A Comprehensive Case Study Rekomendasi Implementasi 11 Kontrol keamanan informasi baru ISO 27001:2022 di Perusahaan HealthTech XYZ: Studi Kasus Komprehensif tentang Meningkatkan Kepatuhan dan Keamanan Siber di HealthTech Company

Suryo Wibowo, Bimantoro
Rizal Fathoni Aji

The Indonesian Journal of Computer Science
Vol. 13 No. 4 (2024): The Indonesian Journal of Computer Science (IJCS)

This study aims to recommend the implementation of new annex controls in ISO 27001:2022, guided by ISO 27002:2022, for PT XYZ. The research questions addressed are: (1) What are the existing gaps between PT XYZ's current information security controls and the requirements of ISO 27001:2022? (2) What specific recommendations can close these gaps? Using a qualitative case study approach, data were collected in May 2024 through purposive sampling, interviews, observations, and document analysis. Findings reveal that while some controls are partially implemented, others lack full documentation and SOPs. Detailed recommendations were provided to ensure compliance with updated standards, emphasizing formalization into SOPs. This study offers practical guidance for organizations transitioning to ISO 27001:2022, enhancing cybersecurity readiness and compliance with stringent data protection regulations.