1. آذر، عادل و مؤمنی، منصور. (1384). آمار و کاربرد آن در مدیریت. تهران: سازمان مطالعه و تدوین کتب علوم انسانی دانشگاه‌ها.
2. آزادبیگی، نورالله. (۱۳۹۸). ارائه راهکارهای بومی و عملیاتی جهت رفع آسیب‌پذیری و تهدیدات امنیتی شبکه‌های کامپیوتری سازمانی در چارچوب استانداردهای ISO/IEC 27K (پایان‌نامه کارشناسی‌ارشد رشته کامپیوتر، گرایش نرم‌افزار). مؤسسه آموزش عالی اشراق بجنورد.
3. آفتابی، نوید. (۱۳۹۷). یک مدل مدیریت امنیت اطلاعات برای کاهش ریسک‌های احتمالی در سازمان‌های مبتنی بر فناوری اطلاعات (پایان‌نامه کارشناسی‌ارشد گرایش سیستم‌های اقتصادی و اجتماعی). دانشکده مهندسی صنایع، دانشگاه شریف.
4. اخوان، فاطمه، موسوی، سید عبداله امین و سرآبادانی، ابوالقاسم. (۱۴۰۲). عوامل کلیدی موفقیت در پیاده‌سازی حاکمیت امنیت اطلاعات (مطالعۀ موردی: شرکت نفت مناطق مرکزی ایران). مطالعات راهبردی در صنعت نفت و انرژی، ۱۴ (۵۶)، ۱۳۲-۱۱۳.
5. جعفرنژاد، سهیلا و تقوا، محمدرضا. (۱۳۹۸). نقش پیاده‌سازی چارچوب‌های مدیریت خدمات و امنیت (ITIL و ISMS) در تداوم خدمات فناوری اطلاعات. نشریه علمی مطالعات مدیریت کسب و کار هوشمند، ۷ (۳۰)، 33-54.
6. شاه‌بهرامی، اسدالله، رفیع‌زاده کاسانی، رامین و پوریوسفی‌درگاه، حسین. (۱۳۹۷). شناسایی و اولویت‌بندی پارامترهای تأثیرگذار بر سیستم مدیریت امنیت اطلاعات (مطالعه موردی: شعب تأمین اجتماعی استان گیلان). فصلنامه علمی-پژوهشی فناوری اطلاعات و ارتباطات ایران، ۱۰ (۳۵ و ۳۶)، ۵۷-۷۴.
7. شیخ‌ابومسعودی، روح‌اله، کوهی‌حبیبی، سحر، عطایی، مریم و اسماعیلی، نازیلا. (۱۳۹۴). ارزیابی سیستم‌های مدیریت اطلاعات دانشگاه علوم پزشکی با استفاده از استاندارد ISO/IEC 27001. مدیریت اطلاعات سلامت، ۱۲ (۳)، ۳۰۶-۳۱۶.
8. فرهادی، کامران. (1396). آموزش جامع پیاده‌سازی و سرممیزی سیستم مدیریت امنیت اطلاعات. تهران: آکادمی باتیس.
9. میدانی، زهرا، عصاری، محمدامین، موسوی، سید غلامعباس و عطایی اندزق، علی. (۱۳۹۶). ارزیابی امنیت سیستم‌های اطلاعات بیمارستانی. مدیریت اطلاعات سلامت، ۵ (۱۴)، ۱۸۷-۱۹۳.

References

10. Aileen, A., & Fianty, M. I. (2024). Capability level assessments of information security controls: An empirical analysis of practitioners assessment capabilities. Journal of Information Security, 8(1), 91-103.
11. Atymtayeva, L. B., Bortsova, G. K., Inoue, A., & Kozhakhmet, K. T. (2012). Methodology and ontology of expert system for information security audit. In The 6th International Conference on Soft Computing and Intelligent Systems, and The 13th International Symposium on Advanced Intelligent Systems (pp. 238-243). IEEE.
12. Bartoš, J., Walek, B., Klimeš, C., & Farana, R. (2014). Fuzzy tool for conducting information security risk analysis. In Proceedings of the 2014 15th International Carpathian Control Conference (ICCC) (pp. 28-33).
13. Broderick, J. S. (2006). ISMS, security standards and security regulations. Information Security Technical Report, 11, 26–31.
14. Chang, L.-Y., & Lee, Z.-J. (2013). Applying fuzzy expert system to information security risk assessment: A case study on an attendance system. In 2013 International Conference on Fuzzy Theory and Its Applications (iFUZZY) (pp. 346-351).
15. Clinch, J. (2009). ITIL V3 and information security. Best Management Practice.
16. Culot, G., Nassimbeni, G., Podrecca, M., & Sartor, M. (2021). The ISO/IEC 27001 information security management standard: Literature review and theory-based research agenda. The TQM Journal, 33(7), 76-105.
17. Dor, D., & Elovici, Y. (2016). A model of the information security investment decision-making process. Computers & Security, 63, 1-13.
18. Farid, G., Warraich, N. F., & Iftikhar, S. (2023). Digital information security management policy in academic libraries: A systematic review (2010–2022). Journal of Information Science. https://doi.org/10.1177/01655515231160026
19. Fonseca-Herrera, O. A., Rojas, A. E., & Florez, H. (2021). A model of an information security management system based on NTC-ISO/IEC 27001 standard. IAENG International Journal of Computer Science, 48(2), 213-222.
20. Ganji, D., Kalloniatis, C., Mouratidis, H., & Malekshahi Gheytassi, S. (2019). Approaches to develop and implement ISO/IEC 27001 standard-information security management systems: A systematic literature review. International Journal on Advances in Software, 12(3).
21. Hentea, M. (2007). Intelligent system for information security management: Architecture and design issues. Informing Science: International Journal of an Emerging Transdiscipline, 4(1), 29-43.
22. Herath, T. C., Herath, H. S. B., & Cullum, D. (2023). An information security performance measurement tool for senior managers: Balanced scorecard integration for security governance and control frameworks. Information Systems Frontiers, 25(2), 681-721.
23. ISO/IEC 27000. (2013). Information technology, security techniques. Information security management systems. Retrieved from https://www.iso.org/obp/ui/#iso:std:iso-iec:27001:ed-2:v1:en
24. Kamal, M., Muhamad, M., Sudianto, Y., Fauzan, M. A., Anggito, Y., Yasin, W., & Hermawan, H. (2024). Information technology security audit at the YDSF national zakat institution using the ISO 27001 framework. Jurnal Sisfokom (Sistem Informasi dan Komputer), 13(1).
25. Kanatov, M., Atymtayeva, L. B., & Yagaliyeva, B. (2014). Expert systems for information security management and audit: Implementation phase issues. In 2014 Joint 7th International Conference on Soft Computing and Intelligent Systems (SCIS) and 15th International Symposium on Advanced Intelligent Systems (ISIS) (pp. 896-900).
26. Khafidh Sunny Al Fajri, & Harwahyu, R. (2024). Information security management system assessment model by integrating ISO 27002 and 27004. Institut Riset dan Publikasi Indonesia (IRPI). P-ISSN: 2797-2313.
27. Kitsios, F., Chatzidimitriou, E., & Kamariotou, M. (2022). Developing a risk analysis strategy framework for impact assessment in information security management systems: A case study in IT consulting industry. Sustainability, 14(3), 1269.
28. Kozhakhmet, K. T., Bortsova, G., Inoue, A., & Atymtayeva, L. B. (2012). Expert system for security audit using fuzzy logic. In Midwest Artificial Intelligence and Cognitive Science Conference (p. 146).
29. Lakhno, V., Tkach, Y., Petrenko, T., Zaitsev, S., & Bazylevych, V. (2016). Development of adaptive expert system of information security using a procedure of clustering the attributes of anomalies and cyber attacks. Восточно-Европейский журнал передовых технологий, 65(4), 32-45.
30. Liu, J., Xiao, Y., Chen, H., Ozdemir, S., Dodle, S., & Singh, V. (2010). A survey of payment card industry data security standards. IEEE Communication Surveys & Tutorials, 12(3), 287-303.
31. Mera-Amores, F., & Roa, H. N. (2024). Enhancing information security management in small and medium enterprises (SMEs) through ISO 27001 compliance. In Future of Information and Communication Conference (pp. 197-207). Cham: Springer Nature Switzerland.
32. Mirtsch, M., Blind, K., Koch, C., & Dudek, G. (2021). Information security management in ICT and non-ICT sector companies: A preventive innovation perspective. Computers & Security, 109, 102383.
33. Muhammad Azam, M. S., Ali Khan, M., & Yang, S. (2022). A decision-making approach for the evaluation of information security management under complex intuitionistic fuzzy set environment. Journal of Mathematics, 2022, Article ID 9704466. https://doi.org/10.1155/2022/9704466
34. Olzak, T. (2013). Insider threats: Implementing the right controls. TechRepublic.
35. Piech, H., & Grodzki, G. (2017). Audit expert system of communication security assessment. Procedia Computer Science, 112, 147-156.
36. Proenca, D., & Borbinha, J. (2018). Information security management systems: A maturity model based on ISO/IEC 27001. In Business Information Systems: 21st International Conference, BIS 2018, Berlin, Germany, July 18-20, Proceedings 21 (pp. 102-114).
37. Raghavendra Rao Althar, D. S., Samanta, D., Purushotham, S., Singh Senga, S., & Hewage, C. (2023). Design and development of artificial intelligence knowledge processing system for optimizing security of software system. SN Computer Science, 4, 331.
38. Riswaya, A. R., Sasongko, A., Maulana, A., Mardira Indonesia, S., & Langlangbuana Bandung, U. (2020). Evaluasi tata kelola keamanan teknologi informasi menggunakan indeks kami untuk persiapan standar SNI ISO/IEC 27001 (Studi Kasus: STMIK Mardira Indonesia). Jurnal Computech & Bisnis, 14(1), 10–18.
39. Rkaur, G., Rani, P., & Garg, S. (2016). Various issues in expert system for information management and audit. International Journal of Advanced Research in Computer Science, 79(3), 245-261.
40. Saha, P., Mahanti, A., Chakraborty, B. B., & Navlani, A. (2013). Development of ontology-based framework for information security standards. In Proceedings of the 9th International Conference on Autonomic and Autonomous Systems (pp. 83-89).
41. Sendi, A. S., Jabbarifar, M., Shajari, M., & Dagenais, M. (2010). FEMRA: Fuzzy expert model for risk assessment. In 2010 Fifth International Conference on Internet Monitoring and Protection (pp. 48-53).
42. Sihwi, S. W., Andriyanto, F., & Anggrainingsih, R. (2016). An expert system for risk assessment of information system security based on ISO 27002. In 2016 IEEE International Conference on Knowledge Engineering and Applications (ICKEA) (pp. 56-61).
43. Singhal, D., Tripathy, S., & Kumar Jena, S. (2018). DEMATEL approach for analyzing the critical factors in remanufacturing process. Materials Today: Proceedings, 5(9), 18568-18573.
44. Sun, H., & Bai, S. H. (2022). Enterprise information security management using Internet of Things combined with artificial intelligence technology. Computational Intelligence and Neuroscience, 2022, Article ID 7138515. https://doi.org/10.1155/2022/7138515
45. Suorsa, M., & Helo, P. (2024). Information security failures identified and measured: ISO/IEC 27001: 2013 controls ranked based on GDPR penalty case analysis. Information Security Journal: A Global Perspective, 1-22.
46. Susanto, H., Almunawar, M. N., & Tuan, Y. C. (2011). Information security management system standards: A comparative study of the big five. International Journal of Electrical Computer Sciences, IJECSIJENS, 11(5), 23-29.
47. Tarek Ali, M., Al-Khalidia, M., & Al-Zaidib, R. (2024). Information security risk assessment methods in cloud computing: Comprehensive review. Journal of Computer Information Systems. https://doi.org/10.1080/08874417.2024.2329985
48. Tripathi, K. P. (2011). A review on knowledge-based expert system: Concept and architecture. IJCA Special Issue on Artificial Intelligence Techniques-Novel Approaches & Practical Applications, 4, 19-23.
49. Wallhoff, J. (2004). Combining ITIL with COBIT and ISO/IEC 17799: 2000. Scillani Information AB.
50. Holbert, R. L., Lee, J., Esralew, S., Walther, W. O., Hmielowski, J. D., & Landreville, K. D. (2013). Affinity for political humor: An assessment of internal factor structure, reliability, and validity. Humor, 26(4), 551-572.
51. Deepak, S., Sushant, T., & Sarat, K. (2018). DEMATEL approach for analyzing the critical factor in remanufacturing process. Materials Today: Proceedings, 5, 18568–18573.
52. Sfaei, H., & Homayounzadeh, F. (2017). A hybrid approach using fuzzy multi-criteria techniques to evaluate the performance of in-service training courses (Case study: Mazandaran and Golestan Regional Electricity Company). Journal of Applied Research on Industrial Engineering, 4(1), 39–49.
53. Zavadskas, E. K., Turskis, Z., Antucheviciene, J., & Zakarevicius, A. (2012). Optimization of weighted aggregated sum product assessment. Electronics and Electrical Engineering, 122(6), 3-6.