A Comparative Review of ISMS Implementation Based on ISO 27000 Series in Organizations of Different Business Sectors

Abstract

Organizations have different takes on Information Security Management Systems (ISMS) since security measurements vary according to their business relevance. One way to assure ISMS is being well-implemented is by having a standard compliance such as the ISO 27000 series. The ISO 27000 series is a family of standards that provides a framework for best practice ISMS that helps organizations keep their information assets secure. This paper intends to seek how organizations in different business sectors implement ISMS in their practices. By identifying which organization attains a higher number of ISO requirements, it is anticipated that the characteristics that increase the chances of an organization being certified can be distinguished. This paper reviews case studies regarding the ISMS implementation based on ISO 27000 series between organizations in different business sectors. The result of this paper presents the state of ISO compliance of the organizations. The findings also discussed the characteristics of organizations that are applicable for certification. Through the findings, it is found that the organization, which fulfilled the highest number of ISO requirement, has a stronger possibility of being certified. However, ISO standards should be more dynamic to support diverse business environment thus avoiding generalization to get compliance.