Design Information Security in Electronic-Based Government Systems Using NIST CSF 2.0, ISO/IEC 27001: 2022 and CIS Control

This study explores the application of three cybersecurity frameworks: NIST CSF 2.0, ISO/IEC 27001:2022, and CIS Control v8, resulting in the synthesis of 22 key components: Organizational context, Risk management processes, Assignment of security roles, Security policy implementation, Governance, monitoring, Third-party risk management, Inventory and management of assets, Risk identification and analysis, Continuous improvement, Access control, account management, Security awareness and training, Data protection, encryption, Configuration and maintenance management, Network and software security, Continuous monitoring, anomaly detection, Incident detection and analysis, Incident response planning, Incident analysis and prioritization, Incident response communication, and Incident mitigation. These syntheses serve as recommendations and information security controls applicable to government agencies. The frameworks provide guidance for developing information security measures, preparing necessary documents, and implementing technical steps to enhance information security.