Integrated Strategy For Information System Security Assessment Through The Implementation Of ISO 27001 Standards

Abstract

Information security has become a critical organizational requirement in the era of digital transformation, as the increasing use of information systems exposes organizations to complex and evolving cyber threats. Information security can no longer be treated solely as a technical issue but must be managed through a structured management framework. This study aims to analyze and synthesize previous research related to the implementation of ISO/IEC 27001 as an international standard for Information Security Management Systems (ISMS). This research adopts a qualitative literature review approach by examining scientific articles, standards documents, and relevant publications related to ISO/IEC 27001, risk management, and information security governance. The analysis focuses on key themes, including risk-based security management, governance structures, continuous improvement using the Plan–Do–Check–Act (PDCA) cycle, and organizational readiness. The results indicate that ISO/IEC 27001 provides a comprehensive framework for strengthening information security governance, improving risk management practices, and enhancing organizational resilience against cyber threats. Furthermore, successful implementation is strongly influenced by leadership commitment, employee awareness, and continuous monitoring mechanisms. This study contributes by providing an integrated understanding of ISO/IEC 27001 implementation from prior studies and offers practical insights for organizations seeking to enhance their information security management practices.