<![CDATA[Information Security Management System is an important aspect for cybersecurity companies in maintaining the confidentiality, integrity, and availability of information. This study evaluates the implementation of ISO 27001:2022 Annex A controls in the Compliance and IT Security divisions of a cybersecurity company using the Gap Analysis method. The evaluation covered 12 controls clusters, including security policies, compliance audits, access management, incident handling, and third party management through observation, semi structured interviews, and document analysis. Assessment results showed an actual score of 33 out of 48, indicating a compliance level of 68.75% categorized as compliant. Technical controls had generally been implemented well. However, gaps remained in compliance audits, third party management, security documentation, and employee security awareness. Recommendations include documentation standardization, stronger compliance monitoring, periodic evaluations, and formal incident handling procedures to improve ISMS implementation continuously.Keywords: ISO 27001:2022; Annex A; Gap Analysis; Compliance; Information Security. AbstrakSistem Manajemen Keamanan Informasi menjadi aspek penting bagi perusahaan keamanan siber dalam menjaga kerahasiaan, integritas, dan ketersediaan informasi. Penelitian ini mengevaluasi implementasi kontrol ISO 27001:2022 Annex A pada divisi Compliance dan IT Security menggunakan metode Gap Analysis. Evaluasi dilakukan terhadap 12 cluster kontrol keamanan informasi melalui observasi, wawancara semi terstruktur, dan analisis dokumen perusahaan. Hasil penilaian menunjukkan skor aktual sebesar 33 dari skor maksimal 48 dengan tingkat kepatuhan 68,75% yang termasuk kategori patuh. Implementasi kontrol pada aspek teknis telah berjalan cukup baik, namun masih ditemukan kesenjangan pada audit kepatuhan, pengelolaan pihak ketiga, dokumentasi keamanan informasi, dan kesadaran keamanan SDM. Rekomendasi yang diusulkan meliputi standarisasi dokumentasi, penguatan pemantauan kepatuhan, evaluasi berkala, dan penyusunan prosedur formal penanganan insiden guna meningkatkan implementasi SMKI secara berkelanjutan. ]]>
