Information Security Risk Assessment Measures of Facility Management in Transport Industry - Ramli, Abdul Halid; Maarop, Nurazean; Zulkifli, Muhammad Syahreen; Samy, Ganthan Narayana; Hassan, Noor Hafizah; Mohammad, Roslina (Malaysian Journal of Information and Communication Technology (MyJICT), 2024)
The objective of this study is to identify the necessary information security measures for facility management (FM) firms in the transportation industry to control risks. This study was founded on the three phases of the OCTAVE framework, the Information Security Risk Assessment checklist, the nine stages of NIST SP800-30 2012, and ISO 27005:2011 on Information System Risk Management. This study finalized eight significant risk management measures for FM enterprises based on a descriptive analysis of sixty questionnaires containing responses from key respondents employed by FM companies in Malaysia. Beforehand, the information security experts reviewed and validated the appropriateness of the following measures for managing risks in this study context: system characteristics; threat identification; vulnerability identification; control analysis; likelihood determination; impact analysis; risk determination; and recommendation for controls. Consequently, the result of this study reveals the outcomes of descriptive analysis comprising mean and standard deviation for the information system security measures for risk management of the respective transport company. Lastly, our research could be advantageous to FM companies, particularly those in the transportation industry, by providing standardized measures for managing information security risk.