Analysis of Information Security Management System Implementation at BSN

Abstrak

SNI ISO/IEC 27001:2013, adopted by the National Standardization Agency of Indonesia (BSN), is a national standard derived from the international ISO/IEC 27001 published by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC). This study evaluates the effectiveness of BSN's Information Security Management System (ISMS) implementation, focusing on compliance with international standards, risk management strategies, and organizational commitment to safeguarding information. Employing qualitative descriptive methods, data were collected through interviews, document analysis, and observations. The findings highlight the critical roles of leadership commitment, comprehensive risk assessments, and regular system evaluations in achieving ISMS objectives. Despite significant achievements, including obtaining Integrated Management System certification in 2023, challenges persist in optimizing resources and adapting to emerging security threats. Recommendations include enhancing staff capabilities, investing in advanced technologies, and transitioning to the updated SNI ISO/IEC 27001:2022 standard. This study reinforces the importance of ISMS in protecting sensitive information, fostering trust, and aligning with global best practices.