<![CDATA[Regional water companies have increasingly adopted information technology to support their operations. However, the absence of formalized information security risk management procedures can lead to substantial operational disruptions and financial losses. Therefore, this study aims to conduct a systematic risk assessment of a regional water company based on its IT assets, utilizing the ISO/IEC 27005:2022 standard. Data collection through semi-structured interviews and questionnaires with the company's IT department identified 31 assets, which were subsequently used for risk mapping and assessment. The assessment identified a total of 265 risk scenarios, categorized into 10 High (3.77%), 68 Medium (25.66%), and 187 Low (70.57%) level risks. Following the evaluation where all risks were deemed unacceptable, risk modification was recommended as treatment for all risk scenarios. Based on the results of the risk assessment, control recommendations were developed according to ISO/IEC 27001:2022 to assist the company in managing and mitigating risks. The implementation of the two ISO standards aligns to comprehensively map risks and provide a structured mitigation plan. These results are expected to assist the company in establishing formal risk management procedures and maintain business process continuity and effectiveness.]]>
Copyrights © 2026
