The DOI matches its Crossref record; 1 of the 1 references it cites were found in a registry or an index.
Integrating ISO 31000, ISO/IEC 27005, and NIST SP 800-30 for Risk Management in High-Classification Government Application
Open accessAbstract
Digital transformation has encouraged various sectors to adapt and innovate. One such sector is government, which is required to simplify bureaucracy through digitalization. However, the digitalization process has led to an increase in the complexity of cybersecurity risks. A comprehensive risk management strategy is needed to address vulnerabilities to cyberattacks. A stand-alone risk management framework is not entirely effective in dealing with this issue, therefore a combined framework approach may be a more relevant solution. This research is a case study of risk management implementation in Application X, which is a high-classification application in the government sector. The methods used combine ISO 31000, ISO/IEC 27005, and NIST SP 800-30. ISO 31000 is used as the main risk management framework, meanwhile ISO/IEC 27005 and NIST SP 800-30 are used as guidelines in the risk assessment process. The risk evaluation stage is carried out by comparing the results of the risk analysis with the risk acceptance criteria, with the aim of determining which risks are tolerable. The results show that 64 risks were identified, of which 13 need to be addressed because they are outside the organization's risk tolerance, while the other 51 do not need to be addressed because they are within the organization's risk tolerance. ISO/IEC 27002 is used as a technical guideline for risk treatment recommendations.
Overview
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Citations
Cites
Sinulingga, R. M. A., Raharjo, T., & Trisnawaty, N. W. (2024) · Jurnal Informatika Ekonomi Bisnis · doi:10.37034/infeb.v6i4.1053 · Cited by 6
Flagged first, then by citations
Research works printed but not linked: 14
- Eom, 2022, Digital government transformation in turbulent times: Responses, challenges, and future direction, Gov Inf Q, 39, 10.1016/j.giq.2022.101690 · DOI
- Soomro, 2016, Information Security Management Needs More Holistic Approach: A Literature Review, Int J Inf Manage, 36, 215
- International Organization for Standardization. Information Security, Cybersecurity and Privacy Protection-Guidance on Managing Information Security Risks (ISO/IEC 27005:2022). Fourth Edition. 2022.
- International Organization for Standardization. Risk Management-Guidelines (ISO 31000:2018). Second Edition. 2018.
- International Organization for Standardization. Information Security, Cybersecurity and Privacy Protection-Information Security Management Systems-Requirements (ISO/IEC 27001:2022). Third Edition. 2022.
- Goman M. Current State of IT Risk Analysis in Management Frameworks: Is It Enough? 2019. https://doi.org/10.1109/ITMS47855.2019.8940653. · DOI
- Putra, 2023, Integrated Methodology for Information Security Risk Management using ISO 27005:2018 and NIST SP 800-30 for Insurance Sector, Int J Adv Comput Sci Appl, 14, 2023
- AFiK, 2022, Desain Kerangka Kerja Manajemen Risiko Keamanan Informasi Berdasarkan Kajian Risk Profiling pada Sektor Kesehatan, Jurnal Multinetics, 8
- Everett, 2011, A Risky Business: ISO 31000 and 27005 unwrapped, Computer Fraud & Security, 10.1016/S1361-3723(11)70015-X · DOI
- Barafort, 2018, Integrated Risk Management Process Assessment Model for IT Organizations Based on ISO 31000 in an ISO Multi-Standards Context, Comput Stand Interfaces, 60, 57, 10.1016/j.csi.2018.04.010 · DOI
- Pambudi, 2023, Information Security Risk Management Design of Supervision Management Information System at XYZ Ministry Using NIST SP 800-30, Jurnal Teknik Informatika (JUTIF), 4, 591, 10.52436/1.jutif.2023.4.3.978 · DOI
- Juliharta, 2023, Analysis and Design of Risk Management System of Electronic Government (E-Government) (Study Case: XYZ Institutions), Jurnal TAM (Technology Acceptance Model), 14, 145
- 2020, Peraturan Menteri Pendayagunaan Aparatur Negara dan Reformasi Birokrasi RI, Peraturan Menteri Pendayagunaan Aparatur Negara dan Reformasi Birokrasi Republik Indonesia Nomor 5 Tahun 2020 tentang Pedoman Manajemen Risiko Sistem Pemerintahan Berbasis Elektronik
- Meitarice, 2024, Risk Management Analysis of Information Security in an Academic Information System at a Public University in Indonesia: Implementation of ISO/IEC 27005:2018 and ISO/IEC 27001:2013 Security Controls, Journal of Information Technology and Cyber Security, 2, 58, 10.30996/jitcs.12099 · DOI
Metadata
- Authors
- Setiawan, D., & Soewito, B.
- Affiliations
- Binus University (ID)
- Corresponding author
- Setiawan, Dedy
- ORCID
- Soewito, Benfano
- Venue
- Procedia Computer Science
- Publisher
- Elsevier BV
- Published
- 2026
- Volume
- 289
- Pages
- 20-29
- ISSN
- 1877-0509 (ISSN-L)
- OpenAlex
- W7214166893
- Cited by
- 0
- References
- 1
- FWCI
- 0.00
- Type
- conference paper
- Language
- en
- Open access
- diamond
- doi.org
- Licence
- Locations
- Procedia Computer Science (publishedVersion, cc-by)
- Topics
- Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
- Social Sciences › Business, Management and Accounting › Management Information Systems › Information Technology Governance and Strategy
- Social Sciences › Business, Management and Accounting › Strategy and Management › Quality and Management Systems
- Keywords
- risk management, ISO 31000, ISO/IEC 27005, NIST SP 800-30, cybersecurity risk assessment, risk acceptance criteria, risk response, ISO/IEC 27002, digitalization of public administration, cyberattack vulnerability
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
