)$O#6I(-.#5$!J!('%)2I.#5$!*'!#$.#*'$.#-%D!L%&-!4'(%)$-!*#%4)$'!*'!4()g.'*#,#'$&)%!'%.(#&)%!4-(-!2-%!-.&#:#*-*'%!(I&#$-(#-%h!4'()!*'1'!#,4():#%-(!'$!%#&I-.#)$'%!-&Rg4#.-%W!4-(-!2-%!UI'!4I'*'!('.I((#(!-2!%)4)(&'!&;.$#.)!*'!2-!E(6-$#Q-.#5$!,-&(#QD!
!" 7)!'M#%&'!$#$60$!42-$!*'!.)$&#$6'$.#-!?,8%!-228!*'2!4().'%)!,-$I-2!*'!2-%!-.&#:#*-*'%CD!
!" LM#%&'$!.)$&(-&)%!*'!,-$&'$#,#'$&)!.)$!2)%!%I,#$#%&(-*)('%!*'!2)%!'UI#4)%!J!*'!2)%!4()6(-g,-%!18%#.)%[!%#%&',-!)4'(-&#:)W!)O#,8&#.-W!.)((')!J!%'(:#*)('%!y'1D!
!" T)%!I%I-(#)%! #$&'($)%!%)$!-*,#$#%&(-*)%!4)(!'2!)4'(-*)(W!UI'!('UI#'('!%)2#.#&I*!4)(!'%.(#&)!*'!-2&-%W!1-F-%!J!.-,1#)%D!\#.V-!%)2#.#&I*!*'1'!:'$#(!O#(,-*-!4)(!'2!6'('$&'D!
"-6'(#&!:'(%#5$!<! ! 3-%)!4(8.&#.)!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!@BK!?*'!@ABC!
!" T)%!I%I-(#)%!'M&'($)%!%'!*-$!*'!-2&-!4'(%)$-2,'$&'W!#$*#.-$*)!%I!7HeD!/-(-!('.-1-(!%I!.)$g&(-%'c-!*'1'$!4'(%)$-(%'! OR%#.-,'$&'! 2-!4(#,'(-!:'QD!9$-!:'Q! ('6#%&(-*)%!$)!%'!V-.'!I$!%'6I#,#'$&)!*'!2-%!.I'$&-%W!UI'!*I(-$!#$*'O#$#*-,'$&'D!
!" `-$&)!2)%!I%I-(#)%!#$&'($)%!.),)!'M&'($)%!%'!#*'$&#O#.-$!4)(!,'*#)!*'!I$!$),1('!*'!I%I-(#)!J!I$-!.)$&(-%'c-D!`)*)%! ('.#1'$!I$-%!%),'(-%! #$%&(I..#)$'%!%)1('!.5,)!'2'6#(!.)$&(-%'gc-%h!4'()!$)!%'!:'(#O#.-!UI'!2-%!.I,42-$W!$#!UI'!2-%!.)$&(-%'c-%!%'!.-,1#'$!('6I2-(,'$&'D!!
!" ]'!V-!('-2#Q-*)!('.#'$&','$&'!I$-!-I*#&)(R-!*'!2)%!*-&)%!*'!.-(8.&'(!4'(%)$-2W!V-1#'$*)!%#g*)!%I4'(-*-!42'$-,'$&'!'$!&)*)%!2)%!-%4'.&)%D!
!" T)%!*-&)%!4().'*'$&'%!*'2!-(.V#:)!.'$&(-2!%'!.)$%#*'(-$!.)(('.&)%D!T)%!*-&)%! #$&()*I.#*)%!4)(!2)%!.#I*-*-$)%!*'1'$!%'(!:-2#*-*)%!4)(!'2!4'(%)$-2!*'!2-!I$#*-*D!T)%!*-&)%!#$&()*I.#*)%!4)(!2)%!I%I-(#)%!#$&'($)%!*'1'$!%'(!:-2#*-*)%!4)(!I$!%'6I$*)!I%I-(#)h!$)(,-2,'$&'!2)%!#$g&()*I.'!I$-!4'(%)$-!J!2)%!:-2#*-!UI#'$!O#(,-!'2!4()6('%)!*'2!'M4'*#'$&'D!
!" L2!-42#.-&#:)!*'!&(-,#&-.#5$!*'!'M4'*#'$&'%!'%!%I,#$#%&(-*)!4)(!2-!E(6-$#Q-.#5$!,-&(#QW!.)$g%#*'(8$*)%'!j*'!.-2#*-*!%IO#.#'$&'kD!
!" ]'!V-!#$%&-2-*)!I$!%#%&',-!-$&#g:#(I%!J!%'!V-!.)$&(-&-*)!I$!%'(:#.#)!*'!,-$&'$#,#'$&)!<BMK!-!&(-:;%!*'!2-!E(6-$#Q-.#5$!,-&(#Q!.)$!I$!&#',4)!*'!('%4I'%&-!#$O'(#)(!-!@!*R-D!
!" L2!%'(:#.#)!*'!,'$%-F'(R-!%'!.'$&(-2#Q-!'$!'2!%'(:#*)(!*'!O)(,-!UI'!'2!-..'%)!*'!2)%!I%I-(#)%!#$&'($)%!'%!-!&(-:;%!*'!I$-!#$&'(O-Q!y'1D!]#%&',8&#.-,'$&'!%'!'2#,#$-!&)*)!)!*'!-$'M)!'$!'2!.)((')!%-2#'$&'!J!%'!-$-2#Q-!.)$!'2!-$&#g:#(I%!2)%!-$'M)%!*'2!.)((')!'$&(-$&'D!
!" L2!%'(:#.#)!*'!-(.V#:)!.'$&(-2!'%!I$!%'(:#.#)!4('%&-*)!'M&'($-,'$&'!UI'!%'!:-!-!.)$%#*'(-(!j*'!.-2#*-*!%IO#.#'$&'kD!L$!I$!-$82#%#%!,8%!*'&-22-*)!V-1(8!UI'!'$&(-(!'$!2-!4('%&-.#5$!*'!'%g&'!%'(:#.#)D!
!" T-%!.),I$#.-.#5$!-!H$&'($'&! !('%4)$*'!-!I$!.)$&(-&)!+\]T!'%&8$*-(W!$)!V-1#;$*)%'!('-2#gQ-*)!I$!'%&I*#)!*'!$'.'%#*-*'%W!$#!'%&-(!4(':#%&-!$#$6I$-!.28I%I2-!.)$&(-.&I-2!*'!.-2#*-*!*'!%'(:#.#)!)!-,42#-.#5$!*'!.-4-.#*-*D!
!" T-!.)$'M#5$!-2!-(.V#:)!.'$&(-2!%'!('-2#Q-!%)1('!H$&'($'&W!I%-$*)!I$-!('*!4(#:-*-!:#(&I-2!UI'!%'! '%&-12'.'! '$&('! 2)%! 'M&(',)%D!L%&-! ('*! '%&8! .)$O#6I(-*-! J!,-$&'$#*-! *'%*'!'2! -(.V#:)!.'$&(-2W!%#$!&'$'(!.-4-.#*-*!2).-2!*'!.)$O#6I(-.#5$!-26I$-D!]'!.)$%#*'(-(8!j*'!.-2#*-*!%IO#g.#'$&'kD!
L$!'%&'!4I$&)!%'!)1&#'$'!2-!jL:-2I-.#5$!*'!]-2:-6I-(*-%kKS!*'!2-!)(6-$#Q-.#5$D!
Insuficiencias detectadas
3)&'F-*)%!2)%!*'%.I1(#,#'$&)%W!%'!-4('.#-$!2-%!%#6I#'$&'%!#$%IO#.#'$.#-%[!
!" T-!%'6('6-.#5$!*'! &-('-%!'%!-*'.I-*-!'M.'4&)!'$!'2! .-%)!*'2! -*,#$#%&(-*)(!*'!%#%&',-%!UI'!*#%4)$'!*'!-,42#-!.-4-.#*-*!*'!-..'%)!-!&)*)%!2)%!%#%&',-%W!#$%&-2-.#)$'%!J!.)$O#6I(-g.#)$'%D!
!" \'1'(R-!'M#%&#(!I$!42-$!*'!.)$&#$6'$.#-[!6'%$!*'!','(6'$.#-%W!42-$!*'!.)$&#$I#*-*!J!42-$!*'!('.I4'(-.#5$D!
!" \'1'(R-$!'M#%&#(!4().'*#,#'$&)%!'%.(#&)%!4-(-!&)*-%!2-%!&-('-%!)(*#$-(#-%!J!4-(-!2-%!#$.#*'$g.#-%!4(':#%#12'%W!#$.2IJ'$*)!&)*-%!2-%!UI'!%'!V-J-$!*-*)!'$!'2!4-%-*)D!
!" \'1'(R-!('-2#Q-(%'!I$!'%&I*#)!*'2!I%)!*'!2-!.)$'M#5$!+\]T!J!%I!':)2I.#5$!4-(-!4)*'(!42-$#gO#.-(! I$-! -,42#-.#5$! *'! .-4-.#*-*D! `-,1#;$! *'1'(R-! '%&-12'.'(%'! .)$! '2! 4():''*)(! I$!-.I'(*)!*'!.-2#*-*!*'!%'(:#.#)D!
!" \'1'(R-$!'%&-12'.'(%'!,'.-$#%,)%!4-(-!*'&'.&-(!J!('-..#)$-(!-!I$!-&-UI'!*'!*'$'6-.#5$!*'!%'(:#.#)D!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
KS!_'(!j+4;$*#.'!BD>D!L:-2I-.#5$!*'!%-2:-6I-(*-%k!*'2!j3-&82)6)!*'!L2','$&)%kD!
"-6'(#&!:'(%#5$!<! ! 3-%)!4(8.&#.)!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!@BN!?*'!@ABC!
!" \'1'(R-!V-.'(%'!I$!%'6I#,#'$&)!*'! 2-%!.I'$&-%!*'! 2)%!I%I-(#)%!'M&'($)%W!-2!,'$)%!*'&'.g&-$*)!2-(6)%!4'(#)*)%!*'! #$-.&#:#*-*W! #$&'$&)%!*'!4'$'&(-.#5$!J!.),4)(&-,#'$&)%!-$5,-2)%!'$!6'$'(-2D!
!" L2! I%)! *'! .)$&(-%'c-%! .),)!,'.-$#%,)! *'! -I&'$&#.-.#5$! %'! .)$%#*'(-! j*;1#2kW! ('.),'$g*8$*)%'!'2!I%)!*'!&-(F'&-%!.(#4&)6(8O#.-%!*'!#*'$&#O#.-.#5$D!
L$!'%&'!4I$&)!%'!)1&#'$'!'2!jH$O)(,'!*'!H$%IO#.#'$.#-%kK@!*'!2-!)(6-$#Q-.#5$D!
7.2.7. Actividad A2.4: Estimación del estado de riesgo
3)$).#*)%!'2!j")*'2)!*'!_-2)(kW!'2!j"-4-!*'!Z#'%6)%k!J!2-!jL:-2I-.#5$!*'!]-2:-6I-(*-%k!%'!4()g.'*'!-!2-!'%&#,-.#5$!*'2!2)%!#$*#.-*)('%!*'!#,4-.&)!J!(#'%6)W!&-$&)!-.I,I2-*)%!?%)1('!2)%!-.&#:)%!#$O'(#)('%C!.),)!('4'(.I&#*)%!?%)1('!2)%!-.&#:)%!%I4'(#)('%CD!
Impacto acumulado residual72
!
Riesgo acumulado residual73
!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
K@!_'(!j+4;$*#.'!BDAD!H$O)(,'!*'!#$%IO#.#'$.#-%k!*'2!j3-&82)6)!*'!L2','$&)%kD!K<!/-(-!'2!.82.I2)!*'2!#,4-.&)!('%#*I-2!%'!%#6I'!2)!#$*#.-*)!'$!2-!%'..#5$!j<D@DGD!Z':#%#5$!*'2!4-%)!B[!#,4-.g&)!('%#*I-2D!_;-%'!&-,1#;$!2-!%'..#5$!j<D<D@D!")*'2)!.I-2#&-&#:)k!*'!2-!j^IR-!*'!`;.$#.-%kD!
K>!/-(-!'2!.82.I2)!*'2!(#'%6)!('%#*I-2!%'!%#6I'!2)!#$*#.-*)!'$!2-!%'..#5$!j<D@DKD!Z':#%#5$!*'2!4-%)!A[!(#'%6)!('%#*I-2D!_;-%'!&-,1#;$!2-!%'..#5$!j<D@D!+$82#%#%!,'*#-$&'!&-12-%k!*'!2-!j^IR-!*'!`;.$#.-%kD!
"-6'(#&!:'(%#5$!<! ! 3-%)!4(8.&#.)!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!@BP!?*'!@ABC!
Impacto repercutido residual
!
"-6'(#&!:'(%#5$!<! ! 3-%)!4(8.&#.)!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!@AS!?*'!@ABC!
Riesgo repercutido residual
!
L$!'%&'!4I$&)!%'!)1&#'$'!'2!jL%&-*)!*'!Z#'%6)kKB!*'!2-!)(6-$#Q-.#5$D!L%&'!jL%&-*)!*'!Z#'%6)k!:#'g$'!*).I,'$&-*)!4)(!'2!#$O)(,'!*'!jL:-2I-.#5$!*'!]-2:-6I-(*-%k!UI'!('.)6'!*'!*'%42#'6I'!-.&I-2!*'!%'6I(#*-*W!J!'2!jH$O)(,'!*'!H$%IO#.#'$.#-%kKA!UI'!('.)6'!2-%!*'1#2#*-*'%!*'%.I1#'(&-%D!
7.3. Proceso P3: Gestión de riesgos
7.3.1. Actividad A3.1: Toma de decisiones
_#%&)%!2)%!#$*#.-*)('%!*'!(#'%6)!('%#*I-2!J!2-%!#$%IO#.#'$.#-%!*'!2-!I$#*-*W!2-!\#('..#5$!*'.#*'!.2-%#gO#.-(!'$!2)%!%#6I#'$&'%!$#:'2'%!2)%!4()6(-,-%!*'!%'6I(#*-*!-!*'%-(()22-([!
De carácter urgente
/@[!\'%-(()22-(!I$!42-$!*'!.)$&#$6'$.#-!
/<[!")$#&)(#Q-(!J!6'%&#)$-(!2-%!.I'$&-%!*'!I%I-(#)%!'M&'($)%!
Consideraciones importantes
/>D@[!\).I,'$&-(! &)*)%! 2)%!4().'*#,#'$&)%!*'! &(-1-F)W! (':#%-$*)! 2)%!-.&I-2'%!J!-c-*#'$*)! 2)%!UI'!O-2&'$!
/>D<[!]'6('6-(!2-%!OI$.#)$'%!*'2!-*,#$#%&(-*)(!*'!%#%&',-%!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
KB!_'(!j+4;$*#.'!BDBD!L%&-*)!*'!(#'%6)k!*'2!j3-&82)6)!*'!L2','$&)%kD!KA!_'(!j+4;$*#.'!BDAD!H$O)(,'!*'!#$%IO#.#'$.#-%k!*'2!j3-&82)6)!*'!L2','$&)%kD!
"-6'(#&!:'(%#5$!<! ! 3-%)!4(8.&#.)!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!@A@!?*'!@ABC!
Temas a considerar en el futuro
!" 9%)!*'!&-(F'&-%!*'!#*'$&#O#.-.#5$!
!" Z'2-.#)$'%!.)$!'2!4():''*)(!*'!.),I$#.-.#)$'%!4-(-!6-(-$&#Q-(!2-!.-2#*-*!*'2!%'(:#.#)!
!" 3)$&(-&-.#5$!*'!I$!%'(:#.#)!-2&'($-&#:)!*'!.),I$#.-.#)$'%!
!" "'*#*-%!O('$&'!-!-&-UI'%!*'!*'$'6-.#5$!*'!%'(:#.#)!
7.3.2. Actividad A3.2: Plan de seguridad
`)*-%!2-%!.)$%#*'(-.#)$'%!-$&'(#)('%!V-J!UI'!42-%,-(2-%!'$!I$!j/2-$!*'!]'6I(#*-*kKG!UI'!)(6-$#gQ-!2-%!-.&#:#*-*'%!*'!O)(,-!42-$#O#.-*-!J!6'%&#)$-*-D!
L2!*'%-(()22)!*'2!42-$!*'!.)$&#$6'$.#-!?4()6(-,-!/@C!%'!&(-*I.'!'$!I$!4()J'.&)!'%4'.RO#.)!4-(-!'2!UI'!
@D! '%&'!-c)!%'!('-2#Q-(8!I$-!'%&#,-.#5$!*'!.)%&'%!*'2!4()J'.&)!J!I$-!%)2#.#&I*!*'!4()4I'%&-%!UI'!%'!.),42'&-(8!.)$!2-!-*FI*#.-.#5$!-!I$!.)$&(-&#%&-!'M&'($)!
<D! -!2-!:#%&-!*'!2-!)O'(&-!6-$-*)(-!%'!*'%&#$-(8$!O)$*)%!'2!-c)!UI'!:#'$'!4-(-!2-!('-2#Q-.#5$!*'2!42-$h!'$!'%&-!('-2#Q-.#5$!%'!#$.2I#(8$!&)*-%!2-%!&-('-%!-*,#$#%&(-&#:-%!?*#,'$%#)$-*)W!%'2'.g.#5$!*'!%)2I.#)$'%W!4().'*#,#'$&)%W!'&.DCW!'M.'4&I8$*)%'! 2-%!4)%#12'%!'F'.I.#)$'%!*'!)1(-!.#:#2!)!.)$&(-&-.#5$!*'!%'(:#.#)%!'M&'($-2#Q-*)%!*'!.)$&#$I#*-*W!UI'!%'(8$!)1F'&)!*'!OI&I(-%!2#.#&-.#)$'%!
/-(-! 2-!,)$#&)(#Q-.#5$!*'!.I'$&-%! ?4()6(-,-!/<C!%'! 2-$Q-!I$!4()J'.&)!4-(-!'2!*'%-(()22)!*'!I$!%#%&',-!*'!6'%$!*'!.I'$&-%!UI'! #$.2IJ-! 2-!*'&'..#5$!*'! #$&(I%#)$'%!J!'2! 2-$Q-,#'$&)!*'!-2-(g,-%D!]'!'%&#,-!UI'!'%&'!4()J'.&)!%'!4I'*'!2-$Q-(!#$,'*#-&-,'$&'!J!UI'!%I!*I(-.#5$!%'(8!*'!I$!-c)D!
/-(-!2-!*).I,'$&-.#5$!*'!&)*)%!2)%!4().'*#,#'$&)%!?4()6(-,-!/>D@C!%'!('.I((#(8!-!I$-!-,42#-.#5$!*'2!.)$&(-&)!*'!.)$%I2&)(R-!J!-%'%)(-,#'$&)!UI'!2-!E(6-$#Q-.#5$!,-&(#Q!&#'$'!-.&I-2,'$&'D!L$!'%&-!-,42#-.#5$W!.)$%I2&)('%!'M&'($)%!%'!'$.-(6-(8$!*'!('.-1-(!2-!#$O)(,-.#5$!4'(&#$'$&'W!.),42'&-$*)!2)%!,-$I-2'%!-.&I-2'%D!L%&-!&-('-!$)!%'!-.),'&'(8!V-%&-!'2!4(5M#,)!'F'(.#.#)D!L$!2-!'2-1)(-.#5$!*'!4().'*#,#'$&)%!%'!*'O#$#(8$! 2-%! &-('-%!'%4'.RO#.-%!*'!I$!)4'(-*)(! ?2).-2C! J!I$!-*,#$#%&(-*)(!?(',)&)C!*'!O)(,-!UI'!%'!-2.-$.'!'2!)1F'&#:)!*'2!4()6(-,-!/>D<D!]'!$'6).#-!.)$!-(.V#:)!.'$&(-2!2-!*#%4)%#.#5$!*'!I$!%'(:#.#)!.'$&(-2#Q-*)!*'!-*,#$#%&(-.#5$W!*'F-$*)!-!$#:'2! 2).-2! 2-%!,'(-%!OI$.#)g$'%!*'!)4'(-.#5$D!
/)(!02&#,)!%'!('.-1-!*'!2-!E(6-$#Q-.#5$!,-&(#Q!#$O)(,-.#5$!%)1('!'2!I%)!*'!&-(F'&-%!*'!#*'$&#O#.-g.#5$!.)(4)(-&#:-%!'!#$.2I%)!*'2!\7H!'2'.&(5$#.)W!.),)!,'*#)%!UI'!4I*#'(-$!I#Q-(%'!'$!'2!OI&I()!4-(-!,'F)(-(!2-!-I&'$&#.#*-*!*'!2)%!I%I-(#)%D!/-(-!'2!4(5M#,)!'F'(.#.#)!%'!.)$&(-&-(8!I$!'%&I*#)!*'!2-%!,)*#O#.-.#)$'%!('UI'(#*-%!4-(-!#$.)(4)(-(!*#.V)%!,'.-$#%,)%W!&-$&)!4-(-!2)%!I%I-(#)%!#$&'($)%!.),)!4-(-!2)%!I%I-(#)%!'M&'($)%D!/-(&'!*'!'%'!'%&I*#)!%'(8!I$!42-$!*'&-22-*)!*'!('-2#Q-.#5$W!UI'!'$!$#$60$!.-%)!%'!-.),'&'(8!-$&'%!*'!*)%!-c)%D!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
KG!_'(!j+4;$*#.'!BDGD!/2-$!*'!%'6I(#*-*k!*'2!j3-&82)6)!*'!L2','$&)%kD!
"-6'(#&!:'(%#5$!<! ! 3-%)!4(8.&#.)!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!@A<!?*'!@ABC!
7.3.3. Evolución de los indicadores de impacto y riesgo
T-%!%#6I#'$&'%!O#6I(-%!,I'%&(-$!2-!':)2I.#5$!*'!2)%!#$*#.-*)('%!*'!#,4-.&)!J!(#'%6)W!-.I,I2-*)!J!('4'(.I&#*)W!'$!&('%!#$%&-$&'%!*'!2-!6'%$!*'2!%#%&',-!*'!#$O)(,-.#5$!%),'&#*)!-!'%&I*#)[!
!" %#$!%-2:-6I-(*-%!
!" '$!'2!,),'$&)!4('%'$&'!
!" &(-%!2-!'F'.I.#5$!*'!2)%!4()6(-,-%!/@W!/<!J!/>!*'2!42-$!*'!%'6I(#*-*!
Impacto acumulado
!
Riesgo acumulado
!
"-6'(#&!:'(%#5$!<! ! 3-%)!4(8.&#.)!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!@A>!?*'!@ABC!
Impacto repercutido
!
Riesgo repercutido
!
"-6'(#&!:'(%#5$!<! ! 3-%)!4(8.&#.)!
=!"#$#%&'(#)!*'!+*,#$#%&(-.#)$'%!/012#.-%! ! 486#$-!@AB!?*'!@ABC!
7.3.4. Calificación según los Criterios de Seguridad del CSAE
T)%!j3(#&'(#)%!*'!]'6I(#*-*W!7)(,-2#Q-.#5$!J!3)$%'(:-.#5$!*'!2-%!+42#.-.#)$'%!9#Q-*-%!4-(-!'2!LF'(.#.#)!*'!/)&'%&-*'%k!4()4)(.#)$-$!'$!%I!2#1()!*'!j3(#&'(#)%!*'!]'6I(#*-*k!I$-!2-(6-!('2-.#5$!*'!%-2:-6I-(*-%! UI'!*'1'$! #,42-$&-(%'! '$! 2)%! %#%&',-%D! T-! %#6I#'$&'!6(8O#.-!,I'%&(-!'2! 6(-*)!*'!%-&#%O-..#5$!*'!*#.V)%!.(#&'(#)%!-!2)!2-(6)!*'2!*'%-(()22)!*'2!42-$!*'!%'6I(#*-*[!
!
7.3.5. Calificación según la norma ISO/IEC 17799:2005
T-!$)(,-!H]EdHL3!@KKPP[<SSAW!j3)*'!)O!4(-.&#.'!O)(! #$O)(,-&#)$!%'.I(#&J!,-$-6','$&kKKW!*'O#$'!I$-!%'(#'!*'!.)$&()2'%!('.),'$*-12'%!4-(-!%#%&',-%!*'!6'%$!*'!2-!%'6I(#*-*!*'!2-!#$O)(,-.#5$!?]^]HCD!T-!%#6I#'$&'!6(8O#.-!,I'%&(-!'2!6(-*)!*'!%-&#%O-..#5$!*'!*#.V)%!.(#&'(#)%!-!2)!2-(6)!*'2!*'g%-(()22)!*'2!42-$!*'!%'6I(#*-*[!
!
!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
KK!3I-$*)!%'!'*#&-!'%&'!*).I,'$&)W!$)!'M#%&'!I$-!&(-*I..#5$!)O#.#-2!*'!2-!$)(,-h!'2!&'M&)!*'!2)%!'4R6(-O'%!4I'*'!%'(!*#O'('$&'!.I-$*)!%'!4I12#UI'!2-!&(-*I..#5$!)O#.#-2D!
