Evaluation Of Information Security Controls Using ISO/IEC 27001:2022 In Government Data Centers

Abstract

Information security has become a strategic concern for government institutions amid growing dependence on digital infrastructure and increasing cyber threats to critical information assets. This study evaluates the implementation status of information security controls at the Garut Government Data Center against all 93 Annex A controls of ISO/IEC 27001:2022; control applicability under the organization risk context and Statement of Applicability was not independently verified, noted as a scope limitation. A descriptive evaluation was conducted using observation, discussions with responsible personnel, documentation review, and a checklist developed from Annex A. Each control was classified as Fully Implemented, Partially Implemented, or Planned based on operational practice and formal documentation: Fully Implemented required both practice and documentation (written policy, assigned responsibility, periodic review); Partially Implemented indicated practice without complete documentation; Planned indicated the control had not yet been carried out. Classification was performed by a single assessor triangulating documentation, discussions, and observation, without independent inter-assessor verification. Results show that only 16 controls (17.2%) were fully implemented, 74 (79.6%) partially implemented, and 3 (3.2%) still planned, with the largest gaps in the Organizational and Technological Controls themes, indicating that governance practices, policy implementation, and technical mechanisms require significant improvement. Priority recommendations were developed to support continual ISMS improvement through risk-based implementation planning. This study presents a control-implementation evaluation rather than a comprehensive ISMS maturity or certification-readiness assessment, demonstrating that Annex A control-status evaluation provides a structured basis for identifying implementation gaps and prioritizing improvement actions in government data center environments.