Risk Management Framework for ISP Network Operations Based on ISO 27005:2022 and FMEA

Abstract

This study designs information security risk management for network operations and monitoring at PT RNet Mitra Sentosa using ISO/IEC 27005:2022 and FMEA. Asset identification was conducted across five categories (hardware, software, data & information, network & infrastructure, and human resources), with each risk assessed for its impact on the CIA triad and analyzed using Severity, Occurrence, and Detection parameters to generate Risk Priority Number (RPN). The findings identified 185 risk scenarios, with 11 priority risks (RPN ≥ 120) requiring immediate treatment. The two highest risks (RPN 210) relate to IT asset inventory inaccuracies and unauthorized access to inventory data, dominated by the Data & Information category. Treatment recommendations emphasize mitigation through asset management, access control, preventive maintenance, and security awareness, along with risk transfer for DDoS and traffic overload.