The DOI matches its Crossref record; 46 of the 46 references it cites were found in a registry or an index; none of the 37 sources its claims cite is checked for support yet.
Best practice framework for information technology security governance in Indonesian government
Open accessAbstract
Information technology security is crucial for a digital government system to have so that the continuity of business processes can run smoothly. However, the current best practice of information security governance in the Indonesian national government is still inadequate according to various related studies still siloed and scattered and leading to vulnerabilities in the various digital services provided. Therefore, this study aims to develop a best practice framework for managing information security that is aligned with the needs of Indonesia's digital government. This research started by looking for the main framework of information security governance. Then the main components that resulted from that were benchmarked with other Information Security Governance (ISG) best practices from different countries. Finally, it ended up complementing them with information security parameters, other related components, and recommendations, particularly in the Indonesian context, so that the main components and their respective constituent sub-components can be obtained according to the needs of the Indonesian e-government. The cause-and-effect analysis concept analyses the data linkages between the six central components and their respective sub-components. This study concludes that each of main components and sub-components supports each other so that all these things must be carried out in a balanced and continuous manner.
Overview
AI snapshot
Written from the paper’s full text.
TL;DR
The paper develops a best-practice framework for IT security governance in Indonesian e-government by combining a CPS security governance model and information security critical success factors, benchmarking against other countries, and adding Indonesian-specific parameters, elements, and recommendations. It concludes that six interdependent main components—evaluation, direction, observation, performance conformance, compliance, and operational processes—must be implemented in a balanced, continuous, and synergistic way, though many subcomponent activities still require further development.
Key findings
- The proposed framework has six main components: evaluation, direction, observation, performance conformance, action skills (compliance), and operational processes (policies and procedures). These contain subcomponents, including five evaluation subcomponents, five observation subcomponents, three performance conformance subcomponents, one compliance subcomponent, and ten operational-process subcomponents.
- Benchmarking found that the USA had all main components, while Malaysia and South Africa had some of them; the paper states these countries complement one another and validate that Indonesia’s digital government needs all components.
- Cause-and-effect analysis indicated strong relationships among the six main components and their subcomponents: neglecting one component or subcomponent can disrupt the overall information security system, so they must be carried out in a balanced and continuous manner.
- Many activities within the subcomponents are not yet optimal and need further development because Indonesian information security parameters, related elements, or recommendations are missing or incomplete—for example, incident management, business continuity, controlling mechanisms and processes, timely and accurate IS performance reporting, third-party engagement, data copyright and privacy, and effective business continuity/disaster recovery planning.
Methods
- The study used a three-stage conceptual development process: stage 1 derived main components from a CPS security governance model and information security critical success factors; stage 2 benchmarked these against ICT/ISG best practices from the United States, Malaysia, and Africa/South Africa; stage 3 complemented them with Indonesian information security parameters, related elements, and cybersecurity recommendations.
- Data came from prior studies, standards, frameworks, laws, guidelines, and expert recommendations; no empirical survey, case sample, or statistical dataset is reported.
- Cause-and-effect analysis was used to analyze data linkages between the six main components and their respective subcomponents.
Limitations
- The paper states that many activities within each subcomponent are still inadequate or not optimal and require continuous development, and that there is a lack of synergy between current IT governance and IT security governance in Indonesia.
- The paper states that gaps within best-practice subcomponents are unavoidable outcomes and can be used for future developments in Indonesia and other relevant nationalities.
- Evident from the text: the framework is conceptual and not empirically validated or implemented; the benchmarking is limited to selected countries with a brief rationale (political system, human resources index, and geolocation), and several tables/figures appear incomplete in the provided text.
Model-written summary. Check it against the paper before relying on it.
Integrity signals
Registry
Cites
Statistics
Figures
![Figure 1 . Figure1. Information security governance positioned[14]](/paper-figures/a1d9e2360b56467a83a4cd96c1c67fb1/best-practice-framework-for-information-technology-security-governance-in-figure-1.png)
![Figure 2 . Figure 2. The relationship between information and communication security, information security and cyber security [14]](/paper-figures/58b94a64013d441b8834de440ba253d4/best-practice-framework-for-information-technology-security-governance-in-figure-2.png)
Verification
Claims the paper makes
32 Sources not found · 13 Own result · 5 Own interpretation · 4 No basis given
A result the paper reports from its own data — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“In the case of some best practice subcomponents such as incident management, business continuity, potential conflict and controlling mechanisms and processes, the availability of these activities in Indonesia's government is still missing, even though related research and recommendations have emerged.”
§ Best practice framework for information technology security governance in Indonesian government > 3.3.3. Observation
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A result the paper reports from its own data — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“the results of a proposed best practice framework for information security in the Indonesian government are obtained, consisting of six main frameworks and then the sub-components of each of these main frameworks, namely evaluation, direction, observation, performance conformance, action skills (compliance), and operational processes (policies and procedures).”
§ Best practice framework for information technology security governance in Indonesian government > 3.1. Key components from stage 1
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
A result the paper reports from its own data — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“As shown from Table 4, Indonesia still has not yet given any attention to the three of the constituent elements of this subcomponent because of the absence of information security parameters.”
§ Best practice framework for information technology security governance in Indonesian government > 3.3.5. Action skills/compliance
plainstates a cause- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
- Rests on an assumption: External rules and regulations frequently govern an organization's ability to collect information, conduct investigations, and control networks.
A result the paper reports from its own data — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Based on the research results that are shown in Table 2, we can see that each of the best practice sub components needs further development because of the incomplete concrete activities that are available at this time.”
§ Best practice framework for information technology security governance in Indonesian government > 3.3.3. Observation
plainstates a cause- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
In the paper
“Data collected by [34] through document analysis and interviews has confirmed that the ISG is present in several Malaysian public sector documents.”
§ Best practice framework for information technology security governance in Indonesian government > 3.2. Results from stage 2 (benchmarking the results from the first stage with existing Information and Communication Technology (ICT) governance best practices in certain countries)
What the sources say
- Not matchedcites [34]
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
- Not matched
In the paper
“In the case of industrial compliance, loss of privileges related to compliance can occur.”
§ Best practice framework for information technology security governance in Indonesian government > 3.3.5. Action skills/compliance
What the sources say
- Not matchedcites [48]
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
plainstates a cause- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
- Rests on an assumption: External rules and regulations frequently govern an organization's ability to collect information, conduct investigations, and control networks.
- Not matched
In the paper
“while the maturity level of information security (cybersecurity) in Indonesia is still deficient [18]”
§ Best practice framework for information technology security governance in Indonesian government > 1. INTRODUCTION
What the sources say
- Not matchedcites [18]
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
- Not matched
A result the paper reports from its own data — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“The components are governance approaches, good practices, risk management, organizational management, training and awareness, implementation methods, and laws and regulations.”
§ Best practice framework for information technology security governance in Indonesian government > 3.2. Results from stage 2 (benchmarking the results from the first stage with existing Information and Communication Technology (ICT) governance best practices in certain countries)
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
None of the sources cited for this claim could be matched to a paper in Crossref, so there is nothing to check it against.
In the paper
“Based on several studies from references [3], [4] and facts from the real world [5], Indonesia, however, does not yet have a comprehensive best-practice framework for managing information security.”
§ Best practice framework for information technology security governance in Indonesian government > 1. INTRODUCTION
What the sources say
- Not matchedcites [3]
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
- Not matchedcites [4]
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
- Not matchedcites [5]
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
- Not matched
None of the sources cited for this claim could be matched to a paper in Crossref, so there is nothing to check it against.
In the paper
“Until now, the framework COBIT 5 [1] and ISO 27001: 2013 [41] are generally used to analyze the maturity level of information security systems especially in the Indonesia context [42].”
§ Best practice framework for information technology security governance in Indonesian government > 3.3.1. Evaluation
What the sources say
- Not matchedcites [1]
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
- Not matchedcites [41]
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
- Not matchedcites [42]
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
- Not matched
In the paper
“The development of the ISG framework has been an integrated program involving policymaking institutions in public sector administration in Malaysia.”
§ Best practice framework for information technology security governance in Indonesian government > 3.2. Results from stage 2 (benchmarking the results from the first stage with existing Information and Communication Technology (ICT) governance best practices in certain countries)
What the sources say
- Not matchedcites [34]
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
plainstates a cause- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
- Not matched
In the paper
“Information security is a vital component in the planning process of integrated information technology in organizations, particularly in the Indonesian government [1].”
§ Best practice framework for information technology security governance in Indonesian government > 1. INTRODUCTION
What the sources say
- Not matchedcites [1]
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
- Not matched
In the paper
“According to a study, coercive pressure, normative pressure, and mimetic pressure have a significant influence to the organizational information of security compliance.”
§ Best practice framework for information technology security governance in Indonesian government > 3.3.5. Action skills/compliance
What the sources say
- Not matchedcites [49]
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
plainstates a cause- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
- Rests on an assumption: External rules and regulations frequently govern an organization's ability to collect information, conduct investigations, and control networks.
- Not matched
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“If one component is neglected or not implemented properly, it will result the disruption of the overall information security system.”
§ Best practice framework for information technology security governance in Indonesian government > 3.3.6. Operational processes (policies and procedures)
plainstates a cause- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
- Probably not a substantial claim. 34
- It may state two separate claims as one. 14
- The quote only partly states this claim. 1
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“For the sake of performance conformance, the Indonesian government still has no idea what kind of activities to handle each of these best practice subcomponents, particularly in terms of providing timely and accurate information on IS performance, reviewing IS performance in relation to business outcomes, and promoting continuous improvement in IS.”
§ Best practice framework for information technology security governance in Indonesian government > 3.3.4. Performance conformance
plain- Asserted: passes — The authors put it forward as true.
- Checkable: fails — It may be too vague to check against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. It may be too vague to check against evidence. The paper may give no reason why it holds.
A result the paper reports from its own data — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Moreover, in terms of IT infrastructure and daily operation subcomponent, Indonesia has given attention to this part from a technology point of view, but the relevant activities are miserable.”
§ Best practice framework for information technology security governance in Indonesian government > 3.3.3. Observation
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
A result the paper reports from its own data — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“By seeing Table 1, America has all of the main components, while Malaysia and South Africa have some of them.”
§ Best practice framework for information technology security governance in Indonesian government > 3.2. Results from stage 2 (benchmarking the results from the first stage with existing Information and Communication Technology (ICT) governance best practices in certain countries)
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
- Rests on an assumption: The United States, Malaysia, and Africa/South Africa are appropriate comparators for Indonesia because of similarities in political system, human resources index, and geolocation.
A result the paper states — it cites no source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“The subcomponents consist of law and regulations, third party engagement, data copy rights, and privacy.”
§ Best practice framework for information technology security governance in Indonesian government > 3.3.5. Action skills/compliance
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim.
- Rests on an assumption: External rules and regulations frequently govern an organization's ability to collect information, conduct investigations, and control networks.
A result the paper states — it cites no source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“There are 10 (ten) important subcomponents in the operational activities of making policies and procedures in the information technology security as can be seen in Table 5.”
§ Best practice framework for information technology security governance in Indonesian government > 3.3.6. Operational processes (policies and procedures)
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“There is only one best practice subcomponent in the context of compliance, namely conforming to and complying with internal and external information security requirements.”
§ Best practice framework for information technology security governance in Indonesian government > 3.3.5. Action skills/compliance
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds.
- Rests on an assumption: External rules and regulations frequently govern an organization's ability to collect information, conduct investigations, and control networks.
A result the paper states — it cites no source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“In this context, for some parts, it is easier to create various activities relating to each best practice subcomponent because of the presence of a set of information security parameters, elements, and recommendations such as protecting classified information.”
§ Best practice framework for information technology security governance in Indonesian government > 3.3.6. Operational processes (policies and procedures)
plainstates a cause- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
In the paper
“Moreover, by using the concept of cause-and-effect analysis [55] in analyzing the data linkages between the six main components along with their respective sub-components, it is concluded that there are strong relationships between one component and another components.”
§ Best practice framework for information technology security governance in Indonesian government > 3.3.6. Operational processes (policies and procedures)
What the sources say
- Not matchedcites [55]
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
boostedstates an association- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
The quote only partly states this claim.
- Not matched
A result the paper states — it cites no source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“This study concludes that there are six main components to compiling the best practice framework for information security governance that can be used by the Indonesian government, which consists of evaluating, directing, monitoring, performance conformance, action skills (compliance), and operational processes (policies and procedures) components.”
§ Best practice framework for information technology security governance in Indonesian government > 4. CONCLUSION
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Due to the fact that the related IS parameters in the Indonesian government are not comphrehensive yet, the relevant activities cannot be generated.”
§ Best practice framework for information technology security governance in Indonesian government > 3.3.6. Operational processes (policies and procedures)
plainstates a cause- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper may give no reason why it holds. It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Each of the main components and sub-components supports each other, so all these things must be carried out synergistically and proportionately.”
§ Best practice framework for information technology security governance in Indonesian government > 4. CONCLUSION
plainstates an association- Asserted: passes — The authors put it forward as true.
- Checkable: fails — It may be too vague to check against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. It may be too vague to check against evidence. The paper may give no reason why it holds.
A result the paper states — it cites no source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Within each of these main components and the supporting sub-components, relevant activities can be generated but still need further development.”
§ Best practice framework for information technology security governance in Indonesian government > 4. CONCLUSION
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. It may state two separate claims as one.
A result the paper states — it cites no source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Nevertheless, in other parts, it is taking more effort to create the activities because of the absence of either related parameters, elements, or recommendations such as an effective business continuity or disaster recovery plan.”
§ Best practice framework for information technology security governance in Indonesian government > 3.3.6. Operational processes (policies and procedures)
plainstates a cause- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim.
In the paper
“Research conducted by [7] revealed that security should be seen as an indispensable feature in a digital context.”
§ Best practice framework for information technology security governance in Indonesian government > 3. RESULTS AND DISCUSSION
What the sources say
- Not matchedcites [7]
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
plain- Asserted: passes — The authors put it forward as true.
- Checkable: fails — It may be too vague to check against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. It may be too vague to check against evidence. The paper’s conclusions may not depend on it.
- Not matched
In the paper
“The functional aspects included in the security framework consist of identify, protect, detect, respond, and recover and each of these aspects is accompanied by their respective components and subcomponents [33].”
§ Best practice framework for information technology security governance in Indonesian government > 3.2. Results from stage 2 (benchmarking the results from the first stage with existing Information and Communication Technology (ICT) governance best practices in certain countries)
What the sources say
- Not matchedcites [33]
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. It may state two separate claims as one.
- Not matched
In the paper
“In the observation/monitoring stage, there are two main functions of technology information in the security system, that are monitoring the conformity between the system and policies and monitoring the implementation of the system against the plan [22].”
§ Best practice framework for information technology security governance in Indonesian government > 3.3.3. Observation
What the sources say
- Not matchedcites [22]
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. It may state two separate claims as one.
- Not matched
None of the sources cited for this claim could be matched to a paper in Crossref, so there is nothing to check it against.
In the paper
“However, the study by [15] proves that cybersecurity governance in Indonesia's government agencies is still lacking and not yet integrated and the need to combine various related matters [16].”
§ Best practice framework for information technology security governance in Indonesian government > 1. INTRODUCTION
What the sources say
- Not matchedcites [15]
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
- Not matchedcites [16]
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
boosted- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
- Not matched
In the paper
“so that it affects various organizational management activities from the operational level to the strategic level of the organization [14].”
§ Best practice framework for information technology security governance in Indonesian government > 1. INTRODUCTION
What the sources say
- Not matchedcites [14]
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
plainstates a cause- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
- Not matched
In the paper
“Integrated development has resulted in a comprehensive ISG framework for use by public sector agencies in Malaysia.”
§ Best practice framework for information technology security governance in Indonesian government > 3.2. Results from stage 2 (benchmarking the results from the first stage with existing Information and Communication Technology (ICT) governance best practices in certain countries)
What the sources say
- Not matchedcites [34]
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
plainstates a cause- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
- Not matched
In the paper
“Basically, information security is a crucial matter that works integrated with organizational governance and is related to data management, applications, business processes and infrastructure/technology [19]”
§ Best practice framework for information technology security governance in Indonesian government > 1. INTRODUCTION
What the sources say
- Not matchedcites [19]
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
plainstates an association- Asserted: passes — The authors put it forward as true.
- Checkable: fails — It may be too vague to check against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. It may be too vague to check against evidence. It may state two separate claims as one.
- Not matched
In the paper
“This framework has security middleware, which is basically the link between the public key infrastructure system and the application.”
§ Best practice framework for information technology security governance in Indonesian government > 3.2. Results from stage 2 (benchmarking the results from the first stage with existing Information and Communication Technology (ICT) governance best practices in certain countries)
What the sources say
- Not matchedcites [36]
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
plainstates an association- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
- Not matched
In the paper
“The audit implementation relies on advanced standards and frameworks of IT infrastructure organization, management, and security such as Cobit and ISO 17799 [40].”
§ Best practice framework for information technology security governance in Indonesian government > 3.3.1. Evaluation
What the sources say
- Not matchedcites [40]
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
plainstates a cause- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
- Not matched
In the paper
“The research is done through monitoring organizational information in practice and makes a conclusion that monitoring information can improve the information security management (ISM) practices in organizations [45].”
§ Best practice framework for information technology security governance in Indonesian government > 3.3.3. Observation
What the sources say
- Not matchedcites [45]
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
plainstates a cause- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
- Not matched
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“If the ISM practice works well, it will improve the overall organizational practice.”
§ Best practice framework for information technology security governance in Indonesian government > 3.3.3. Observation
hedgedstates a possible cause- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds.
In the paper
“The directing stage directly serves the preparation and implementation of various plans and policies to ensure that the use of CPS can connect with the objectives of the security system [22].”
§ Best practice framework for information technology security governance in Indonesian government > 3.3.2. Direction
What the sources say
- Not matchedcites [22]
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
plainstates a cause- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
- Not matched
In the paper
“This system ensures that all communications between parties within the e-government infrastructure are encrypted.”
§ Best practice framework for information technology security governance in Indonesian government > 3.2. Results from stage 2 (benchmarking the results from the first stage with existing Information and Communication Technology (ICT) governance best practices in certain countries)
What the sources say
- Not matchedcites [36]
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
plainstates a cause- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
- Not matched
In the paper
“In the case of regulatory compliance, non-compliance can effect harsher penalties, including detention for violating the relevant law [48].”
§ Best practice framework for information technology security governance in Indonesian government > 3.3.5. Action skills/compliance
What the sources say
- Not matchedcites [48]
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
plainstates a cause- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
- Rests on an assumption: External rules and regulations frequently govern an organization's ability to collect information, conduct investigations, and control networks.
- Not matched
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“These six things are interrelated to one another so that if one component or sub-component is ignored, it will affect overall performance.It will have the potential to weaken the ongoing governance system.”
§ Best practice framework for information technology security governance in Indonesian government > 3.1. Key components from stage 1
hedgedstates a possible cause- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. It may state two separate claims as one.
In the paper
“Compliance with laws and regulations is critical and becomes one of the key elements to ensure the ISG of the organization is effective and sustainable [23].”
§ Best practice framework for information technology security governance in Indonesian government > 3.3.5. Action skills/compliance
What the sources say
- Not matchedcites [23]
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
plainstates a cause- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim.
- Rests on an assumption: External rules and regulations frequently govern an organization's ability to collect information, conduct investigations, and control networks.
- Not matched
In the paper
“The evaluation stage, often called the assessment stage or audit stage, serves an evaluation by using the CPS for current and future condition.”
§ Best practice framework for information technology security governance in Indonesian government > 3.3.1. Evaluation
What the sources say
- Not matchedcites [22]
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
plainstates a cause- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
- Not matched
In the paper
“According to a study, information security is purposefully defined and applied, but the measurements are principally implemented in the technical and operational levels, while strategic management remains inadequate [39].”
§ Best practice framework for information technology security governance in Indonesian government > 3.3.4. Performance conformance
What the sources say
- Not matchedcites [39]
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. It may state two separate claims as one.
- Not matched
In the paper
“Role-based access control allows for proper assignment of responsibilities based on the policies specified in the strategic framework and is primarily based on hierarchical considerations.”
§ Best practice framework for information technology security governance in Indonesian government > 3.2. Results from stage 2 (benchmarking the results from the first stage with existing Information and Communication Technology (ICT) governance best practices in certain countries)
What the sources say
- Not matchedcites [36]
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
plainstates a cause- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. It may state two separate claims as one.
- Not matched
In the paper
“Most organizations recognize the needs of monitoring and improving the management of risk and internal security processes by using security governance procedures [52].”
§ Best practice framework for information technology security governance in Indonesian government > 3.3.6. Operational processes (policies and procedures)
What the sources say
- Not matchedcites [52]
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
- Not matched
In the paper
“The framework recommended the use of session keys because session keys are randomly generated, making it difficult for attackers to intercept messages on the network.”
§ Best practice framework for information technology security governance in Indonesian government > 3.2. Results from stage 2 (benchmarking the results from the first stage with existing Information and Communication Technology (ICT) governance best practices in certain countries)
What the sources say
- Not matchedcites [36]
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
plainstates a cause- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. It may state two separate claims as one.
- Not matched
In the paper
“Basically, there is a relationship between aspects of information security and information technology governance as shown in Figure 1 and also a relationship between IT security and cyber security as shown in Figure 2 [14].”
§ Best practice framework for information technology security governance in Indonesian government > 1. INTRODUCTION
What the sources say
- Not matchedcites [14]
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
plainstates an association- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
- Not matched
In the paper
“The model shows how e-government systems relate to their customers by using two-way certificate authentication with valid user authentication for each service.”
§ Best practice framework for information technology security governance in Indonesian government > 3.2. Results from stage 2 (benchmarking the results from the first stage with existing Information and Communication Technology (ICT) governance best practices in certain countries)
What the sources say
- Not matchedcites [36]
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
plainstates a cause- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
- Not matched
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Nevertheless, these countries complement one another and can validate the research findings that Indonesia's digital government needs all of these components to adequately protect the digital system in running the daily operations with its related stakeholders.”
§ Best practice framework for information technology security governance in Indonesian government > 3.2. Results from stage 2 (benchmarking the results from the first stage with existing Information and Communication Technology (ICT) governance best practices in certain countries)
plainstates a cause- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
- Rests on an assumption: The United States, Malaysia, and Africa/South Africa are appropriate comparators for Indonesia because of similarities in political system, human resources index, and geolocation.
In the paper
“It implies that the advantages of information security compliance encourage the management to enhance their commitment for information security compliance [49].”
§ Best practice framework for information technology security governance in Indonesian government > 3.3.5. Action skills/compliance
What the sources say
- Not matchedcites [49]
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
hedgedstates a cause- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
- Rests on an assumption: External rules and regulations frequently govern an organization's ability to collect information, conduct investigations, and control networks.
- Not matched
In the paper
“The information security model that applies in Nigeria has been emphasized in the general aspect of security.”
§ Best practice framework for information technology security governance in Indonesian government > 3.2. Results from stage 2 (benchmarking the results from the first stage with existing Information and Communication Technology (ICT) governance best practices in certain countries)
What the sources say
- Not matchedcites [36]
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
- Not matched
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Nevertheless, if these components are not regularly reviewed, the level of effectiveness in achieving government performance will be difficult to be measured.”
§ Best practice framework for information technology security governance in Indonesian government > 3.3.6. Operational processes (policies and procedures)
plainstates a possible cause- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim.
The paper relies on this without support.
The United States, Malaysia, and Africa/South Africa are appropriate comparators for Indonesia because of similarities in political system, human resources index, and geolocation.
“which consists of United States, Malaysia and Africa because of the political system, human resources index and geolocation closed similarities with Indonesia respectively.”
The paper relies on this without support.
External rules and regulations frequently govern an organization's ability to collect information, conduct investigations, and control networks.
“External rules and regulations frequently govern an organization's ability to collect information, conduct investigations, and control the networks among other activities of the information gotten from technology security.”
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
Each contradiction between two passages listed here was confirmed by an independent check.
Rated minor: it would not touch a result — a value no result rests on, a p-value that stays on the same side of the significance level, or a conflict that is clerical, resolved elsewhere in the paper, or outside its own findings.
In the paper
§ Best practice framework for information technology security governance in Indonesian government > 3.2. Results from stage 2 (benchmarking the results from the first stage with existing Information and Communication Technology (ICT) governance best practices in certain countries)
“The components are governance approaches, good practices, risk management, organizational management, training and awareness, implementation methods, and laws and regulations.The four components will undergo a continuous cycle of design, implementation, assessment, and follow-up processes.”
§ Best practice framework for information technology security governance in Indonesian government > 3.2. Results from stage 2 (benchmarking the results from the first stage with existing Information and Communication Technology (ICT) governance best practices in certain countries)
“The components are governance approaches, good practices, risk management, organizational management, training and awareness, implementation methods, and laws and regulations.”
Citations
Cites
From information security to cyber security
von Solms, R., & van Niekerk, J. (2013) · Computers & Security · doi:10.1016/j.cose.2013.04.004 · Cited by 1,078
Enterprise Governance of Information Technology
Haes, S. D., & Grembergen, W. V. (2009) · Springer eBooks · doi:10.1007/978-0-387-84882-2 · Cited by 392
Information security governance challenges and critical success factors: Systematic review
AlGhamdi, S., Win, K. T., & Vlahu‐Gjorgievska, E. (2020) · Computers & Security · doi:10.1016/j.cose.2020.102030 · Cited by 170
The Integrated Architecture Framework Explained
Wout, J. V. ’., Waage, M., Hartman, H., Stahlecker, M., & Hofman, A. (2010) · Springer eBooks · doi:10.1007/978-3-642-11518-9 · Cited by 119
Computer and Information Security Handbook
(2013) · Elsevier eBooks · doi:10.1016/c2011-0-07051-5 · Cited by 113
Lundgren, B., & Möller, N. (2017) · Science and Engineering Ethics · doi:10.1007/s11948-017-9992-1 · Cited by 108
Information security assessment in public administration
Szczepaniuk, E. K., Szczepaniuk, H., Rokicki, T., & Klepacki, B. (2019) · Computers & Security · doi:10.1016/j.cose.2019.101709 · Cited by 93
State of the art in information security policy development
Paananen, H., Lapke, M., & Siponen, M. T. (2019) · Computers & Security · doi:10.1016/j.cose.2019.101608 · Cited by 90
Sulistyowati, D., Handayani, F., & Suryanto, Y. (2020) · JOIV International Journal on Informatics Visualization · doi:10.30630/joiv.4.4.482 · Cited by 79
Data Governance is Key to Interpretation: Reconceptualizing Data in Data Science
Leonelli, S. (2019) · Harvard Data Science Review · doi:10.1162/99608f92.17405bb6 · Cited by 67
Research works printed but not linked: 4
- H. Ardiyanti, "Cyber-security and its development challenges in Indonesia," (in Bahasa), Jurnal Politica Dinamika Masalah Politik Dalam Negeri dan Hubungan Internasional, vol. 5, no. 1, pp. 95-119, 2014.
- A. B. Setiawan, "In the application of E-Government," (in Bahasa), Jurnal Masyarakat Telematika dan Informasi, vol. 4, no. 2, pp. 109-126, 2013.
- DHS, "Cyber resilience review," Department Homeland University, Carnegie Mellon University, 2011.
- J. Andress, Foundations of information security. No Starch Press, 2019.
Cited by
Sorted by citations
Public Services Based On e-Government in Digital Age
Weningsih, S., Sulaiman, A. I., Chusmeru, C., & Adi, T. N. (2022) · Technium Social Sciences Journal · doi:10.47577/tssj.v37i1.7723 · Cited by 9
National and sectoral information technology planning: a systematic literature review
Alidousti, S., & Sahli, F. (2024) · International Journal of Public Sector Management · doi:10.1108/ijpsm-09-2023-0286 · Cited by 6
E-GOVERNMENT MATURITY ANALYSIS USING THE LAYNE AND LEE, HILLER AND BELANGER, AND SPBE MODELS
Noman, E. P., & Emanuel, A. W. R. (2024) · JITK (Jurnal Ilmu Pengetahuan dan Teknologi Komputer) · doi:10.33480/jitk.v9i2.5110 · Cited by 5
Fachrurrozi, N. R., Wirabudi, A. A., & Rozano, S. A. (2024) · International Journal of Science Education and Cultural Studies · doi:10.58291/ijsecs.v3i2.246 · Cited by 3
Prasetyo, A., Aji, R. F., & Wibowo, W. S. (2025) · Journal of Information Systems Engineering and Business Intelligence · doi:10.20473/jisebi.11.2.126-142 · Cited by 3
Metadata
- Authors
- Yuliana, R., & Arifin Hasibuan, Z.
- Affiliations
- Universitas Islam Negeri Ar-Raniry (ID)
- Venue
- International Journal of Electrical and Computer Engineering (IJECE)
- Published
- 2022-12-01
- Volume
- 12
- Issue
- 6
- Pages
- 6522
- ISSN
- 2722-256X (ISSN-L)
- 2722-2578
- 2088-8708
- OpenAlex
- W4296713784
- Semantic Scholar
- ee1cfee53f82b6c01b3576c629acda09c223b686
- Cited by
- 18
- References
- 45
- Citations by year
- 2026: 3 · 2025: 5 · 2024: 8 · 2023: 1 · 2022: 1
- FWCI
- 2.62
- Type
- journal article
- Language
- en
- Open access
- diamond
- doi.org
- Licence
- Locations
- International Journal of Power Electronics and Drive Systems/International Journal of Electrical and Computer Engineering (publishedVersion, cc-by-sa)
- Topics
- Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
- Social Sciences › Business, Management and Accounting › Management Information Systems › Information Technology Governance and Strategy
- Social Sciences › Political Science and International Relations › E-Government and Public Services
- Keywords
- information security governance, best practice framework, e-government, Indonesian government, cause-and-effect analysis, benchmarking, business continuity
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
A language model drew the claims from the paper on 2026-11-07, under version 3 of the claim definition (model deepseek-v4.1-flash, prompt extract-v3).
A second model labelled each claim on 2026-11-07 (model jev-1.13-20260917, definition revision gold-guideline-v0.2).
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
