Information Security Maturity Model for Integrated Irrigation and Drainage Management Systems

Abstract

In a global context of increasing digitalization, the protection of personal data and the secure management of information have become fundamental pillars to ensure public trust, institutional transparency, and regulatory compliance. In Ecuador, the implementation of the Organic Law on Personal Data Protection (LOPDP, 2021) still faces limitations in its practical application, particularly within Decentralized Autonomous Governments (GADs), where information systems lack comprehensive information security management frameworks. In response to this issue, the present research aimed to design a maturity model applied to information security management for the Integrated Irrigation and Drainage Management System of the Provincial GAD of El Oro, aligned with the LOPDP, ISO/IEC 27001:2022, and the Governmental Information Security Scheme (EGSI), version 3. The study integrated the Capability Maturity Model Integration (CMMI) framework and adopted a cross-sectional research design, allowing for the analysis of a geographically and systematically delimited sample of 12 participants over a defined period. A mixed-methods approach was employed using three instruments: first, a checklist based on the ISO/IEC 27001:2022 controls; second, a survey administered to technical and administrative personnel; and third, interviews conducted with professionals according to their profiles. The results revealed a low level of compliance and awareness of the LOPDP (corresponding to levels 1 and 2 of the CMMI reference model), characterized by an incipient initial stage in the implementation of an EGSI, a lack of methodological documentation, and a scarcity of institutional policies that comprehensively govern information security. Additionally, there was an absence of institutional training and awareness programs, as well as deficiencies in access control, risk management, incident response, and staff training. These findings reflect a limited articulation among the LOPDP, EGSI v3, CMMI, and internal institutional processes. In this regard, the study identifies key weaknesses within the irrigation system and highlights the institution’s recent adoption of the LOPDP framework. The proposed model is intended to serve as a strategic tool to enhance information security management within the institution, addressing technical, legal, and administrative aspects that promote data confidentiality, integrity, and availability. Moreover, it provides a methodological contribution that can be replicated in other institutional information systems. Finally, it opens avenues for future research aimed at assessing the maturity levels of information systems, promoting alternatives for EGSI implementation across GADs, and fostering the development of studies or audits related to public cybersecurity management.