Information Security Management Evaluation at ABC University Using OCTAVE-S and ISO Standards

ABC University, recognized as one of the leading educational institutions in Indonesia, bears significant responsibility for safeguarding its information security, mainly due to its reliance on technology to manage critical financial and educational data. Despite the university’s esteemed academic reputation, no prior research has evaluated the effectiveness of the information security practices implemented by the Information and Communication Technology (ICT) Unit. This study aims to fill this gap by assessing the Information Security Management System (ISMS) within the ICT unit, utilizing ISO 27001 standards in conjunction with the comprehensive risk evaluation framework of the OCTAVE-S method. Through qualitative methods—including interviews, document analysis, and field studies—this research identifies 15 security practice areas, revealing that 10 are rated red, 5 yellow, and none green. These findings indicate significant vulnerabilities in critical assets, such as the Academic Information System and Course Management System, which face 24 and 26 potential threats, respectively. By proposing risk mitigation measures across five key areas, this research enhances overall security at ABC University. Applying the Standar Nasional Indonesia (SNI) ISO 27001:2013 framework to develop tailored strategies for addressing identified threats protects sensitive financial and educational data and further reinforces ABC University’s credibility as a model of best practices in information security at the Indonesia University level.