Framework for Security Risk Assessment (FSRA) and Fuzzy Risk Inference System (FRIS) based on Standard ISO/IEC 27002:2022

Information security is a critical aspect for organizations, and a problem in this regard consists ofknowing the level of vulnerability in which organizations. Therefore, this article aims to present a CybersecurityFramework (FSRA) based on the ISO/IEC 27002:2022 standard. In addition, a Fuzzy Risk Inference System(FRIS) is presented, which uses FSRA controls - Security Practices (SP), Software (S), and People (P) asinput, a total of 93 sub-items. A FRIS output is the Security Risk (SR) in which the organization is due tonon-compliance or partial compliance with FSRA controls. Thus, if each control is fully met, its entry value in theFRIS will be 100%. Otherwise, it will be proportional. Therefore, when the FRIS returns the SR, whose outputvalues can be Low (13% to 39.99%), Medium (40% to 59.99%), or High (60% to 100%), the security analyst canmeasure the risk security, in which the organization is located, according to ISO/IEC 27002:2022 and from thatknow where to act and how to act.