在資訊科技爆炸時代，資訊安全管理系統已成為各組織營運之最優先考量因素；資訊安全漏洞將造成企業之危機，風險發生原因及其影響也將帶來革命性的變化，為求組織永續發展及營運安全，不斷資訊安全管理系統評估、預防管理及立即應變計畫乃必然之防範作為。本研究以實踐大學高雄校區 ISO27001系統認證為例，透過資管系受過 ISO27001稽核員訓練課程 54小時之同學為對象，以時間柵欄分別於2011年及2012年，間隔一年方式針對相同對象進行問卷調查，運用投票式權重評選模式計算權重值，發現「政策與規劃、執行與管理、檢查與矯正、管理審查」等 4項主要及 16項次要之關鍵成功因素，並排列優先順序，且經分析兩次之評估結果並無顯著差異，可作為企業或大學院校導入 ISO27001認證之參考。

In this information technology explosion era, the information security management system (ISMS) has become a top priority of the organization operations considerations. Any leaks in ISMS would cause disaster enterprise but on the other hands the factors of risk and its impact on ISMS could also bring a revolution. For the sake of long term business and operational security, the frequent information security management system evaluation, prevention management and instant contingency plan are a required action. We take the ISO27001 certificating on Shih Chien University Kaohsiung Campus as an example. By students who had 54 hours of ISO27001 auditor course, to carry out questionnaires in 2011 and 2012.The voting-ranking model is used to evaluate and calculate the weights of critical success factors (CSFs) of ISO27001 certification. We find out four CSFs, 16 Sub-CSFs and the descended ranking as the “policy and planning, execution and management, checking and correction, management reviews”. With no significant difference in two consecutive analyses, the results of this study can a reference for one who intends to introduce ISO27001 certification.