Operationalising Information Security Management: A Procedural Framework Analysis of ISO/IEC 27001:2022 Implementation in a Financial-Technology Organisation

• URL: http://arxiv.org/abs/2604.23230v1
• Date: Sat, 25 Apr 2026 09:46:04 GMT
• Title: Operationalising Information Security Management: A Procedural Framework Analysis of ISO/IEC 27001:2022 Implementation in a Financial-Technology Organisation
• Abstract summary: This article analyses the procedural architecture deployed in a financial-technology organisation's Information Security Management System.<n>It examines eight core operational procedures: IT Risk Assessment and Treatment, User Code of Conduct, Password Policy, Access Control, Internet Access, Physical Security, Backup and Restore Management, and Nonconformity Analysis and Corrective Action.<n>The findings suggest that a tightly integrated, multi-layered procedural hierarchy, supported by clear accountability structures and measurable risk metrics, constitutes the foundation of an effective ISMS implementation.
• Score: 0.0
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Organisations operating within information-intensive environments face intensifying pressure to formalise the governance of information security. The ISO/IEC 27001:2022 standard provides a globally recognised framework for establishing, implementing, maintaining, and continually improving an Information Security Management System (ISMS). This article analyses the procedural architecture deployed in a financial-technology organisation's ISMS, examining eight core operational procedures: IT Risk Assessment and Treatment, User Code of Conduct, Password Policy, Access Control, Internet Access, Physical Security, Backup and Restore Management, and Nonconformity Root Cause Analysis and Corrective Action. Drawing on documented internal training materials, the article investigates how each procedure operationalises the requirements of Annex~A controls and Clauses~6--10 of ISO~27001:2022. The paper evaluates the CIA Triad as a unifying evaluation criterion, the twelve-step risk assessment methodology, role-based responsibility allocation, and the interplay between corrective action governance and continual improvement. The findings suggest that a tightly integrated, multi-layered procedural hierarchy, supported by clear accountability structures and measurable risk metrics, constitutes the foundation of an effective ISMS implementation in financial-technology operating environments.

Related papers

• Agentic AI for Safety-critical Multi-drone Systems: Challenges and Opportunities [38.499036085412094]
  Multi-drone systems are increasingly positioned for safety-critical missions such as search and rescue (SAR) and critical infrastructure monitoring.<n>Yet, real-world adoption remains constrained not only by autonomy performance, but by the difficulty of integrating agentic behavior into professional work.<n>This position paper synthesizes the ambitions and lessons from two ongoing efforts: NAMUR and PERSIST.
  arXiv  Detail & Related papers  (2026-08-19T11:53:02Z)
• AI Assurance in UK Defence: Challenges in Operationalising JSP 936 [0.0]
  This report examines practical challenges in operationalising 936 Part 1 for AI assurance in UK Defence.<n>The report argues that 936 provides a useful governance basis, but that implementation depends on unresolved technical, organisational, and assurance questions.<n>The report identifies areas where further methods, guidance, and organisational capability are needed for the ambitious, safe, and responsible adoption of AI across Defence.
  arXiv  Detail & Related papers  (2026-06-08T12:28:55Z)
• SeClaw: Spec-Driven Security Task Synthesis for Evaluating Autonomous Agents [87.26967184869198]
  SeClaw is a framework that combines specification-driven security task synthesis with execution-based security evaluation for Autonomous agents.<n> benchmark covers risks arising from resources, user tasks, environments, and intrinsic agent behaviors.
  arXiv  Detail & Related papers  (2026-06-01T14:23:42Z)
• Towards trustworthy agentic AI: a comprehensive survey of safety, robustness, privacy, and system security [57.35851886874902]
  Agentic AI systems execute complex tasks autonomously, but their multi-step trajectories introduce new failure modes that challenge trustworthiness.<n>This survey provides a focused examination of trustworthy agentic AI through two core dimensions that are critical for high-risk deployments.<n>For each dimension, we clarify key concepts, identify where risks emerge along the agent workflow, and summarize stage-targeted mitigation strategies.
  arXiv  Detail & Related papers  (2026-05-17T10:26:37Z)
• An Automated Framework for Cybersecurity Policy Compliance Assessment Against Security Control Standards [0.25489046505746704]
  PROPARAG is an audit support approach for evaluating organizational cybersecurity policies against security controls autonomously.<n>For each control, the approach retrieves relevant policy evidence, assesses coverage, identifies missing elements, and generates supporting explanations and recommendations.
  arXiv  Detail & Related papers  (2026-05-08T09:45:25Z)
• AI Agents Under EU Law [31.882541856960888]
  We present a practical taxonomy of nine agent deployment categories mapping concrete actions to regulatory triggers.<n>We propose a twelve-step compliance architecture and a regulatory trigger mapping connecting agent actions to applicable legislation.<n>We conclude that high-risk agentic systems with untraceable behavioral drift cannot currently satisfy the AI Act's essential requirements.
  arXiv  Detail & Related papers  (2026-04-06T11:47:38Z)
• How frontier AI companies could implement an internal audit function [0.0]
  Internal audit could play a central role in strengthening safety governance.<n>This paper examines how an internal audit function could be designed to provide meaningful assurance for frontier AI developers.
  arXiv  Detail & Related papers  (2025-12-16T20:36:58Z)
• SafeEvalAgent: Toward Agentic and Self-Evolving Safety Evaluation of LLMs [37.82193156438782]
  This paper introduces a new paradigm of agentic safety evaluation, reframing evaluation as a continuous and self-evolving process.<n>We propose a novel multi-agent framework SafeEvalAgent, which autonomously ingests unstructured policy documents to generate and perpetually evolve a comprehensive safety benchmark.<n>Our experiments demonstrate the effectiveness of SafeEvalAgent, showing a consistent decline in model safety as the evaluation hardens.
  arXiv  Detail & Related papers  (2025-09-30T11:20:41Z)
• Safe and Certifiable AI Systems: Concepts, Challenges, and Lessons Learned [45.44933002008943]
  This white paper presents the T"UV AUSTRIA Trusted AI framework.<n>It is an end-to-end audit catalog and methodology for assessing and certifying machine learning systems.<n>Building on three pillars - Secure Software Development, Functional Requirements, and Ethics & Data Privacy - it translates the high-level obligations of the EU AI Act into specific, testable criteria.
  arXiv  Detail & Related papers  (2025-09-08T17:52:08Z)
• CISAF: A Framework for Estimating the Security Posture of Academic and Research Cyberinfrastructure [2.485322084016379]
  Cyber Infrastructure Security Analysis Framework (CISAF) is a simple, systematic, mission-centric approach to analyze the security posture of a CI.<n>CISAF guides administrators through a top-down process: (1) defining unacceptable losses, (2) identifying associated system hazards and critical assets, (3) analyzing possible attack paths that target these critical assets, and (4) analyzing security mechanisms that lie on these attack paths.
  arXiv  Detail & Related papers  (2025-08-29T22:32:20Z)
• Bridging the Mobile Trust Gap: A Zero Trust Framework for Consumer-Facing Applications [51.56484100374058]
  This paper proposes an extended Zero Trust model designed for mobile applications operating in untrusted, user-controlled environments.<n>Using a design science methodology, the study introduced a six-pillar framework that supports runtime enforcement of trust.<n>The proposed model offers a practical and standards-aligned approach to securing mobile applications beyond pre-deployment controls.
  arXiv  Detail & Related papers  (2025-08-20T18:42:36Z)
• Control Tax: The Price of Keeping AI in Check [22.94651464417764]
  We introduce the notion of Control tax -- the operational and financial cost of integrating control measures into AI pipelines.<n>We conduct comprehensive evaluations of state-of-the-art language models in adversarial settings.<n>We provide empirical financial cost estimates for control protocols and develop optimized monitoring strategies.
  arXiv  Detail & Related papers  (2025-06-05T17:48:39Z)
• AssessITS: Integrating procedural guidelines and practical evaluation metrics for organizational IT and Cybersecurity risk assessment [0.0]
  'AssessITS' aims to enable organizations to enhance their IT security strength actionable based on internationally recognized standards. 'AssessITS' aims to enable organizations to enhance their IT security strength actionable based on internationally recognized standards.
  arXiv  Detail & Related papers  (2024-10-02T17:01:59Z)
• Layered Security Guidance for Data Asset Management in Additive Manufacturing [0.0]
  This paper proposes leveraging the National Institute of Standards and Technology's Cybersecurity Framework to develop layered, risk-based guidance for fulfilling specific security outcomes. The authors believe implementation of the layered approach would result in value-added, non-redundant security guidance for AM that is consistent with the preexisting guidance.
  arXiv  Detail & Related papers  (2023-09-28T20:48:40Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.