Integrating ISO 31000, ISO/IEC 27005, and NIST SP 800-30 for Risk Management in High-Classification Government Application
Year: 2026
Type: conference-paper
Abstract: Digital transformation has encouraged various sectors to adapt and innovate. One such sector is government, which is required to simplify bureaucracy through digitalization. However, the digitalization process has led to an increase in the complexity of cybersecurity risks. A comprehensive risk management strategy is needed to address vulnerabilities to cyberattacks. A stand-alone risk management framework is not entirely effective in dealing with this issue, therefore a combined framework approach may be a more relevant solution. This research is a case study of risk management implementation in Application X, which is a high-classification application in the government sector. The methods used combine ISO 31000, ISO/IEC 27005, and NIST SP 800-30. ISO 31000 is used as the main risk management framework, meanwhile ISO/IEC 27005 and NIST SP 800-30 are used as guidelines in the risk assessment process. The risk evaluation stage is carried out by comparing the results of the risk analysis with the risk acceptance criteria, with the aim of determining which risks are tolerable. The results show that 64 risks were identified, of which 13 need to be addressed because they are outside the organization's risk tolerance, while the other 51 do not need to be addressed because they are within the organization's risk tolerance. ISO/IEC 27002 is used as a technical guideline for risk treatment recommendations.
Source: Procedia Computer Science
Authors: Dedy Setiawan, Benfano Soewito
Institution: Binus University
Language: English
Subfield: Information Systems
Field: Computer Science
Domain: Physical Sciences
Open Access status: diamond
OpenAlex ID: W7214166893