The importance of the process of evaluating information system security for a company, organization, or government agency whose goal is to carry out early detection of information leaks and even disruption of information systems. In this research conducted at SMAN 1 XYZ. The research being conducted was to determine the level of readiness and governance of information security based on ISO/IEC 27001:2013 standardization by using tools, namely the KAMI Information Security Index Version 4.2. In this research the method used to carry out the data collection process is to make direct observations on the objects used as research and questions and answers with the IT department that handles related information systems. Based on the research conducted, it was found that the maturity level of information security is that at the level of need for electronic devices, a score of 20 points is in line with the high KAMI index and is still Level I to Level II. Even though the result of the readiness assessment has a value of 245, this is a safety level of 1 which applies to SMAN 1 XYZ. To achieve a qualification level in accordance with the ISO/IEC 27001: 2013 standard, SMAN 1 XYZ must improve information security internally and externally, in this case external parties, and carry out security assessments on an ongoing and continuous basis.