Assessing Information Security Risk Exposure During the Transition from ISO/IEC 27001:2013 to ISO/IEC 27001:2022 in a Banking Institution
Year: 2026
Type: article
Abstract: The transition from ISO/IEC 27001:2013 to ISO/IEC 27001:2022 is often approached as a certification and documentation update. However, for banking institutions with critical digital operations, the transition may create a distinct form of information security exposure when existing controls, evidence, ownership, and risk treatment decisions are not fully aligned with the revised control structure. This study examines transitional risk exposure in Bank XYZ, a banking institution with an established ISO/IEC 27001:2013-based Information Security Management System (ISMS). Using a qualitative single-case study design, the research analyzes ISMS documents, 96 information security risk records, Statement of Applicability records, control implementation evidence, ISO/IEC 27001:2013-to-ISO/IEC 27001:2022 control mapping materials, and stakeholder validation within the scope of core banking development and operations in data center and disaster recovery center environments. Risk exposure was assessed by comparing inherent and residual risks using a likelihood-impact matrix, while transition readiness was evaluated through control applicability, evidence adequacy, ownership clarity, supplier dependency, human factor readiness, and transition governance. The findings show that Bank XYZ implemented or provided evidence for 109 of 114 ISO/IEC 27001:2013 controls and reduced 96 inherent risks, consisting of 38 Moderate and 58 Moderate-to-High risks, into 13 Low and 83 Low-to-Moderate residual risks. Nevertheless, the transition review revealed that a mature residual risk position under ISO/IEC 27001:2013 does not automatically indicate readiness for ISO/IEC 27001:2022. Of 11 newly introduced controls, 2 were implemented, 4 were partially implemented, 4 were not implemented, and 1 was not applicable. The most significant transition gaps were found in threat intelligence, information deletion, data masking, and data leakage prevention. The study contributes by distinguishing transitional risk exposure from residual risk and by offering a control-level basis for prioritizing ISO/IEC 27001:2022 transition activities in banking institutions.
Source: Information
DOI: 10.3390/info17070692
Authors: Noviati Nurani, Nilo Legowo
Institution: Binus University
Language: English
Subfield: Information Systems
Field: Computer Science
Domain: Physical Sciences
Open Access status: gold
Estimated APC paid: $1,930
OpenAlex ID: W7168582115