Abstract:
Information security has become a critical concern for organizations worldwide, and ISO/IEC 27001:2022 provides a recognized framework for managing information security risks, improving governance, and enhancing stakeholder trust. Despite these benefits, many organizations delay or avoid implementing the standard due to high costs, complex documentation, limited internal expertise, and time constraints. This study investigates the challenges in ISO/IEC 27001 implementation and evaluates the role of a smart, AI-driven predictive ToolKit, which consists of semi-automated documentation and an intelligent ISO 27001 checklist, in supporting effective, efficient, and sustainable compliance. A quantitative research approach was adopted using a cross-sectional survey design. Data were collected from information security professionals and analyzed using Partial Least Squares Structural Equation Modeling (PLS-SEM) in SmartPLS 4. The study examined the relationships between perceived benefits of ISO/IEC 27001, implementation difficulty, organizational avoidance behavior, and the effectiveness of the AI-enabled predictive ToolKit. The findings reveal that while organizations recognize the strategic and operational benefits of ISO/IEC 27001, perceived implementation difficulty remains a major barrier, leading to avoidance behavior. The results further show that the AI-driven predictive ToolKit reduces this difficulty by simplifying documentation, providing clear guidance, and offering a dynamic, intelligent ISO 27001 checklist to monitor compliance. Implementation difficulty and ToolKit effectiveness were found to mediate the relationship between perceived benefits and actual adoption of ISO/IEC 27001. Overall, this research demonstrates that AI-enabled predictive ToolKits, integrating documentation and intelligent checklists, can transform ISO/IEC 27001 implementation from a complex, manual process into a guided, manageable, and sustainable practice. The study provides practical recommendations for organizations, practitioners, and ToolKit developers, contributing to both academic knowledge and real-world governance, risk, and compliance practices.
