Iso 27001 information security management system: An analysis on access control policy

Information security is one of the concepts that gain importance with technological innovations in the globalizing world. It can be defined as the application of an access management system to prevent the removal of explicit or confidential information and documents owned by institutions and organizations and to prevent unauthorized or unsanctioned attempts. The demands of institutions and organizations to ISO 27001 Information Security Management System (ISMS) providing a framework for the management of these processes have increased and continue to increase. Additionally, it has importance to what extent effectively the companies that have an ISO 27001 ISMS certificate operate the implementation processes stemming from having this document. Many studies have indicated that in the events of information security in companies, company employees may pave the way for the threats to information security of the company, and as a result, they may make their company confront with many material and moral damages. This situation shows how important the access control policies of companies for information systems are. In this context, the existing study aims to examine the importance level of the access control protocol which is within the scope of ISO 27001 ISMS, which has international validity within the ISMS standards, and the effects of that on providing the information security of companies. 343 employees from different sectors (education, finance, etc.) and levels (senior manager, mid-level manager, etc.) participated in the questionnaire which was prepared with a 5-point Likert scale. By examining the access security levels of companies with and without ISO 27001 ISMS, comparisons were made with statistical analysis on the data obtained, and it was seen that the risks of information security of the access control policies of the companies that have ISMS certificate were minimized.