IT risk management framework based on ISO 31000:2009

2012 ◽  
Author(s):  
Tati Ernawati ◽  
Suhardi ◽  
Doddi R. Nugroho
Keyword(s):  
Risk Management ◽  
Management Framework ◽  
It Risk Management ◽  
Risk Management Framework ◽  
Iso 31000 ◽  
It Risk

scholarly journals JURNAL IT RISK MANAGEMENT ANALISIS RESIKO TEKNOLOGI INFORMASI PADA TOKO PUNTADEWA OUTDOOR

2021 ◽  
Vol 1 (03) ◽  
pp. 54-64
Author(s):  
Usman ◽  
Andika A. Yudhistira
Keyword(s):  
Risk Management ◽  
It Risk Management ◽  
Iso 31000 ◽  
It Risk

Puntadewa outdoor merupakan sebuah perusahaan yang bergerak dalam bidang penyediaan dan penjualan perlengkapan luar ruangan, toko tersebut sudah menggunakan penerapan SI/TI dalam menunjang aktivitas bisnis yang dijalankan. Toko tersebut menggunakan aplikasi SmartConsole yang digunakan untuk menunjang penjualan, mendata stok barang, serta mendata pengeluaran sehari-hari yang dibutuhkan. Namun dalam dunia manajemen pasti selalu ada kemungkinan risiko yang mungkin dapat terjadi dan dapat mengganggu aktivitas bisnis dalam penggunaan sistem tersebut. Dengan begitu analisis risiko sangat diperlukan terhadap sumber daya SI/TI yang terdapat pada toko tersebut. Dengan menggunakan ISO 31000 diharapkan dapat meminimalisir risiko yang terdapat pada aplikasi SmartConsole. Hasil dari analisis risiko ini berupa analisis kemungkinan risiko, mengelompokkan kemungkinan – kemungkinan risiko berdasarkan dampak nya sehingga menghasilkan usulan tindakan risiko terhadap kemungkinan risiko yang terdapat pada aplikasi SmartConsole, dengan begitu toko tersebut dapat memperlakukan kemungkinan risiko yang ada sesuai dengan prioritas level risikonya dan dapat mencegah serta meminimalisir sehinga tidak mengganggu aktivitas bisnis.

scholarly journals Measurement of IT Risk Management Maturity Level in CEC Using IT Domain Risk Governance Framework

2021 ◽  
Vol 6 (1) ◽  
pp. 42-48
Author(s):  
Annas Iswahyudi
Keyword(s):  
Risk Management ◽  
Risk Governance ◽  
Maturity Model ◽  
It Risk Management ◽  
Risk Management Framework ◽  
Information Technology Services ◽  
Technology Services ◽  
Risk Framework ◽  
The Impact ◽  
It Risk

IT Risk Management has long been adopted and implemented in CEC. This is inseparable from the high need for reliable and trusted information technology services at CEC as a government institution that has primary task for eradicating corruption. With a good IT risk management is expected to reduce the impact if the IT risk occurs and impacted to overall business process in CEC. However, up to 15 years after the implementation of IT risk management has never been measured how the level of IT maturity risk management. In this research, Author will use the IT Risk Framework with the risk governance domain approach as a standard IT risk management framework to evaluate the implementation of IT risk management in CEC. The process of evaluating the level of IT maturity is based on the maturity model that has been defined in the IT risk framework.

A Hybrid Asset-Based IT Risk Management Framework

2021 ◽  
pp. 236-253
Author(s):  
Baris Cimen ◽  
Meltem Mutluturk ◽  
Esra Kocak ◽  
Bilgin Metin
Keyword(s):  
Risk Management ◽  
Information Security ◽  
Quantitative Methods ◽  
Security Risks ◽  
Management Framework ◽  
Qualitative And Quantitative Methods ◽  
Risk Management Framework ◽  
Analysis Methodology ◽  
Business Goals ◽  
It Risk

Information security has become one of the most important responsibilities of all organizations due to increasing cyber threats. Attackers take advantage of systems vulnerabilities; therefore, system administrators should be aware of potential threats to take necessary actions to protect their organizations and stakeholders. At this point, a risk assessment is needed to discover possible threats for vulnerable systems of the organization and to implement strategies for the business goals. This study proposes a hybrid risk management framework using both qualitative and quantitative methods to analyze risk within organizations and reduce them with practical countermeasures. Based on this framework, case studies have been carried out considering three hypothetical companies identifying possible information security risks, and these risks have been reduced to an acceptable level by applying the proposed risk analysis methodology.

Development and Implementation of an Operational Risk Management Framework Aligned With ISO 31000

2012 ◽  
Author(s):  
David Weir ◽  
Susan Urra
Keyword(s):  
Risk Management ◽  
Cultural Change ◽  
Operational Risk ◽  
International Standards ◽  
Management Framework ◽  
Operational Risk Management ◽  
Risk Management Framework ◽  
Early Results ◽  
Risk Management Process ◽  
Iso 31000

The International Standards Organization (ISO) standard 31000 (Risk Management – Principles and Guidelines) provides guidance on the development of a systematic approach to managing risk within an organization. Using ISO 31000 as a guide, Enbridge Pipelines has enhanced its existing release-focused risk-informed decision-making approach and risk management process. The development of this enhancement has involved engagement of all levels of management and staff, and has required consideration of corporate cultural change, staff communication and training, development of performance measures, and management reporting. This paper provides a high level overview of the ISO 31000 standard as it pertains to its use in the development of the Enbridge Pipelines operational risk management framework, the roadmap for implementation of the framework, and discusses the challenges, successes, learnings, and early results of implementing the framework in a large multi-national pipeline company.

scholarly journals Analisis IT Risk Management di Universitas Bina Darma Menggunakan ISO31000

2020 ◽  
Vol 11 (1) ◽  
Author(s):  
Yeni Erlika ◽  
Muhammad Izman Herdiansyah ◽  
A. Haidar Mirza
Keyword(s):  
Risk Management ◽  
Disaster Recovery ◽  
Management Practices ◽  
Current System ◽  
It Management ◽  
It Risk Management ◽  
Risk Management Process ◽  
Iso 31000 ◽  
The University ◽  
It Risk

<p class="SammaryHeader" align="center"><strong>Abstract</strong></p><p><em>The application of IT management needs to be evaluated to measure the level of IT risk management that occurs. This study aims to analyze and know the IT risk management process adopted at the University of Bina Darma Palembang using the ISO 31000 approach, and focus on evaluating IT management practices which include three stages; identification, analysis, and risk treatment. Bina Darma University is a university that has applied the use of information technology to support its business processes and in accordance with its vision and mission. The implementation of the entire system can be used to support the performance of employees, lecturers and to provide services to students, system managers namely the Directorate of Technology Systems, hereinafter referred to as DSTI. Risks that have occurred at the University of Bina Darma in terms of security standards for security, disaster recovery, to previously be able to cope with problems that occur, but there is no standard, manual, for example data backup using a hard disk. By using the risk assessment stage within the ISO 31000 framework, researchers found that Bina Darma University currently has not implemented ISO standards in dealing with their IT risk management. University management is in the process of designing to implement ISO. From interviews with IT staff and observations, researchers found that Bina Darma University had the ability to apply ISO 31000 in managing their risk. This research produces IT risk reports on current system applications.</em></p><p><strong><em>Keywords</em></strong><strong><em> </em></strong><strong><em>: </em></strong><em>IT Risk Management, ISO 31000, Assessment, Mitigation</em></p><p class="SammaryHeader" align="center"><strong>Abstrak</strong></p><p><em>Penerapan manajemen IT perlu dilakukan evaluasi untuk mengukur tingkat penanganan risiko IT yang terjadi. Penelitian ini bertujuan untuk menganalisis dan mengetahui proses manajemen risiko IT yang diadopsi di Universitas Bina Darma Palembang menggunakan pendekatan ISO 31000, dan berfokus pada evaluasi praktik manajemen IT yang mencakup tiga tahapan; identifikasi, analisis, dan perlakuan risiko. Universitas Bina Darma merupakan perguruan tinggi yang telah mengaplikasikan penggunaan teknologi informasi sebagai pendukung proses bisnisnya dan sesuai dengan visi dan misi nya. Penerapan seluruh sistem yang ada dapat digunakan untuk mendukung kinerja pegawai, dosen maupun untuk layanan kepada mahasiswa/i, pengelola sistem yaitu Direktorat sistem teknologi selanjutnya di sebut dengan DSTI. Risiko yang pernah terjadi pada Universitas Bina Darma dari segi keamanan standart untuk keamanan, disaster recovery, untuk sebelumnya bisa menanggulangi masalah yang terjadi, tetapi tidak ada standarnya, manual, misal backup data dengan menggunakan hardisk. Dengan menggunakan tahap penilaian risiko dalam kerangka kerja ISO 31000, peneliti menemukan bahwa Universitas Bina Darma saat ini masih belum menerapkan standar ISO dalam menangani manajemen risiko IT mereka. Manajemen universitas sedang dalam proses perancangan untuk mengimplementasikan ISO. Hasil wawancara dengan staf IT dan pengamatan, peneliti menemukan bahwa Universitas Bina Darma memiliki kemampuan untuk menerapkan ISO 31000 dalam mengelola risiko mereka. Penelitian ini menghasilkan laporan risiko TI pada aplikasi sistem saat ini.</em></p><strong><em>Kata kunci : </em></strong><em>IT Risk Management, ISO 31000, Penilaian, Mitigasi</em>

scholarly journals Risk management in higher education: An open distance learning perspective

2019 ◽  
Vol 19 ◽  
pp. 74-98
Author(s):  
J S Wessels ◽  
E Sadler
Keyword(s):  
Higher Education ◽  
Risk Management ◽  
Distance Learning ◽  
Reading Strategies ◽  
Enterprise Risk Management ◽  
Management Framework ◽  
Risk Management Framework ◽  
Enterprise Risk ◽  
Iso 31000 ◽  
Scholarly Discourse

This article contributes to the continuing scholarly discourse on risk and risk management within the context of higher education institutions by reporting on a qualitative assessment of the appropriateness of the risk management framework of a selected open distance learning institution. The assessment is based on a single instrumental case study of an open distance learning institution. The assessment was undertaken by conducting a qualitative content analysis of the institution’s enterprise risk management framework document. For the purpose of this analysis, two reading strategies were followed, namely the reproductive (literal) and hermeneutic reading strategies. This article’s unique contribution to the scholarly discourse is to apply a conceptual framework derived from the work by Tufano (2011) providing trustworthy evidence that the critique by Leitch’s (2010) on the ISO 31000:2009 standard does not necessarily have an empirical sound foundation. The research has indicated that an enterprise risk management framework meeting the ISO 31000:2009 standard, is not only appropriate for a risk imbedded open distance higher education institution such as the selected institution, but has the potential to contribute significantly to the enhancement of the institution’s mission, strategic goals and objectives within an astringent national regulatory and funding context and an ever-changing international higher education landscape.

A Hybrid Asset-Based IT Risk Management Framework

2022 ◽  
pp. 56-76
Author(s):  
Baris Cimen ◽  
Meltem Mutluturk ◽  
Esra Kocak ◽  
Bilgin Metin
Keyword(s):  
Risk Management ◽  
Information Security ◽  
Quantitative Methods ◽  
Security Risks ◽  
Management Framework ◽  
Qualitative And Quantitative Methods ◽  
Risk Management Framework ◽  
Analysis Methodology ◽  
Business Goals ◽  
It Risk

Information security has become one of the most important responsibilities of all organizations due to increasing cyber threats. Attackers take advantage of systems vulnerabilities; therefore, system administrators should be aware of potential threats to take necessary actions to protect their organizations and stakeholders. At this point, a risk assessment is needed to discover possible threats for vulnerable systems of the organization and to implement strategies for the business goals. This study proposes a hybrid risk management framework using both qualitative and quantitative methods to analyze risk within organizations and reduce them with practical countermeasures. Based on this framework, case studies have been carried out considering three hypothetical companies identifying possible information security risks, and these risks have been reduced to an acceptable level by applying the proposed risk analysis methodology.

Sign in / Sign up

Export Citation Format

Share Document