Information Security Management System (ISMS) at BPJS Kesehatan Tondano: Implementation of ISO 27001:2022 Standard

Information security is crucial for organizations managing sensitive data in the digital era. This is especially true for institutions like the Social Security Administrative Body for Health (BPJS Kesehatan), which organizes social health security for the Indonesian people and handles various important information, including participant, medical, and financial data. However, as threats to information security increase, organizations need to implement an effective information security management system. This research examines the implementation of the Information Security Management System (ISMS) based on the ISO 27001:2022 standard at the Tondano BPJS Kesehatan Branch Office. The methodology of the research is descriptive qualitative. The research results indicate that implementing the ISMS has improved overall data security. This is achieved through regular data backups and storing servers in locked rooms. In addition, implementing the ISO 27001:2022 standard reduces information security risks by providing clear guidance on data security management, including antivirus updates, access restrictions, and password management. The main challenges in implementing the ISMS are limited IT infrastructure resources and employee resistance to changes in IT security procedures. Despite these challenges, implementing the ISO 27001:2022 standard at the Tondano BPJS Kesehatan Branch Office has improved information security and strengthened the trust of customers and business partners