CoChat
Sign Up
Cited by 0Information and Cyber SecurityQuality and Management SystemsDecision Support System Applications

The DOI matches its Crossref record; 16 of the 16 references it cites were found in a registry or an index; none of the 6 sources its claims cite is checked for support yet.

Information System Risk Assessment on Website Jogja Smart Service using ISO 31000

Open access
Muharam, Herdian Aziz Qurnia, Riadi, Imam·2024·International Journal of Computer Applications
DOI 10.5120/ijca2024924043
Open this paper in CoChat — free account

Abstract

Aspects of life in the current era are greatly influenced by information technology.Among others, the Yogyakarta City Information and Coding Communication Service.The information system owned is a website that functions as an online city hall, the name of the website is Jogja Smart Service (JSS).Information technology cannot be separated from the possibility of a risk emerging in the future which could hamper the website.for example, server down and unstable internet.This research aims to determine the emergence of possibilities and prevention of risks on the Jogja Smart Service (JSS) website.This research uses the ISO 31000 method.An international standard that implements risk management.Risk assessment using ISO 31000 has 5 main stages, namely communication and consultation, establishing context, risk assessment (risk identification, risk analysis, risk evaluation), risk treatment and recording and reporting.This research produced 8 possible risks, of which 3 risks were at the low level, and 5 risks were at the medium level, but the risk treatment was different, namely 7 risks received reduction treatment, then 1 risk received transfer treatment.The results of the risk assessment evaluation that has been carried out can be used as a basis for handling and maintaining information technology and can reduce losses in terms of material or data in the future.

Overview

AI snapshot

Written from the paper’s full text.

TL;DR

This paper applies ISO 31000 risk management to the Jogja Smart Service (JSS) website to identify, analyze, evaluate, and treat information-system risks. It reports 8 possible risks, with 3 at low level and 5 at medium level, and recommends 7 reduction treatments and 1 transfer treatment.

Key findings

  • The assessment identified 8 possible risks across nature/environment, human, and systems/infrastructure sources: A.01 Earthquake, M.01 Abuse of access rights or user ID, M.02 Human error, M.03 Cybercrime, M.04 Data leak, SI.01 System bugs, SI.02 Server down, and SI.03 Data backup failure.
  • Risk levels were 3 low and 5 medium: A.01 Medium (5), M.01 Medium (6), M.02 Low (4), M.03 Medium (6), M.04 Low (4), SI.01 Medium (6), SI.02 Low (3), and SI.03 Medium (6).
  • Risk treatment mapping assigned 7 risks to reduction and 1 risk to transfer: A.01 Earthquake was transfer, while M.01, M.02, M.03, M.04, SI.01, SI.02, and SI.03 were reduction.
  • Example treatments include backup hardware/servers/networks in different locations for A.01, stronger username/password combinations for M.01, SOP-based system handling and regular evaluation for M.02, high-security software for M.03, data-security training for M.04, reporting to programmers for SI.01, load balancing for SI.02, and backup verification for SI.03.

Methods

  • The study uses ISO 31000 risk management on the JSS website, covering communication and consultation, establishing context, risk assessment, risk treatment, monitoring and review, and recording and reporting.
  • Data were collected through literature review, observation, interviews, and questionnaires with JSS website managers; a Likert scale from 1 to 5 was used, and risk variables were validated by one main informant and one supporting informant.
  • Risk analysis used a qualitative approach with key informants, combining likelihood and impact values into a consequence/probability matrix to rank risks from highest to lowest.

Limitations

  • The paper does not state a limitations section; no explicit limitations are given in the text.
  • Evident from the text: the questionnaire validation relied on only one main informant and one supporting informant, which limits generalizability and may introduce subjectivity.
  • Evident from the text: the risk treatment table uses inconsistent risk IDs relative to the earlier identification table (e.g., M.05/M.06 and SI.04/SI.05 appear in Table 9 while earlier tables use M.03/M.04 and SI.02/SI.03), and the study is a single-case assessment of the JSS website.

Model-written summary. Check it against the paper before relying on it.

Integrity signals

Registry

Crossref · 10.5120/ijca2024924043

Cites

16 of 16 references verified0 citation errors · 0 not checkable

Statistics

Nothing to recompute.

Verification

Claims the paper makes

0 of 6 cited sources checked · 0 supported · 0 flagged

  • Findingown data

    The Earthquake risk (A.01) on the JSS website is assigned to the transfer risk treatment category.

    “There is 1 risk in the transfer category, namely A.01, where risk sharing will be carried out with other parties in order to reduce the impact experienced.”
    Quote in the paperNot a substantial claim
    • Rests on an assumption: The information provided by key informants and the project manager accurately reflects the actual conditions and risks of the JSS website.
    • Rests on an assumption: The ISO 31000 likelihood and impact criteria are appropriate for assessing risks on the JSS website.
  • Findingown data

    The Abuse of access rights or user ID risk (M.01) on the JSS website has a Medium risk level with score 6.

    “M.01 Abuse of access rights or user ID 2 3 Medium (6)”
    Quote in the paperNot a substantial claim
    • Rests on an assumption: The information provided by key informants and the project manager accurately reflects the actual conditions and risks of the JSS website.
    • Rests on an assumption: The ISO 31000 likelihood and impact criteria are appropriate for assessing risks on the JSS website.
  • Findingown data

    The Server down risk (SI.02) on the JSS website has a Low risk level with score 3.

    “SI.02 Server down 1 3 Low (3)”
    Quote in the paperNot a substantial claim
    • Rests on an assumption: The information provided by key informants and the project manager accurately reflects the actual conditions and risks of the JSS website.
    • Rests on an assumption: The ISO 31000 likelihood and impact criteria are appropriate for assessing risks on the JSS website.
  • Findingown data

    The Data backup failure risk (SI.03) on the JSS website has a Medium risk level with score 6.

    “SI.03 Data backup failure 2 3 Medium (6)”
    Quote in the paperNot a substantial claim
    • Rests on an assumption: The information provided by key informants and the project manager accurately reflects the actual conditions and risks of the JSS website.
    • Rests on an assumption: The ISO 31000 likelihood and impact criteria are appropriate for assessing risks on the JSS website.
  • Findingown data

    The risks M.02, M.04, M.01, M.03, SI.01, SI.02, and SI.03 on the JSS website are assigned to the reduction risk treatment category.

    “there are 7 risks M.02, M.04, M.01, M.03, SI.01, SI. 02, SI.03 which is in the reduction category”
    Quote in the paperSubstantial claim
    • Rests on an assumption: The information provided by key informants and the project manager accurately reflects the actual conditions and risks of the JSS website.
    • Rests on an assumption: The ISO 31000 likelihood and impact criteria are appropriate for assessing risks on the JSS website.
  • It may state two separate claims as one. 9
  • Probably not a substantial claim. 12

  • It may state two separate claims as one.

    Findingown data

    The risk treatment mapping for the JSS website assigned 7 risks to reduction and 1 risk to transfer.

    “This research produced 8 possible risks, of which 3 risks were at the low level, and 5 risks were at the medium level, but the risk treatment was different, namely 7 risks received reduction treatment, then 1 risk received transfer treatment.”
    • Also stated in: § 4.4 Risk Evaluation · plain
      “It can be seen in Table 8 which shows that there are 7 risks M.02, M.04, M.01, M.03, SI.01, SI. 02, SI.03 which is in the reduction category”
    Quote in the paperSubstantial claim
    • Rests on an assumption: The information provided by key informants and the project manager accurately reflects the actual conditions and risks of the JSS website.
    • Rests on an assumption: The ISO 31000 likelihood and impact criteria are appropriate for assessing risks on the JSS website.

  • It may state two separate claims as one.

    Findingown data

    Of the 8 identified risks on the JSS website, 3 are at the low level and 5 are at the medium level.

    “This research produced 8 possible risks, of which 3 risks were at the low level, and 5 risks were at the medium level, but the risk treatment was different, namely 7 risks received reduction treatment, then 1 risk received transfer treatment.”
    • Also stated in: § 4.4 Risk Evaluation · plain
      “Table 7 shows the results of the risk assessment by the informant which contains a risk level at a low level with a total of 3 possible risks and the remaining 5 possible risks are at a medium level”
    Quote in the paperSubstantial claim
    • Rests on an assumption: The information provided by key informants and the project manager accurately reflects the actual conditions and risks of the JSS website.
    • Rests on an assumption: The ISO 31000 likelihood and impact criteria are appropriate for assessing risks on the JSS website.

  • Probably not a substantial claim. It may state two separate claims as one.

    Findingown data

    According to the project manager, current conditions on the JSS website have problems including users not being familiar with JSS and system bugs that disrupt business processes when scanning KTP and facial verification.

    “Current conditions on the Jogja Smart Service (JSS) website have several problems, including users not being familiar with Jogja Smart Service (JSS), then there are system bugs that disrupt the website's business processes in the form of bugs when they want to scan.”
    Quote in the paperSubstantial claim
    • Rests on an assumption: The information provided by key informants and the project manager accurately reflects the actual conditions and risks of the JSS website.

  • Probably not a substantial claim. It may state two separate claims as one.

    Findingreasoning

    According to the project manager, increasing user traffic on the JSS website makes server down possible, which could hamper or stop website performance.

    “then user traffic from this website increases and becomes denser, so it is possible that there will be a server down which will hamper or stop the performance of the website.”
    Quote in the paperSubstantial claim
    • Rests on an assumption: The information provided by key informants and the project manager accurately reflects the actual conditions and risks of the JSS website.

  • Probably not a substantial claim. The paper’s conclusions may not depend on it.

    Premisecitation

    The aim of ISO 31000 is to create an international standard for implementing risk management that can be used by various types of organizations, from small to large scale, to deal with various kinds of risks related to organizational business processes.

    “The aim of ISO 31000 itself is to create an international standard for implementing risk management that can be used by various types of organizations, from small to large scale, to deal with various kinds of risks related to organizational business processes.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [11]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • It may state two separate claims as one.

    Study design and conductown data

    The possible risks were extracted from key informants and interviews, then combined with self-assessment results.

    “The results of possible risks come from extracting information from key informants and also interviews, which are then combined with the results of self-assessment which will enrich the results of possible risks.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim.

    Study design and conductown data

    The risk analysis stage was carried out using a qualitative approach with key informants to obtain values or information about the identified risk levels.

    “This risk analysis stage is carried out by taking a qualitative approach with key informants to obtain values or information from the level of risk that has been identified in the previous stage.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim. It may be too vague to check against evidence. The paper’s conclusions may not depend on it. It may state two separate claims as one.

    Premisecitation

    Risk is an uncertainty and has a negative impact on an organization's goals that it wants to achieve.

    “Risk is an uncertainty and has a negative impact on an organization's goals that it wants to achieve [16].”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [16]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Probably not a substantial claim.

    Study design and conductown data

    The risk variables were validated by the main informant by combining probability and consequence values to determine the risk level and priorities.

    “The risk variables that have been created are then validated by the main informant by combining probability and consequence values to determine the level of risk which will be categorized at various levels to determine risk priorities.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim.

    Study design and conductnone given

    The questionnaire containing all possible risk variables was validated by one main informant and one supporting informant to obtain probability and impact values.

    “When filling in the questionnaire containing all possible risk variables, it is validated by one main informant and one supporting informant in order to obtain the probability and impact values.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim. It may be too vague to check against evidence. It may state two separate claims as one.

    Interpretationown data

    The results of the JSS website risk assessment evaluation can be used as a basis for handling and maintaining information technology and can reduce losses in terms of material or data in the future.

    “The results of the risk assessment evaluation that has been carried out can be used as a basis for handling and maintaining information technology and can reduce losses in terms of material or data in the future.”
    Quote in the paperNot a substantial claim
    • Rests on an assumption: Implementing the recommended risk treatments will reduce the identified risks or losses on the JSS website.

  • Probably not a substantial claim. It may state two separate claims as one.

    Premisecitation

    When a website is not managed properly, it will have possible risks that can threaten the continuity of the website's performance or business processes, so risk management analysis is needed.

    “When a website is not managed properly, it will have possible risks that can threaten the continuity of the website's performance or the business processes within it, so risk management analysis is needed [16].”
    Quote in the paperSubstantial claim0 of 1 sources checked
    • cites [16]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Probably not a substantial claim. The paper’s conclusions may not depend on it. It may state two separate claims as one.

    Premisecitation

    ISO 31000 risk management has 6 main processes that are continuous with each other.

    “ISO 31000 risk management has 6 main processes that are continuous with each other as shown in Figure 1 [11].”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [11]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Probably not a substantial claim. The paper’s conclusions may not depend on it.

    Premisecitation

    The principles of ISO 31000 aim to provide generic principles and guidelines that can be used by all types of companies, from small to large scale, to deal with various kinds of risks that will arise in the future.

    “The principles of ISO 31000 aim to provide principles and guidelines that have a generic nature, which can be used by all types of companies, from small to large scale in an effort to deal with various kinds of risks that will arise in the future [ 11].”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [11]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Probably not a substantial claim.

    Premisecitation

    ISO 31000 is an international standard that implements risk management.

    “The International Organization for Standardization (ISO) 31000 is an international standard that implements risk management.”
    Quote in the paperSubstantial claim0 of 1 sources checked
    • cites [11]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

15 of 15

  • The paper relies on this without support.

    The information provided by key informants and the project manager accurately reflects the actual conditions and risks of the JSS website.

    “The results of possible risks come from extracting information from key informants and also interviews, which are then combined with the results of self-assessment which will enrich the results of possible risks.”
    “Current conditions on the Jogja Smart Service (JSS) website have several problems, including users not being familiar with Jogja Smart Service (JSS), then there are system bugs that disrupt the website's business processes in the form of bugs when they want to scan.”

  • The paper relies on this without support.

    The risk identification process captured all relevant risks to the JSS website.

    “resulting in 8 possible risks in terms of nature and environment, humans and systems and infrastructure.”
    “The results of possible risks come from extracting information from key informants and also interviews, which are then combined with the results of self-assessment which will enrich the results of possible risks.”

  • The paper relies on this without support.

    The ISO 31000 likelihood and impact criteria are appropriate for assessing risks on the JSS website.

    “Assessment indicators based on frequency of occurrence and their descriptions can be seen in Tables 4 and 5.”
    “In Table 4, the likelihood value criteria based on the probability matrix explain a probability in qualitative form regarding the estimated frequency of risk events in a certain time period.”

  • The paper relies on this without support.

    Implementing the recommended risk treatments will reduce the identified risks or losses on the JSS website.

    “The results of the risk assessment evaluation that has been carried out can be used as a basis for handling and maintaining information technology and can reduce losses in terms of material or data in the future.”
4 of 4

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

Each contradiction between two passages listed here was confirmed by an independent check.

  • Server down is missing from the evaluation matrix

    Minor

    Table 6 lists A.01 at likelihood 1 but omits SI.02, which Table 7 assigns likelihood 1 and impact 3.

  • Data leak has two risk IDs

    Minor

    Table 9 labels data leak M.06, while Table 7 labels it M.04.

  • Data backup failure has two risk IDs

    Minor

    Table 9 labels data backup failure SI.05, while Table 7 labels it SI.03.

  • Server down is missing from the treatment mapping

    Minor

    Table 8 omits SI.02 from its mapping, although the text immediately afterward includes it among the seven risks assigned reduction treatment.

  • Cybercrime has two risk IDs

    Minor

    Table 9 labels cybercrime M.05, while Table 7 labels it M.03.

  • Server down has two risk IDs

    Minor

    Table 9 labels server down SI.04, while Table 7 labels it SI.02.

6 of 6

Citations

Cites

Flagged first, then by citations

Research works printed but not linked: 4

  1. Pamungkas, G., Bagas, M., & Atmojo, T. (2021). Analisis Manajemen Risiko Teknologi Informasi pada Website UMKM XYZ berdasarkan Framework ISO 31000. 4(1), 12-17.
  2. Pebriani, O. D., Zulfikar, D. H., Kom, S., Cs, M., Islam, U., Raden, N., & Palembang, F. (n.d.). SNESTIK Seminar Nasional Teknik Elektro, Sistem Informasi, dan Teknik Informatika Analisis Manajemen Risiko Teknologi Informasi Menggunakan ISO 31000 Pada Website SIMPEG di Kantor Kementerian Agama Kota Palembang. https://doi.org/10.31284/p.snestik.2022.2716 · DOI
  3. Putri, A. A., & Irnanda, D. I. (n.d.). Volume 4 issue 1 1 Aisyah Journal of Informatics and Electrical Engineering Analisis Risiko Teknologi Informasi Menggunakan ISO 31000 (Studi Kasus : Aplikasi J&T Express Indonesia). http://jti.aisyahuniversity.ac.id/index.php/AJIEE
  4. Sitorus, J. H. P., & Sakban, M. (2021). Perancangan Sistem Informasi Penjualan Berbasis Web Pada Toko Mandiri 88 Pematangsiantar. Jurnal Bisantara Informatika (JBI), 5(2), 1-13.

Cited by

Still being checked.

Related

Metadata

Authors
Muharam, H. A. Q., & Riadi, I.
Affiliations
Universitas Ahmad Dahlan (ID)
ORCID
Riadi, Imam
Venue
International Journal of Computer Applications
Publisher
Foundation of Computer Science
Published
2024-09-30
Volume
186
Issue
43
Pages
15-20
ISSN
0975-8887 (ISSN-L)
DOI
10.5120/ijca2024924043
OpenAlex
W4403074653
Semantic Scholar
4a4852a4abeadc9d1f70490602d245b966fb0bbd
Cited by
0
References
12
FWCI
0.00
Type
journal article
Language
en
Open access
Locations
International Journal of Computer Applications (publishedVersion)
Topics
  • Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
  • Social Sciences › Business, Management and Accounting › Strategy and Management › Quality and Management Systems
  • Social Sciences › Business, Management and Accounting › Management Information Systems › Decision Support System Applications
Keywords
ISO 31000, risk management, e-government, risk identification, risk response, risk transfer, server downtime

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

A language model drew the claims from the paper on 2026-11-07, under version 3 of the claim definition (model deepseek-v4.1-flash, prompt extract-v3).

A second model labelled each claim on 2026-11-07 (model jev-1.13-20260917, definition revision gold-guideline-v0.2).

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review