Operationalising Information Security Management: A Procedural Framework Analysis of ISO/IEC 27001:2022 Implementation in a Financial-Technology Organisation

Technical Summary: Operationalising ISMS: A Procedural Framework Analysis of ISO 27001:2022

1. Problem Statement

As organizations transition to information-intensive, cloud-based, and remote-working models, the attack surface for digital assets has expanded significantly. While the ISO/IEC 27001:2022 standard provides a high-level framework for Information Security Management Systems (ISMS), a critical gap exists between high-level policy intent and day-to-day operational execution. Empirical evidence suggests that procedural ambiguity and role confusion are primary drivers of nonconformities during third-party audits. In the high-stakes Financial Technology (FinTech) sector, the lack of granular, actionable procedures can lead to catastrophic failures in data confidentiality, integrity, and availability (the CIA Triad).

2. Methodology

The paper employs a procedural framework analysis based on the documented internal governance of a FinTech organization. The study focuses on the Level-2 (Operational Procedures) layer of a four-tier document hierarchy. The methodology involves:

• Comparative Mapping: Aligning specific organizational procedures with the restructured Annex A controls and Clauses 6–10 of the ISO 27001:2022 standard.
• Structural Analysis: Evaluating eight core operational procedures (Risk Assessment, User Conduct, Password Policy, Access Control, Internet Access, Physical Security, Backup/Restore, and Corrective Action).
• Evaluation Framework: Using the CIA Triad as a unifying metric to assess the effectiveness of each procedure.
• Risk Modeling Analysis: Examining a hybrid quantitative-qualitative twelve-step risk assessment methodology that utilizes a five-point ordinal scale for impact and likelihood.

3. Key Contributions

The paper provides a blueprint for translating abstract security standards into a functional operational architecture. Key contributions include:

• A Twelve-Step Risk Assessment Workflow: A structured process ranging from cross-functional team formation and asset valuation (categorized by People, Procedure, Data, Software, Hardware, and Networking) to the calculation of residual risk and formal management approval.
• A Multi-Layered Procedural Hierarchy: Demonstrating how a tiered documentation structure (Level 0–3) ensures audit traceability and clear accountability.
• Integrated Governance Models: Detailing how the Chief Information Security Officer (CISO) acts as a central coordination authority across disparate departments (IT Ops, Risk Management, and Audit).
• Robust Backup and Recovery Governance: Defining specific Recovery Point Objectives (RPO) and Recovery Time Objectives (RTO) of 48 hours, alongside a tiered media classification system (Red, Yellow, Green) and a formal disposal/destruction protocol.
• The PDCA Feedback Loop: A formal seven-step Nonconformity Root Cause Analysis (RCA) and Corrective Action process that mandates a risk assessment before implementing any remediation to prevent the introduction of new vulnerabilities.

4. Results and Findings

The analysis reveals that an effective ISMS is not merely a collection of documents but a tightly integrated, multi-layered hierarchy. The findings indicate:

• Coherence through the CIA Triad: When procedures are anchored to Confidentiality, Integrity, and Availability, they create a unified security posture where technical, physical, and human-centric controls reinforce one another.
• Risk-Based Decision Making: The use of a numerical risk score (1–100) allows for automated management responses (e.g., "Immediate Action" for scores >80 vs. "Risk Appetite" for scores <19), ensuring resources are allocated proportionally to threat levels.
• Human Factor Mitigation: By embedding "User Codes of Conduct" and "Social Engineering Awareness" into formal procedures, the framework addresses the human element, which is often the weakest link in FinTech security.
• Systemic Improvement: The integration of corrective actions with the Change Management process ensures that security improvements are institutionalized rather than treated as isolated incidents.

5. Significance

This research is highly significant for practitioners in the FinTech and highly regulated sectors. It moves the conversation from "compliance as a checkbox" to "compliance as an operational reality." By providing a granular look at how to operationalize the 2022 revision of ISO 27001, the paper offers a scalable model for reducing audit nonconformities, managing complex digital risks, and ensuring business continuity in the face of evolving cyber threats. It highlights that the maturity of an ISMS is determined by the interoperability of its procedures and the clarity of its accountability structures.