<![CDATA[Abstract : Information security threats originating from human factors, such as phishing and user error, remain the dominant cause of security incidents even when organizations have implemented adequate technical controls. PT Pertamina Hulu Rokan Zone 1, a state-owned energy enterprise, has implemented ISO/IEC 27001:2022, yet the effectiveness of the standard is also determined by employees' information security awareness. This study aims to measure employee security awareness through a human-centric approach using the Human Aspects of Information Security Questionnaire (HAIS-Q) and to map the measurement results onto the Annex A controls of ISO/IEC 27001:2022. A modified HAIS-Q questionnaire consisting of 63 items across seven domains was distributed to 134 respondents using a total sampling technique. Data were analyzed using Pearson Product Moment validity testing, Cronbach's Alpha reliability testing, and descriptive analysis of mean scores per domain and per Knowledge-Attitude-Behavior (KAB) dimension. The results show that 61 of 63 items were valid and reliable (Cronbach's Alpha 0.663-0.807). The overall security awareness score falls into the good category (mean 4.110; 82.2%). The Mobile Device Usage and Password Management domains show the highest readiness against Annex A controls, while the Social Media Usage and Information Handling domains show the lowest human-factor readiness and require further strengthening. The mapping results confirm that the effectiveness of ISO/IEC 27001:2022 implementation depends not only on technical controls but also on the readiness of human behavior.]]>
Copyrights © 2026
