CoChat
Sign Up
Cited by 6Software Engineering Techniques and PracticesQuality and Management SystemsInformation and Cyber Security

The DOI matches its Crossref record; 12 of the 12 references it cites were found in a registry or an index; none of the 2 sources its claims cite is checked for support yet.

Risk Management Design and Analysis on Agile Development Project using ISO 31000 Integrated with ISO 27005: A Case Study of SiREV Application

Open access
Sinulingga, Redry Maynard Ananda, Raharjo, Teguh, Trisnawaty, Ni Wayan·2024·Jurnal Informatika Ekonomi Bisnis
DOI 10.37034/infeb.v6i4.1053
Open this paper in CoChat — free accountOpen PDF

Abstract

Implementing e-government in Indonesia, one example of technology adoption in the government sector is the digitalization of business processes within government agencies. SiREV application is an information system used by auditor XYZ Agency in carrying out business processes in the field of supervision. In developing this application, the agile method was chosen to accommodate several reasons starting from requirements that could not be determined at the beginning of the work implementation and changes to the application in the future that needed to be made to adapt to needs. Several obstacles are encountered in its implementation which are the familiarity of using agile methods and the security of the information while developing it. To conduct this research, we use ISO 31000:2018 and ISO 27005:2018 framework to assess the risks. This study aims to assess risk in agile project with ISO 31000 and ISO 27005 so that XYZ Agency has a design of risk management related to agile implementation in project development and information security. The results of this research showed that 24 risks were identified, consisting of 11 risks related to agile implementation and 13 risks related to information security. After doing risk evaluation from these 24 risks, 13 risks need to be handled because they are outside the organization's risk appetite, while the other 11 risks do not need to be handled because they are within the organization's risk appetite

Overview

AI snapshot

Written from the paper’s full text.

TL;DR

This case study designs risk management for agile development of the SiREV application at XYZ Agency by integrating ISO 31000:2018 with ISO 27005:2018. It identifies 24 risks—11 related to agile implementation and 13 to information security—with 13 outside the organization’s risk appetite requiring treatment and 11 accepted.

Key findings

  • 24 risks were identified: 11 related to agile implementation and 13 related to information security.
  • After risk evaluation, 13 risks need to be handled because they are outside the organization’s risk appetite, while 11 do not need handling because they are within the risk appetite.
  • The 13 handled risks consist of 5 agile implementation risks and 8 information security risks.
  • Specific assessed levels include R21 (data theft from external parties) at Very high / 21, R13 (damage to device) and R15 (social engineering attack) at High / 19, R14 (DoS/DDOS attack), R6 (low customer involvement), and R7 (unclear requirements) at High / 18.

Methods

  • Qualitative case study of the SiREV application at XYZ Agency, using ISO 31000:2018 guidelines integrated with ISO 27005:2018 for risk assessment.
  • Data gathered through literature study, interviews with responsible persons, observation, and questionnaires; both primary and secondary data were used.
  • Analysis followed ISO 31000 steps: establishing scope, context and criteria; risk identification; risk analysis using likelihood and impact scoring; risk evaluation against XYZ Agency Regulation No. 6 year 2017 risk criteria; and risk treatment recommendations, with information security controls based on ISO/IEC 27002:2018.

Limitations

  • Stated: because the project had not yet started, the study could only create a risk register and assessment; updating the risk register during sprint or iteration implementation could not be done and is proposed for future work.
  • Stated: future work could also try other frameworks or standards for risk management in agile methods.
  • Evident from the text: the study is a single case study of one application at XYZ Agency, and the paper does not report sample sizes or participant counts for the interviews, observations, or questionnaires.

Model-written summary. Check it against the paper before relying on it.

Integrity signals

Registry

Crossref · 10.37034/infeb.v6i4.1053

Cites

12 of 12 references verified0 citation errors · 0 not checkable

Statistics

Nothing to recompute.

Verification

Claims the paper makes

0 of 2 cited sources checked · 0 supported · 0 flagged

  • Findingown data

    The implementation of the agile method in software development at XYZ Agency is new.

    “Based on the results of the interview, it was found that the implementation of the agile method in software development at XYZ Agency is something new and several risks must be mapped out that could hinder the completion of the project in accordance with what has been determined.”
    Quote in the paperSubstantial claim
  • Findingown data

    In the risk assessment for the SiREV application, 24 risks were identified, consisting of 11 risks related to agile implementation and 13 risks related to information security.

    “The results of this research showed that 24 risks were identified, consisting of 11 risks related to agile implementation and 13 risks related to information security.”
    • Also stated in: § 3.3. Risk Treatment · plain
      “The results of the risk analysis and evaluation stages showed that 24 risks were identified, consisting of 11 risks related to agile implementation and 13 risks related to information security.”
    • Also stated in: § 4. Conclusion · hedged
      “As indicated by the most common way of distinguishing and surveying the risks of SIREV, we can infer that 24 risks were recognized, comprising 11 risks connected with agile implementation and 13 risks connected with information security.”
    Quote in the paperSubstantial claim
    • Rests on an assumption: The set of risks identified from previous studies and ISO 27005 is comprehensive enough to cover all relevant risks for the SiREV project.
  • It may state two separate claims as one. 4

  • It may state two separate claims as one.

    Findingreasoning

    The 13 risks that need to be handled consist of 5 risks related to agile implementation and 8 risks related to information security.

    “These risks consist of 5 risks related to agile implementation and 8 risks related to information security.”
    • Also stated in: § R3 12 · plain
      “These risks consist of 5 risks related to agile implementation and 8 risks related to information security.”
    Quote in the paperNot a substantial claim
    • Rests on an assumption: The risk appetite criteria from XYZ Agency Regulation No. 6 year 2017 are appropriate for evaluating the SiREV project's risks.

  • It may state two separate claims as one.

    Findingown data

    Of the 24 identified risks, 13 need to be handled because they are outside XYZ Agency's risk appetite, while the other 11 do not need to be handled because they are within the organization's risk appetite.

    “After doing risk evaluation from these 24 risks, 13 risks need to be handled because they are outside the organization's risk appetite, while the other 11 risks do not need to be handled because they are within the organization's risk appetite.”
    • Also stated in: § 3.3. Risk Treatment · plain
      “According to the results of the risk evaluation of these 24 risks, 13 risks need to be handled because they are outside the organization's risk appetite, while the other 11 risks do not need to be handled because they are within the organization's risk appetite.”
    • Also stated in: § 4. Conclusion · hedged
      “The results of the risk assessment of these 24 risks indicate that 13 of them must be handled because they are outside the organization's risk appetite, while the remaining 11 risks are within the organization's risk appetite and need not be handled.”
    Quote in the paperSubstantial claim
    • Rests on an assumption: The risk appetite criteria from XYZ Agency Regulation No. 6 year 2017 are appropriate for evaluating the SiREV project's risks.

  • It may state two separate claims as one.

    Premisecitation

    ISO standards are already known and widely used in XYZ Agency, and XYZ Agency's guidelines for preparing risk management are based on ISO 31000.

    “The standard from ISO have already known and widely uses in XYZ Agency and guidelines for preparing risk management at XYZ Agency are based on ISO 31000.”
    Quote in the paperSubstantial claim0 of 1 sources checked
    • cites [9]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • It may state two separate claims as one.

    Premisecitation

    XYZ Agency Regulation No. 6 year 2017 defines impact and likelihood criteria, a risk matrix, and risk acceptance criteria used for risk evaluation.

    “In this regulation, XYZ Agency already defines impact and likelihood criteria as can be seen in Table 1 and Table 2, risk matrix in Table 3 and risk acceptance criteria in Table 4.”
    Quote in the paperSubstantial claim0 of 1 sources checked
    • cites XYZ Agency Regulation No. 6 year 2017

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

4 of 4

  • The paper relies on this without support.

    The set of risks identified from previous studies and ISO 27005 is comprehensive enough to cover all relevant risks for the SiREV project.

    “After we conclude all possibilities risks that are related to agile implementation then we confirm which risk is suitable and have already happened in the organization.”
    “Based on ISO 27005 and we conduct the same step as the previous section which is we confirm which of that risk that suitable and already happened in the organization.”

  • The paper relies on this without support.

    The risk appetite criteria from XYZ Agency Regulation No. 6 year 2017 are appropriate for evaluating the SiREV project's risks.

    “In terms of scope, context and criteria, because the research location is in XYZ Agency, there are already internal regulations from XYZ Agency related to risk management, namely XYZ Agency Regulation No. 6 year 2017.”
2 of 2

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

Each contradiction between two passages listed here was confirmed by an independent check.

  • R21 is rated Very high despite a High matrix classification

    Major

    R21 has likelihood 3 and impact 5. The risk matrix classifies that combination as H (High), but the risk assessment labels R21 Very high.

1 of 1

Citations

Cites

Flagged first, then by citations

Research works printed but not linked: 2

  1. Syihabuddin, A., Suryanto, Y., & Salman, M. (2019). Risk Management in Data Centers Using ISO 31000 Case Study: XYZ Agency. The 1st STEEEM 2019, 1(1), 341-352.
  2. Recker, J. (2021). Scientific research in information systems: a beginner's guide. Springer Nature.

Cited by

Sorted by citations

Related

Metadata

Authors
Sinulingga, R. M. A., Raharjo, T., & Trisnawaty, N. W.
Affiliations
University of Indonesia (ID)
ORCID
Venue
Jurnal Informatika Ekonomi Bisnis
Publisher
SAFE Network
Published
2024-12-31
Pages
815-821
ISSN
2714-8491 (ISSN-L)
DOI
10.37034/infeb.v6i4.1053
OpenAlex
W4405240340
Semantic Scholar
4808fd6b01b0affbf68ce75ca17d3c7a99900921
Cited by
6
References
11
Citations by year
2026: 2 · 2025: 4
FWCI
1.57
Type
journal article
Language
en
Open access
Licence
Locations
Jurnal Informatika Ekonomi Bisnis (publishedVersion, cc-by)
Topics
  • Physical Sciences › Computer Science › Information Systems › Software Engineering Techniques and Practices
  • Social Sciences › Business, Management and Accounting › Strategy and Management › Quality and Management Systems
  • Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
Keywords
risk management, agile software development, ISO 31000, ISO/IEC 27005, information security, risk assessment, risk appetite, e-government

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

A language model drew the claims from the paper on 2026-11-07, under version 3 of the claim definition (model deepseek-v4.1-flash, prompt extract-v3).

A second model labelled each claim on 2026-11-07 (model jev-1.13-20260917, definition revision gold-guideline-v0.2).

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review