Risk Analysis and Control of Information Systems in ISO/IEC 17025 Accredited Testing Laboratories

In the era of digital transformation, information security has become a critical determinant of reliability in ISO/IEC 17025 accredited testing laboratories, especially those conducting transformer parameter measurements that directly influence national energy infrastructure. This study develops a comprehensive risk analysis and control framework grounded in ISO/IEC 27005 and NIST SP 800-30 methodologies and enhanced with modern cybersecurity mechanisms, including Zero Trust architecture, DevSecOps practices, automated monitoring, and disaster recovery solutions. To provide an integrated evaluation of laboratory information system resilience, the research introduces a Trustworthiness Index (TI), combining confidentiality, integrity, and availability as core security attributes. Simulation results involving three hypothetical laboratories demonstrate that the implementation of advanced control mechanisms significantly increases TI values—from medium trustworthiness levels (55–68) to high levels (78–85). Additionally, an optimization model using the Steepest Ascent Method identifies the most effective configuration of controls for each laboratory profile, ensuring resource-efficient security enhancement. The findings reveal that compliance with ISO/IEC 17025 alone is insufficient to guarantee comprehensive information security, highlighting the need for systematic integration of international cybersecurity standards. Future work will involve validating the proposed model using real laboratory data and extending the TI methodology to multi-criteria or weighted assessment approaches.