Evaluation of Information Security Based on KAMI Index and ISO/IEC 27001 at the XYZ Regency Communication and Information Office

Abstract

Information security is one of the key aspects of protecting information assets. Referring to the Regulation of the Ministry of Communication and Informatics No. 4 of 2016, Electronic System Providers (PSE) are required to implement information security to safeguard public interests, public services, state administration, and national defense and security. Therefore, the XYZ Regency Communication and Information Office, as an Electronic System Provider, needs to conduct an evaluation of its information security. This study aims to assess the level of information security at the XYZ Regency Communication and Information Office using the KAMI Index version 5.0 and to provide improvement recommendations in accordance with ISO/IEC 27001:2022 controls. The KAMI Index is used as a standard evaluation tool for assessing information security readiness based on the Regulation of the National Cyber and Crypto Agency (BSSN) No. 8 of 2021. The evaluation results show that the XYZ Regency Communication and Information Office obtained a final score of 248, with a readiness status of "Not Eligible" to meet the ISO/IEC 27001:2022 standard. The maturity level of information security is in the range of Level I to II. Improvement recommendations are provided based on questionnaire results that do not yet meet the ISO/IEC 27001:2022 standards. These recommendations serve as a reference for the XYZ Regency Communication and Information Office to align its information security governance with the ISO/IEC 27001:2022 standard.