Risk Assessment at it Company by Focusing on Information Security Area Using Iso 27001:2022

Modern technology companies should prioritize information security by focusing on system vulnerabilities and adopting a risk management approach based on the ISO/IEC 27001:2022 standard. This method needs to be implemented through several stages of risk assessment to ensure and measure the extent to which the organization effectively addresses information security issues. The assessment approach involves the three stages of identifying, analyzing and evaluating risks and mapping them to the controls specified in ISO/IEC 27001:2022. The implementation shows that the IT risk assessment of the company has a percentage of 86.87% as low risk, 6.06% as medium risk, and 7.07% as High risk. IT Software companies can be considered safe because most risk assessment findings are low, which means they are in the safe category. In practice, regular monitoring of the implementation of risk assessments in line with the ISO/IEC 27001:2022 standard is still very much needed.