The DOI matches its Crossref record; 6 of the 6 references it cites were found in a registry or an index; 13 of the 23 sources its claims cite were checked for support.
Comprehensive Cybersecurity Framework for Digital Governance: Threat Assessment, Risk Mitigation, and Regulatory Compliance in Indonesia
Open accessAbstract
Digital transformation of government administration brings significant benefits in improving public service efficiency and citizen access to information. However, digitalization also opens opportunities for increasingly complex and organized cyber threats. This journal explores a comprehensive cybersecurity framework for digital governance through an extensive literature review that includes threat assessment, risk mitigation strategies, and regulatory compliance analysis. This research analyzes international frameworks (NIST CSF 2.0, ISO/IEC 27001:2022, COBIT 2019), Indonesian national standards (Law No. 1 of 2024 on Information and Electronic Transactions, SPBE, BSSN), and best practices in incident response and Zero Trust Architecture. Results demonstrate that government cybersecurity requires a holistic approach integrating technical aspects, policy, human resources, and governance. This journal recommends implementing a comprehensive cybersecurity framework, enhancing human capital capacity, adopting cutting-edge technology, and fostering inter-institutional coordination to build sustainable cybersecurity resilience for government entities.
Overview
AI snapshot
Written from the paper’s full text.
TL;DR
This paper is a systematic literature review proposing a five-pillar cybersecurity framework for Indonesian digital government, integrating NIST CSF 2.0, ISO/IEC 27001:2022, and COBIT 2019 with Indonesian regulations (ITE Law 1/2024, SPBE, BSSN instruments). It argues that government cybersecurity requires a holistic combination of technical controls, governance, organizational coordination, human capital, and incident response, illustrated by the June 2024 National Data Center ransomware incident.
Key findings
- The June 20, 2024 LockBit 3.0 ransomware attack on the National Data Center (PDN) paralyzed at least 210 central and local government institutions, with particular impact on immigration services at international airports; investigation found some tenants lacked backup data separation from primary systems, and Windows Defender disabling failed to trigger immediate alerts.
- Gap analysis found international framework adoption is early-stage with significant inter-agency variation: many SPBE institutions have not reached maturity level 3+ in NIST CSF implementation, centralized threat-intelligence sharing and incident response coordination are lacking, and security audits often focus on compliance checklists rather than operational effectiveness.
- The proposed framework rests on 5 integrated pillars (technical security; governance and policies; organizational structure and coordination; human capital development; incident response and crisis management), with a roadmap spanning short-term (1–2 years), medium-term (2–5 years), and long-term (5+ years) horizons.
- Risk mitigation is mapped to five threat types with priority ratings: APT (CRITICAL), ransomware (CRITICAL), phishing/social engineering (HIGH), supply chain compromise (HIGH), and insider threats (MEDIUM-HIGH).
Methods
- Systematic literature review; sources drawn from peer-reviewed journals indexed in SINTA, Scopus, and academic databases (emphasizing 2023–2025 publications), official Indonesian government publications, international organization publications, and threat intelligence reports.
- Sources were analyzed against a framework incorporating technical, organizational, human, and legal/regulatory dimensions; international best practices were mapped to Indonesian regulations via mapping and gap analysis with attention to SPBE-specific context.
- Findings were validated by cross-referencing a minimum of 15+ primary sources, with attention to incident data verification, framework specification validation, regulation confirmation, and threat intelligence corroboration.
Limitations
- Not stated in the paper: the text does not include an explicit limitations section or discussion of the review's own constraints.
- Evident from the text: the study is a literature review with no primary empirical data, survey, or case-study fieldwork, so the maturity and gap findings (e.g., "many SPBE institutions have not achieved maturity level 3+") are asserted without reported measurement methodology or sample.
- Evident from the text: the search strategy is described only in general terms — no databases-by-name, search strings, inclusion/exclusion criteria, or source counts beyond "15+ primary sources" — and the roadmap's budget estimates (e.g., Rp 5–10B, Rp 2–5B) are presented without a stated derivation basis.
Model-written summary. Check it against the paper before relying on it.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
10 Sources not found · 8 Partly supported · 8 No basis given · 6 Own interpretation · 3 Couldn’t confirm · 2 Supported · 2 Not checked yet · 1 Own method · accuracy not yet measured
The cited sources that could be checked couldn’t confirm or dispute this claim.
In the paper
“Geopolitical motivation drives APT activities with strategic intelligence gathering objectives (Carello et al., 2023).”
§ Comprehensive Cybersecurity Framework for Digital Governance: Threat Assessment, Risk Mitigation, and Regulatory Compliance in Indonesia > Threat Assessment Against Indonesian Digital Government
What the sources say
- Could not verifycites Carello et al., 2023 sourceExperimental — accuracy not yet measured
The Introduction and Conclusions describe a systematization of healthcare cybersecurity regulations and controls, not the motives or objectives of APT activity. Searches for APTs, geopolitical motivation, and strategic intelligence gathering found no passage addressing the claim. (LLM, conf=0.75)
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
- Could not verify
The cited sources that could be checked couldn’t confirm or dispute this claim.
In the paper
“Security audits often focus on compliance checklists rather than operational effectiveness (Carello et al., 2023).”
§ Comprehensive Cybersecurity Framework for Digital Governance: Threat Assessment, Risk Mitigation, and Regulatory Compliance in Indonesia > Gap Analysis Between International Frameworks and National Regulations
What the sources say
- Could not verifycites Carello et al., 2023 sourceExperimental — accuracy not yet measured
The Cybersecurity Topics Coverage section says assurance, audit, and certification are the least-addressed topics in the documents studied. The Introduction and Conclusions discuss gaps in technical controls, but none of these passages describes what security audits often focus on. Searches for audit checklists and operational effectiveness found no passage addressing that comparison. (LLM, conf=0.76)
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
- Could not verify
Every source the paper cites for this claim was checked and supports it.
In the paper
“International cooperation models like the Indonesia-Australia Cyber Policy Dialogue demonstrate effective approaches to knowledge transfer and capacity building (Shiddique & Juned, 2023).”
§ Comprehensive Cybersecurity Framework for Digital Governance: Threat Assessment, Risk Mitigation, and Regulatory Compliance in Indonesia > Best Practices from Other Jurisdictions
What the sources say
- Supportedcites Shiddique & Juned, 2023 source
The Conclusion reports that the dialogue’s capacity-building activities increased BSSN’s knowledge through visits, boot camps, and webinars. The Introduction also describes planned programs to strengthen cybersecurity skills and knowledge. Together, these support the dialogue as an example of knowledge transfer and capacity building. (LLM, conf=0.90)
boosteddirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
- Supported
The cited sources that could be checked couldn’t confirm or dispute this claim.
In the paper
“These obstacles particularly impact developing economies with limited cybersecurity infrastructure investment (Asyrofi & Nugraha, 2025).”
§ Comprehensive Cybersecurity Framework for Digital Governance: Threat Assessment, Risk Mitigation, and Regulatory Compliance in Indonesia > Implementation Challenges
What the sources say
- Could not verifycites Asyrofi & Nugraha, 2025 sourceExperimental — accuracy not yet measured
The Introduction and §5.2 discuss cybersecurity obstacles for government work-from-anywhere policies, but do not compare their impact across economies. Searches for developing economies, resource constraints, and cybersecurity infrastructure investment found no passage addressing the claimed particular impact. (LLM, conf=0.72)
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
- Could not verify
The cited sources support only part of this claim — read each source’s verdict below.
In the paper
“Resource constraints and skills shortages create implementation bottlenecks (Asyrofi & Nugraha, 2025).”
§ Comprehensive Cybersecurity Framework for Digital Governance: Threat Assessment, Risk Mitigation, and Regulatory Compliance in Indonesia > Gap Analysis Between International Frameworks and National Regulations
What the sources say
- Partly supportedcites Asyrofi & Nugraha, 2025 sourceExperimental — accuracy not yet measured
Section 5.2 says low awareness and resistance to security protocols can impede implementation of security measures, and Section 4.2.1 identifies digital-literacy gaps among civil servants. These passages support a skills-related implementation obstacle, but our copy does not identify resource constraints as a bottleneck. (LLM, conf=0.83)
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
- Partly supported
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Many SPBE institutions have not achieved maturity level 3+ in NIST CSF implementation.”
§ Comprehensive Cybersecurity Framework for Digital Governance: Threat Assessment, Risk Mitigation, and Regulatory Compliance in Indonesia > Gap Analysis Between International Frameworks and National Regulations
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: unclear — It is unclear why the paper says it holds.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Multi-vector attack approaches combine spear-phishing, malware deployment, and supply chain compromise.”
§ Comprehensive Cybersecurity Framework for Digital Governance: Threat Assessment, Risk Mitigation, and Regulatory Compliance in Indonesia > Threat Assessment Against Indonesian Digital Government
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: unclear — It is unclear why the paper says it holds.
In the paper
“Supply chain vulnerabilities in IT vendor software and services provide attackers widespread impact potential through compromised upstream providers (Tempo.co,2024).”
§ Comprehensive Cybersecurity Framework for Digital Governance: Threat Assessment, Risk Mitigation, and Regulatory Compliance in Indonesia > Threat Assessment Against Indonesian Digital Government
What the sources say
- Not matchedcites Tempo.co,2024
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
- Not matched
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Organizational readiness for cybersecurity maturity depends substantially on the quality and depth of human resource capabilities.”
§ Comprehensive Cybersecurity Framework for Digital Governance: Threat Assessment, Risk Mitigation, and Regulatory Compliance in Indonesia > Pillar 4: Human Capital Development
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: unclear — It is unclear why the paper says it holds.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Article 16B of ITE Law 1/2024 introduces tiered administrative sanctions against Electronic System Operators violating security obligations, including written warnings, administrative fines, temporary service suspension, and permanent access termination.”
§ Comprehensive Cybersecurity Framework for Digital Governance: Threat Assessment, Risk Mitigation, and Regulatory Compliance in Indonesia > Recommendations
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
In the paper
“However, this standard became mandatory SNI (National Standard) for SPBE since 2024 under BSSN Regulation No. 7 of 2024, indicating government commitment to certified international standardization (Badan Siber dan Sandi Negara, 2024).”
§ Comprehensive Cybersecurity Framework for Digital Governance: Threat Assessment, Risk Mitigation, and Regulatory Compliance in Indonesia > Recommendations
What the sources say
- Not matchedcites Badan Siber dan Sandi Negara, 2024
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
- Not matched
- Probably not a substantial claim. 22
- It may state two separate claims as one. 17
The cited sources support only part of this claim — read each source’s verdict below.
In the paper
“Emerging technologies offer cybersecurity posture enhancement opportunities including Artificial Intelligence and Machine Learning for threat detection automation, Quantum Computing era preparation, Blockchain for critical infrastructure security, and Cloud Computing with security provisions (Carello et al., 2023).”
§ Comprehensive Cybersecurity Framework for Digital Governance: Threat Assessment, Risk Mitigation, and Regulatory Compliance in Indonesia > Emerging Technologies and Opportunities
What the sources say
- Partly supportedcites Carello et al., 2023 sourceExperimental — accuracy not yet measured
The Introduction describes standards and best practices intended to improve healthcare organizations’ cybersecurity preparedness, and the References list guidance on cloud security for healthcare services and security considerations for cloud computing. Our copy does not describe AI or machine learning for automated threat detection, quantum-era preparation, or blockchain for critical-infrastructure security as opportunities. (LLM, conf=0.77)
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. It may state two separate claims as one.
- Partly supported
The cited sources support only part of this claim — read each source’s verdict below.
In the paper
“Good cybersecurity governance requires implementing five integrated principles addressing accountability through clear expectations, transparency through stakeholder information access, rule of law through consistent enforcement, democratic control through parliamentary oversight, and effectiveness through achieving security objectives (Savaş & Karataş, 2022).”
§ Comprehensive Cybersecurity Framework for Digital Governance: Threat Assessment, Risk Mitigation, and Regulatory Compliance in Indonesia > Additional information
What the sources say
- Partly supportedcites Savaş & Karataş, 2022 sourceExperimental — accuracy not yet measured
Section 2.4 defines cyber governance in terms of participation, transparency, accountability, and interlocking laws and standards. The section labeled K also discusses good cyber governance and strengthening the rule of law. Our copy does not present these as five integrated principles or specify clear expectations, stakeholder information access, consistent enforcement, parliamentary oversight, or achievement of security objectives as the cited sentence does (page numbers unavailable). (LLM, conf=0.85)
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
- Partly supported
The cited sources support only part of this claim — read each source’s verdict below.
In the paper
“Research demonstrates that cybersecurity failures can simultaneously disrupt critical service delivery, compromise citizen privacy, create financial losses, erode public trust, and impact national security (Savaş & Karataş, 2022).”
§ Comprehensive Cybersecurity Framework for Digital Governance: Threat Assessment, Risk Mitigation, and Regulatory Compliance in Indonesia > Impact of Threats on Public Services
What the sources say
- Partly supportedcites Savaş & Karataş, 2022 sourceExperimental — accuracy not yet measured
Section 2.2, “Cybersecurity” (page unavailable), says cybersecurity failures can compromise personal privacy and data, while section K discusses cyber events in relation to national security policy. The paper does not establish that attacks on government simultaneously disrupt critical service delivery, cause financial losses, and erode public trust; its discussion of company operability and cybersecurity spending does not establish those effects. (LLM, conf=0.85)
boosteddirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
- Partly supported
The cited sources support only part of this claim — read each source’s verdict below.
In the paper
“The Indonesia-Australia Cyber Policy Dialogue (2018-2020) demonstrates the importance of international cooperation in capacity building, with BSSN playing a central role in identifying and developing cybersecurity expertise among government personnel (Shiddique & Juned, 2023).”
§ Comprehensive Cybersecurity Framework for Digital Governance: Threat Assessment, Risk Mitigation, and Regulatory Compliance in Indonesia > Risk Identification and Assessment
What the sources say
- Partly supportedcites Shiddique & Juned, 2023 sourceExperimental — accuracy not yet measured
Split into 2 atoms — 0 confirmed, 2 partially supported, 0 disputed, 0 misattributed, 0 unverifiable. Expand the claim to see per-atom verdicts.
boosteddirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
- Partly supported
The cited sources support only part of this claim — read each source’s verdict below.
In the paper
“Systematization of cybersecurity regulations demonstrates that comprehensive frameworks must address multiple dimensions: asset identification, threat assessment, vulnerability analysis, and risk calculation using Likelihood × Impact matrices (Carello et al., 2023).”
§ Comprehensive Cybersecurity Framework for Digital Governance: Threat Assessment, Risk Mitigation, and Regulatory Compliance in Indonesia > Risk Identification and Assessment
What the sources say
- Partly supportedcites Carello et al., 2023 sourceExperimental — accuracy not yet measured
The Documents Mapping section (3.3; page unavailable) maps healthcare security controls across multiple NIST functions and includes asset management and risk assessment categories. The Cybersecurity Topics Coverage section also evaluates coverage across several security topics. But the paper does not specify the claimed sequence of threat assessment and vulnerability analysis or risk calculation using Likelihood × Impact matrices. (LLM, conf=0.84)
boosted- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. It may state two separate claims as one.
- Partly supported
The cited sources support only part of this claim — read each source’s verdict below.
In the paper
“Research demonstrates that such integrated approaches combining technology, human resources, governance, and transparent communication allow public administration to transform cybersecurity from challenge into strategic advantage (Savaş & Karataş, 2022).”
§ Comprehensive Cybersecurity Framework for Digital Governance: Threat Assessment, Risk Mitigation, and Regulatory Compliance in Indonesia > Comprehensive Cybersecurity Framework Recommendations
What the sources say
- Partly supportedcites Savaş & Karataş, 2022 sourceExperimental — accuracy not yet measured
The paper discusses cybersecurity as a combination of technology, human participation, and governance; §2.3 identifies transparency as a feature of governance, and the Introduction identifies ineffective communication among stakeholders as a problem. It also says that challenges with technical, social, and other dimensions can be addressed by handling those dimensions together. Our copy does not establish that this approach turns cybersecurity into a strategic advantage for public administration. (LLM, conf=0.85)
boosteddirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim.
- Partly supported
Every source the paper cites for this claim was checked and supports it.
In the paper
“Research on cybersecurity challenges in remote work environments highlights that Presidential Regulation No. 21 of 2023 granting Indonesian civil servants location flexibility creates cybersecurity challenges requiring comprehensive framework development (Asyrofi & Nugraha, 2025).”
§ Comprehensive Cybersecurity Framework for Digital Governance: Threat Assessment, Risk Mitigation, and Regulatory Compliance in Indonesia > Recommendations
What the sources say
- Supportedcites Asyrofi & Nugraha, 2025 source
The Introduction says Presidential Regulation No. 21 of 2023 introduces flexible working arrangements for Indonesian civil servants and that implementing them creates emerging cybersecurity risks requiring clear frameworks. Section 5.2 calls for a cybersecurity framework specifically designed for work from anywhere in the government sector. (LLM, conf=0.92)
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim.
- Supported
The cited sources support only part of this claim — read each source’s verdict below.
In the paper
“Cybersecurity governance integration with digital transformation strategy is not merely technical imperative but central vector of state responsibility (Savaş & Karataş, 2022).”
§ Comprehensive Cybersecurity Framework for Digital Governance: Threat Assessment, Risk Mitigation, and Regulatory Compliance in Indonesia > 5. CONCLUSION AND RECOMMENDATIONS Conclusion
What the sources say
- Partly supportedcites Savaş & Karataş, 2022 sourceExperimental — accuracy not yet measured
The paper’s discussion of prior studies (section K; page unavailable) says cybersecurity strategies should be included in working strategies and describes a role for governments and state agencies in cyber governance. Its definition of cyber governance (section 2.4; page unavailable) also extends beyond technical measures to laws, accountability, and participation. But the copy does not specifically frame integration with a digital transformation strategy as a central responsibility of the state. (LLM, conf=0.83)
plain- Asserted: passes — The authors put it forward as true.
- Checkable: fails — It may be too vague to check against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. It may be too vague to check against evidence.
- Partly supported
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“International framework adoption remains early-stage with significant inter-agency variations.”
§ Comprehensive Cybersecurity Framework for Digital Governance: Threat Assessment, Risk Mitigation, and Regulatory Compliance in Indonesia > Gap Analysis Between International Frameworks and National Regulations
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
None of the sources cited for this claim have been checked yet.
In the paper
“Legacy systems modernization difficulty, budget constraints, skills shortage, complex change management, and vendor lock-in situations limit implementation progress.”
§ Comprehensive Cybersecurity Framework for Digital Governance: Threat Assessment, Risk Mitigation, and Regulatory Compliance in Indonesia > Implementation Challenges
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: unclear — It is unclear whether the paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“ITE Law 1/2024 regulates electronic transactions, illegal content distribution, data theft, system hacking, and citizen privacy protection with cybersecurity crime handling standards adapted to rapid field developments.”
§ Comprehensive Cybersecurity Framework for Digital Governance: Threat Assessment, Risk Mitigation, and Regulatory Compliance in Indonesia > Recommendations
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. It may state two separate claims as one.
In the paper
“SPBE, regulated under Presidential Regulation No. 95 of 2018, utilizes information and communication technology for government data management and services (Peraturan Presiden Nomor 95 Tahun 2018, 2018).”
§ Comprehensive Cybersecurity Framework for Digital Governance: Threat Assessment, Risk Mitigation, and Regulatory Compliance in Indonesia > Recommendations
What the sources say
- Not matchedcites Peraturan Presiden Nomor 95 Tahun 2018, 2018
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
- Not matched
In the paper
“Law No. 1 of 2024 on the Second Amendment to Law No. 11 of 2008 on Information and Electronic Transactions (ITE Law 1/2024) constitutes the foundation of Indonesian cybersecurity law (Undang-Undang Nomor 1 Tahun 2024, 2024).”
§ Comprehensive Cybersecurity Framework for Digital Governance: Threat Assessment, Risk Mitigation, and Regulatory Compliance in Indonesia > Recommendations
What the sources say
- Not matchedcites Undang-Undang Nomor 1 Tahun 2024, 2024
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim.
- Not matched
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Comprehensive cybersecurity framework for Indonesian digital government requires consolidating five fundamental dimensions.”
§ Comprehensive Cybersecurity Framework for Digital Governance: Threat Assessment, Risk Mitigation, and Regulatory Compliance in Indonesia > 5. CONCLUSION AND RECOMMENDATIONS Conclusion
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Periodic data backup provides critical control for ransomware resilience and business continuity.Best practices include 3-2-1 backup rule (3 copies using 2 media types with 1 offsite location), immutable backups preventing malware modification, and regular restoration testing ensuring recovery capability.”
§ Comprehensive Cybersecurity Framework for Digital Governance: Threat Assessment, Risk Mitigation, and Regulatory Compliance in Indonesia > Additional information
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. It may state two separate claims as one.
In the paper
“For SPBE sector, COBIT 2019 provides integrated processes with clear linkage to business objectives and stakeholder value (ISACA, 2020).”
§ Comprehensive Cybersecurity Framework for Digital Governance: Threat Assessment, Risk Mitigation, and Regulatory Compliance in Indonesia > Recommendations
What the sources say
- Not matchedcites ISACA, 2020
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
boostedcorrelational- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
- Not matched
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Implementing this framework will enhance Indonesian government cybersecurity resilience, protect sensitive citizen information, ensure public service continuity, and build public confidence in government digital transformation.”
§ Comprehensive Cybersecurity Framework for Digital Governance: Threat Assessment, Risk Mitigation, and Regulatory Compliance in Indonesia > 5. CONCLUSION AND RECOMMENDATIONS Conclusion
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: fails — It may be too vague to check against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. It may be too vague to check against evidence. The paper may give no reason why it holds. It may state two separate claims as one.
In the paper
“COBIT 2019 provides enterprise IT governance guidance for organizations with heterogeneous contexts and resource constraints (ISACA, 2019).”
§ Comprehensive Cybersecurity Framework for Digital Governance: Threat Assessment, Risk Mitigation, and Regulatory Compliance in Indonesia > Recommendations
What the sources say
- Not matchedcites ISACA, 2019
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
- Not matched
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Comprehensive Indonesian government cybersecurity framework based on 5 integrated pillars addresses technical controls, governance and policies, organizational structure and coordination, human capital development, and incident response and crisis management.”
§ Comprehensive Cybersecurity Framework for Digital Governance: Threat Assessment, Risk Mitigation, and Regulatory Compliance in Indonesia > Comprehensive Cybersecurity Framework Recommendations
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim.
- Rests on an assumption: Cyber threats against government infrastructure no longer originate solely from ordinary criminals but from organized Advanced Persistent Threat (APT) groups sponsored by nation-states with high technical capabilities.
- Rests on an assumption: In 2024, cybersecurity incidents in the Asia Pacific region reached unprecedented levels, with government institutions facing sophisticated multi-vector attacks combining spear-phishing, malware deployment, and supply chain compromise techniques.
- Rests on an assumption: APT represents the most serious threat to government sectors.
- Rests on an assumption: APT groups are state-sponsored cyber actors possessing high technical capabilities, unlimited financial resources, and long-term objectives to gain access to government systems and critical infrastructure.
- Rests on an assumption: APT activities targeting government sectors in Southeast Asia have increased significantly during 2024-2025, with documented campaigns demonstrating advanced technical capabilities and strategic coordination.
- Rests on an assumption: Recent cyber threat analysis indicates that ransomware-related attacks in the Asia Pacific region have intensified, with criminal operators employing dwell time techniques, sophisticated persistence methods, and exfiltration-based extortion.
- Rests on an assumption: Phishing remains the primary attack vector for breaching government cybersecurity through sophisticated social engineering campaigns.
In the paper
“PDN investigation revealed several tenants lacked backup data separation from primary systems, violating fundamental backup principles (Tempo.co,2024).”
§ Comprehensive Cybersecurity Framework for Digital Governance: Threat Assessment, Risk Mitigation, and Regulatory Compliance in Indonesia > Additional information
What the sources say
- Not matchedcites Tempo.co,2024
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. It may state two separate claims as one.
- Not matched
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“Explicit Supply Chain Risk Management integration directly addresses documented weaknesses in vendor software security management.”
§ Comprehensive Cybersecurity Framework for Digital Governance: Threat Assessment, Risk Mitigation, and Regulatory Compliance in Indonesia > Recommendations
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds.
A conclusion the paper draws from its own results — it cites no other source for it, so there is none to check. The quote shows it is in the paper.
In the paper
“With proper ZTA implementation, such attacks would trigger immediate alerts, block suspicious access, and prevent lateral movement through network segmentation.”
§ Comprehensive Cybersecurity Framework for Digital Governance: Threat Assessment, Risk Mitigation, and Regulatory Compliance in Indonesia > Additional information
hedgeddirectSingle case- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
In the paper
“Based on analysis by the National Cyber and Cryptography Agency (Badan Siber dan Sandi Negara or BSSN), the attack using LockBit 3.0 ransomware on June 20, 2024, paralyzed at least 210 central and local government institutions, with particular impact on immigration services at international airports (Tempo.co,2024).”
§ Comprehensive Cybersecurity Framework for Digital Governance: Threat Assessment, Risk Mitigation, and Regulatory Compliance in Indonesia > Jurnal Teknik Informatika dan Teknologi Informasi -Volume. 5 Nomor. 3 Desember 2025
What the sources say
- Not matchedcites Tempo.co,2024
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
- Not matched
In the paper
“PDN Case Study Implications: June 2024 PDN incident confirmed inadequate ZTA implementation where Windows Defender disabling failed to trigger immediate alerts, malicious activity continued undetected for hours, and lateral movement proceeded unchallenged (Tempo.co,2024).”
§ Comprehensive Cybersecurity Framework for Digital Governance: Threat Assessment, Risk Mitigation, and Regulatory Compliance in Indonesia > Additional information
What the sources say
- Not matchedcites Tempo.co,2024
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
boosteddirectSingle case- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: passes — The paper’s conclusions depend on it.
- Based: passes — The paper gives a reason why it holds.
It may state two separate claims as one.
- Not matched
In the paper
“NIST released Cybersecurity Framework (CSF) 2.0 on February 26, 2024, representing significant evolution from previous versions (National Institute of Standards and Technology, 2024).”
§ Comprehensive Cybersecurity Framework for Digital Governance: Threat Assessment, Risk Mitigation, and Regulatory Compliance in Indonesia > Recommendations
What the sources say
- Not matchedcites National Institute of Standards and Technology, 2024
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. It may state two separate claims as one.
- Not matched
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“COBIT 2019 introduces Design Factors concept enabling organizations to design IT governance systems customized to organizational strategy, risk profiles, threat landscape, compliance requirements, and organizational complexity.”
§ Comprehensive Cybersecurity Framework for Digital Governance: Threat Assessment, Risk Mitigation, and Regulatory Compliance in Indonesia > Recommendations
plaindirect- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it.
None of the sources cited for this claim have been checked yet.
In the paper
“CSF 2.0 organizes cybersecurity activities into six integrated primary functions with explicit governance as central organizing principle.”
§ Comprehensive Cybersecurity Framework for Digital Governance: Threat Assessment, Risk Mitigation, and Regulatory Compliance in Indonesia > Recommendations
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. It may state two separate claims as one.
The paper states this without a source or data behind it here, so there is nothing to check it against. The quote shows it is in the paper.
In the paper
“Research demonstrates that governance frameworks remain inadequately established globally with persistent struggles between organizational solutions and comprehensive governance models.”
§ Comprehensive Cybersecurity Framework for Digital Governance: Threat Assessment, Risk Mitigation, and Regulatory Compliance in Indonesia > Additional information
boosted- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: fails — The paper may give no reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. The paper may give no reason why it holds. It may state two separate claims as one.
What the paper did — it cites no source for this, so there is none to check. The quote shows it is in the paper.
In the paper
“Findings were validated through crossreferencing with minimum 15+ primary sources, with particular attention to cyber security incident data verification, framework specifications validation, latest regulation confirmation, and threat intelligence corroboration.”
§ Comprehensive Cybersecurity Framework for Digital Governance: Threat Assessment, Risk Mitigation, and Regulatory Compliance in Indonesia > 3. METHODS
plain- Asserted: passes — The authors put it forward as true.
- Checkable: passes — It can be checked against evidence.
- Load-bearing: fails — The paper’s conclusions may not depend on it.
- Based: passes — The paper gives a reason why it holds.
Probably not a substantial claim. The paper’s conclusions may not depend on it. It may state two separate claims as one.
The paper relies on this without support.
Cyber threats against government infrastructure no longer originate solely from ordinary criminals but from organized Advanced Persistent Threat (APT) groups sponsored by nation-states with high technical capabilities.
“Cyber threats against government infrastructure no longer originate solely from ordinary criminals but from organized Advanced Persistent Threat (APT) groups sponsored by nation-states with high technical capabilities.”
The paper relies on this without support.
In 2024, cybersecurity incidents in the Asia Pacific region reached unprecedented levels, with government institutions facing sophisticated multi-vector attacks combining spear-phishing, malware deployment, and supply chain compromise techniques.
“In 2024, cybersecurity incidents in the Asia Pacific region reached unprecedented levels, with government institutions facing sophisticated multi-vector attacks combining spear-phishing, malware deployment, and supply chain compromise techniques.”
The paper relies on this without support.
APT represents the most serious threat to government sectors.
“Advanced Persistent Threat (APT) APT represents the most serious threat to government sectors.”
The paper relies on this without support.
APT groups are state-sponsored cyber actors possessing high technical capabilities, unlimited financial resources, and long-term objectives to gain access to government systems and critical infrastructure.
“APT groups are statesponsored cyber actors possessing high technical capabilities, unlimited financial resources, and long-term objectives to gain access to government systems and critical infrastructure.”
The paper relies on this without support.
APT activities targeting government sectors in Southeast Asia have increased significantly during 2024-2025, with documented campaigns demonstrating advanced technical capabilities and strategic coordination.
“APT activities targeting government sectors in Southeast Asia have increased significantly during 2024-2025, with documented campaigns demonstrating advanced technical capabilities and strategic coordination.”
The paper relies on this without support.
Recent cyber threat analysis indicates that ransomware-related attacks in the Asia Pacific region have intensified, with criminal operators employing dwell time techniques, sophisticated persistence methods, and exfiltration-based extortion.
“Recent cyber threat analysis indicates that ransomware-related attacks in the Asia Pacific region have intensified, with criminal operators employing dwell time techniques (prolonged presence in target systems for reconnaissance), sophisticated persistence methods, and exfiltration-based extortion (threatening sensitive data publication in addition to encryption).”
The paper relies on this without support.
Phishing remains the primary attack vector for breaching government cybersecurity through sophisticated social engineering campaigns.
“Phishing remains the primary attack vector for breaching government cybersecurity through sophisticated social engineering campaigns.”
The paper relies on this without support.
ISO 27001 implementation in Indonesian government sectors has shown positive results in several ministries.
“ISO 27001 implementation in Indonesian government sectors has shown positive results in several ministries.”
The paper relies on this without support.
Ransomware remains a pervasive threat to critical government infrastructure.
“Ransomware remains a pervasive threat to critical government infrastructure.”
Citations
Cites
The NIST Cybersecurity Framework (CSF) 2.0
National Institute of Standards and Technology (2024) · doi:10.6028/nist.cswp.29 · Cited by 266
Cyber governance studies in ensuring cybersecurity: an overview of cybersecurity governance
Savaş, S., & Karataş, S. (2022) · International Cybersecurity Law Review · doi:10.1365/s43439-021-00045-4 · Cited by 130
The NIST Cybersecurity Framework 2.0
(2023) · doi:10.6028/nist.cswp.29.ipd · Cited by 38
SoK: Cybersecurity Regulations, Standards and Guidelines for the Healthcare Sector *
Carello, M. P., Marchetti-Spaccamela, A., Querzoni, L., & Angelini, M. (2023) · 2023 IEEE International Conference on Intelligence and Security Informatics (ISI) · doi:10.1109/isi58743.2023.10297246 · Cited by 25
Shiddique, M. R., & Juned, M. (2023) · Journal of Social and Political Sciences · doi:10.31014/aior.1991.06.04.457 · Cited by 5
Cybersecurity Of Work From Anywhere Model For Government : A Systematic Literature Review
Asyrofi, M. F., & Nugraha, I. G. D. (2025) · International Journal of Electrical, Computer, and Biomedical Engineering · doi:10.62146/ijecbe.v3i1.113 · Cited by 5
Cited by
Still being checked.
Metadata
- Authors
- Mualim, W. M. A., Marta, F. Y. D., & Meiyenti, I.
- Affiliations
- Institut Pemerintahan Dalam Negeri (ID)
- Venue
- Jurnal Teknik Informatika dan Teknologi Informasi
- Publisher
- Politeknik Pratama Purwokerto
- Published
- 2025-12-11
- Volume
- 5
- Issue
- 3
- Pages
- 434-450
- ISSN
- 2827-9379 (ISSN-L)
- 2827-9387
- OpenAlex
- W7114809593
- Cited by
- 0
- References
- 5
- FWCI
- 0.00
- Type
- journal article
- Language
- en
- Open access
- hybrid
- doi.org
- Licence
- Locations
- Jurnal Teknik Informatika dan Teknologi Informasi (publishedVersion, cc-by-sa)
- Topics
- Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
- Social Sciences › Political Science and International Relations › Cybersecurity and Cyber Warfare Studies
- Social Sciences › Political Science and International Relations › Security, Politics, and Digital Transformation
- Keywords
- cybersecurity framework, digital governance, government cybersecurity, threat assessment, risk mitigation, regulatory compliance, NIST CSF 2.0, ISO/IEC 27001:2022, COBIT 2019, incident response, zero-trust architecture, cyber resilience
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
A language model drew the claims from the paper on 2026-11-07, under version 3 of the claim definition (model deepseek-v4.1-flash, prompt extract-v3).
A second model labelled each claim on 2026-11-07 (model jev-1.13-20260917, definition revision gold-guideline-v0.2).
Cited sources are checked with a language model’s help (gpt-6-sol).
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
