Information Security Evaluation Based on KAMI Index 5.0 (2023) at PT X

Authors

  • Greycia Febrina Michelle Pradita University, Kabupaten Tangerang, Banten, Indonesia
  • Nickel Modami Pradita University, Kabupaten Tangerang, Banten, Indonesia
  • Ephraim Eleazar Reva Manopo Pradita University, Kabupaten Tangerang, Banten, Indonesia
  • Muhamad Rafly Kurniawan Pradita University, Kabupaten Tangerang, Banten, Indonesia
  • Danendra Rafi Enditama Pradita University, Kabupaten Tangerang, Banten, Indonesia
  • Afifah Trista Ayunda Pradita University, Kabupaten Tangerang, Banten, Indonesia https://orcid.org/0009-0003-6069-4147

DOI:

https://doi.org/10.51903/etg50932

Keywords:

Information Security, KAMI Index 5.0, Risk Management, ISO/IEC 27001:2022, Maturity Evaluation

Abstract

The digital transformation in the financial services sector demands robust information security assurance to protect strategic data from increasingly complex cyber threats. PT X, as a strategic institution managing investments and public assets, faces the challenge of balancing Enterprise Resource Planning (ERP) system operations with regulatory compliance for data privacy. This study aims to evaluate the information security maturity level and identify risk gaps at PT X using the Information Security Index (KAMI) Version 5.0 instrument, aligned with ISO/IEC 27001:2022 standards. The research methodology employs a descriptive quantitative approach through interviews, document observation, and dashboard assessment covering seven evaluation areas. Based on the evaluation conducted in November 2025, the Electronic System at PT X is classified in the "High” category with a score of 21. The final evaluation result indicates an “Adequate" (Cukup Baik) status, with varying maturity levels: Governance (III+), Risk Management (III+), Framework (II), Asset Management (II), Technology (III+), and Personal Data Protection (I+). Research findings reveal that while governance aspects and technology controls are well-defined, significant gaps exist in the formalization of framework documentation and PDP Law compliance, which remains at an initial level. In conclusion, strategic improvement priorities must focus on developing data privacy policies and asset lifecycle management to achieve optimal compliance targets.

References

[1] J. Xianglan, C. Huizhu, L. Fengwei, H. Ziqiang, and C. Yonghao, “Does Cybersecurity Regulation Promote Digital Transformation? Evidence from the Cyber Security Law in China,” Financ. Res. Lett., vol. 76, p. 107041, 2025, doi: 10.1016/j.frl.2025.107041.

[2] S. Wang, M. Asif, M. F. Shahzad, and M. Ashfaq, “Data Privacy and Cybersecurity Challenges in the Digital Transformation of the Banking Sector,” Comput. Secur., vol. 147, p. 104051, 2024, doi: 10.1016/j.cose.2024.104051.

[3] Riska and S. M. Sulubara, “Tantangan dan Peluang Otoritas Jasa Keuangan dalam Era Digitalisasi Layanan Keuangan,” J. Ris. Manaj., vol. 2, no. 21, pp. 240–248, 2024, doi: doi.org/10.54066/jurma.v2i4.2712.

[4] M. Zammani, R. Razali, and D. Singh, “Organisational Information Security Management Maturity Model,” Int. J. Adv. Comput. Sci. Appl., vol. 12, no. 9, pp. 668–678, 2021, doi: 10.14569/ijacsa.2021.0120974.

[5] J. Xu, “Cybersecurity Governance and Corporate Innovation: Evidence from China,” Financ. Res. Lett., vol. 82, p. 107619, 2025, doi: 10.1016/j.frl.2025.107619.

[6] T. Hasani, N. O. Reilly, A. Dehghantanha, D. Rezania, and N. Levallet, “Evaluating the Adoption of Cybersecurity and Its Influence on Organizational Performance,” SN Bus. Econ., vol. 3, no. 5, pp. 1–38, 2023, doi: 10.1007/s43546-023-00477-6.

[7] T. Hadlington, “The ‘Human Factor’ in Cybersecurity: Exploring the Accidental Insider,” in Psychological and Behavioral Examinations in Cyber Security, J. McAlaney, L. A. Frumkin, and V. Benson, Eds., IGI Global, 2021, pp. 46–63, doi: 10.4018/978-1-5225-4053-3.ch003.

[8] S. Perera, X. Jin, A. Maurushat, and D. J. Opoku, “Factors Affecting Reputational Damage to Organisations Due to Cyberattacks,” Informatics, vol. 9, no. 28, pp. 1–24, 2022, doi: 10.3390/ informatics9010028.

[9] H. A. Pratiwi and L. Wulandari, “Evaluasi Tingkat Kesiapan Keamanan Informasi Menggunakan Indeks Keamanan Informasi (Indeks KAMI) Versi 4.0 pada Dinas Komunikasi dan Informatika Kota Bogor,” J. Ind. Eng. Manag. Res., vol. 2, no. 5, pp. 146–163, 2021, doi: 10.7777/jiemar.v2i5.196.

[10] A. Kornelia and D. Irawan, “Analisis Keamanan Informasi Menggunakan Tools Indeks KAMI ISO 4.1,” J. Pengemb. Sist. Inf. dan Inform., vol. 2, no. 2, pp. 78–86, 2021, doi: 10.47747/jpsii.v2i2.548.

[11] K. Ryanto and V. Tundjungsari, “Standardization of Information Security Management in the Banking Sector using the ISO 27001:2022 Framework,” J. La Multiapp, vol. 05, no. 04, pp. 361–379, 2024, doi: 10.37899/journallamultiapp.v5i4.1399.

[12] Z. S. Nadine, I. Aknuranda, and H. Farisi, “Evaluasi Pengelolaan Keamanan Informasi Berbasis Indeks KAMI 5.0 di Satuan Logistik (SLOG) Polri,” J. Pengemb. Teknol. Inf. dan Ilmu Komput., vol. 9, no. 10, pp. 1–12, 2025. [Online]. Available: https://j-ptiik.ub.ac.id/index.php/j-ptiik/article/view/15393

[13] T. Ali, M. Al-khalidi, and R. Al-zaidi, “Information Security Risk Assessment Methods in Cloud Computing : Comprehensive Review,” J. Comput. Inf. Syst., pp. 1–28, 2024, doi: 10.1080/08874417.2024.2329985.

[14] A. Alfaadhel, I. Almomani, and M. Ahmed, “Risk-Based Cybersecurity Compliance Assessment System (RC2AS),” Appl. Sci., vol. 13, no. 10, p. 6145, 2023, doi: 10.3390/ app13106145 Academic.

[15] N. T. Mai and I. Khalid, “Human Error vs. System Security: Evaluating the Weakest Link in Digital Business Information Systems,” J. Manag. Informatics, vol. 4, no. 3, pp. 981–997, Dec. 2025, doi: 10.51903/jmi.v4i3.305.

[16] S. Arkha, A. Nugroho, and A. Wibowo, “Evaluating Digital Transformation within Integration Limitations using Desk-Based Analytical Case Study,” J. Technol. Informatics Eng., vol. 4, no. 2, pp. 289–299, Aug. 2025, doi: 10.51903/jtie.v4i2.365.

[17] M. Izzani, N. Nellatul, A. Ismatul, and A. Hamdani, “Evaluasi Penerapan Kemanan Informasi pada SIAKAD Universitas Ibrahimy Berbasis ISO/IEC 27001:2022,” J. Ilm. Sist. Inf., vol. 5, no. 1, pp. 175–185, Jan. 2026, doi: 10.51903/d3bktm29.

[18] J. Angelo, S. Tania, and F. Loren, “Kajian Literatur Terhadap Audit Sistem Informasi pada Perusahaan Perbankan,” JDMIS J. Data Min. Inf. Syst., vol. 2, no. 2, pp. 82–89, 2024, doi: 10.54259/jdmis.v2i2.2216.

[19] D. Javaheri, M. Fahmideh, H. Chizari, P. Lalbakhsh, and J. Hur, “Cybersecurity Threats in FinTech: A Systematic Review,” Expert Syst. Appl., vol. 241, pp. 1–42, 2023, doi: 10.1016/j.eswa.2023.122697.

[20] D. Javaheri, M. Fahmideh, H. Chizari, P. Lalbakhsh, and J. Hur, “Cybersecurity Threats in FinTech: A Systematic Review,” Expert Syst. Appl., vol. 241, pp. 1–42, 2023, doi: 10.1016/j.eswa.2023.122697.

[21] M. Mirtsch, J. Kinne, and K. Blind, “Information Security Management System Standard ISO / IEC 27001 : A Web Mining-Based Analysis,” IEEE Trans. Eng. Manag., vol. 68, no. 1, pp. 87–100, 2021, doi: 10.1109/tem.2020.2977815.

[22] N. S. Azzahra, A. M. Tambunan, N. N. Aulia, A. Binarsih, and T. H. Saepudin, “Tinjauan Literatur tentang Ancaman Cybercrime dan Implementasi Keamanan Siber di Industri Perbankan,” Humanit. J. Humaniora, Sos. dan Bisnis, vol. 2, no. 7, pp. 692–700, 2024. https://humanisa.my.id/index.php/hms/article/view/188

[23] F. C. Arumdiya and R. Christ, “Implementasi ISO 27001:2022 dalam Manajemen Risiko Keamanan Informasi,” J. PETISI, vol. 6, no. 2, pp. 143–155, 2025, doi: 10.36232/jurnalpetisi.v6i2.2012.

[24] Badan Siber dan Sandi Negara (BSSN), Indeks Keamanan Informasi (KAMI) Versi 5.0: Panduan Evaluasi Keamanan Informasi, 2023. https://www.bssn.go.id/indeks-kami

[25] A. Ghanad, “An Overview of Quantitative Research Methods,” Int. J. Multidiscip. Res. Anal., vol. 06, no. 08, pp. 3794–3803, 2023, doi: 10.47191/ijmra/v6-i8-52.

[26] J. Recker, Scientific Research in Information Systems: A Beginner’s Guide, Springer International Publishing, 2021, doi: 10.1007/978 3 030 85436 2.

[27] B. Novriyadi, M. Jazman, M. Megawati, and M. Afdal, “Evaluation of Information Security Readiness Using the KAMI Index 5.0 and ISO/IEC 27001:2022,” Progresif J. Ilm. Komput., vol. 21, no. 2, pp. 573–585, 2025, doi: 10.35889/progresif.v21i2.2882.

[28] A. Ebekozien, C. O. Aigbavboa, and M. Ramotshela, “A Qualitative Approach to Investigate Stakeholders’ Engagement in Construction Projects,” Benchmarking: An Int. J., vol. 31, no. 3, pp. 866–883, 2024, doi: 10.1108/bij 11 2021 0663.

Downloads

Published

2026-01-28

Issue

Vol. 5 No. 2 (2026): May: Jurnal Ilmiah Sistem Informasi

Section

Articles

License

Copyright (c) 2026 Greycia Febrina Michelle, Nickel Modami, Ephraim Eleazar Reva Manopo, Muhamad Rafly Kurniawan, Danendra Rafi Enditama, Afifah Trista Ayunda

Creative Commons License

This work is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License.

All articles published in this journal are open access and licensed under the terms of the Creative Commons Attribution-ShareAlike 4.0 International License (CC BY-SA 4.0).

Under this license:

  • Authors retain copyright of their work.

  • Others are free to:

    • Share — copy and redistribute the material in any medium or format;

    • Adapt — remix, transform, and build upon the material for any purpose, even commercially;

  • As long as they:

    • Give appropriate credit to the original author(s) and the source;

    • Provide a link to the license;

    • Indicate if changes were made;

    • Distribute their contributions under the same license as the original.

This ensures that derivative works will also remain free and open under the same terms.