Gap Audit and ISO/IEC 27001:2022 Control Implementation for Improving the Control Conformity of a Web-Based Local Archive Digitization System

Abstract

Local governments increasingly rely on web-based systems to manage digital archives, yet such systems are often deployed without a structured security evaluation. This study audits a Laravel-based local archive digitization system at the Library and Archives Office of Probolinggo City, Indonesia, before wider operational use. A mixed-methods case study proceeded through baseline assessment, risk analysis, remediation, and re-evaluation with identical instruments. The baseline combined a gap analysis against 13 technological controls of ISO/IEC 27001:2022 Annex A.8, grey-box penetration testing (manual testing and OWASP ZAP), and static analysis of source code and dependencies. Baseline conformity was 50% (13 of 26 points), and eight findings were identified: two high-risk, five medium-risk, and one low-risk. The most critical were archive files reachable by URL without authentication (risk score 25) and inconsistent authorization on data-management functions (risk score 16). Remediation comprised private storage with signed URLs, policy-based authorization, threat monitoring with automatic blocking and alerts, field-level audit logging, soft deletion with restore, and security headers. After remediation, conformity rose to 96.15% (25 of 26 points), twelve controls were fully conformant, dynamic testing reported no medium or higher alerts, and an archivist’s verification matched the expected result in 33 of 34 feature scenarios. The only residual risk concerns development-branch dependencies. Conformity measures the implementation of selected application-level controls, not resistance to real attacks, and scoring was performed by the study team in an isolated environment. Within that scope, the closed-loop audit gives a repeatable account of control improvement before deployment.