Dhitia, Ekky Cahya (2026) Pengembangan Risk-Weighted Cybersecurity Maturity Index (RWCMI) Berbasis NIST Cybersecurity Framework 2.0 Pada Organisasi Multi-Entitas. Masters thesis, Institut Teknologi Sepuluh Nopember.
![[thumbnail of 6032241027_Master_Thesis.pdf]](http://repository.its.ac.id/style/images/fileicons/text.png) |
Text
6032241027_Master_Thesis.pdf - Accepted Version Restricted to Repository staff only Download (3MB) | Request a copy |
Abstract
Organisasi multi-entitas memiliki karakteristik operasional, tingkat digitalisasi, kapabilitas, dan profil risiko keamanan siber yang berbeda. Perbedaan tersebut memerlukan pengukuran kematangan untuk mengetahui kesiapan setiap entitas dan menetapkan prioritas peningkatan keamanan siber secara tepat. Namun, pengukuran kematangan konvensional umumnya menggunakan pembobotan seragam sehingga belum sepenuhnya mempertimbangkan risiko relatif pada setiap kategori. Penelitian ini bertujuan mengembangkan Risk-Weighted Cybersecurity Maturity Index (RWCMI) berbasis NIST Cybersecurity Framework (CSF) 2.0 dengan mengintegrasikan skor kematangan dan bobot risiko pada tingkat kategori. Penelitian menggunakan pendekatan kuantitatif melalui studi kasus pada 11 entitas dalam suatu organisasi multi-entitas. Tingkat kematangan diukur pada 22 kategori NIST CSF 2.0, sedangkan bobot risiko diperoleh melalui expert judgement terhadap probabilitas dan dampak, kemudian dipetakan menggunakan matriks risiko internal organisasi dan dinormalisasi. Hasil penelitian menunjukkan nilai RWCMI berada pada rentang 0,44–4,78, dengan lima entitas berada di atas target 3,00, satu entitas mendekati target, dan lima entitas berada di bawah target. Dibandingkan dengan pengukuran kematangan konvensional, perbedaan nilai agregat relatif kecil, tetapi RWCMI mampu mengidentifikasi kategori berisiko tinggi yang belum didukung oleh tingkat kematangan yang memadai. Dengan demikian, RWCMI dapat melengkapi pengukuran kematangan konvensional dalam mendukung perbandingan antarentitas, penentuan prioritas peningkatan keamanan siber, dan alokasi sumber daya berbasis risiko.
======================================================================================================================================
Multi-entity organizations have different operational characteristics, levels of digitalization, capabilities, and cybersecurity risk profiles. These differences require maturity assessment to determine the readiness of each entity and establish appropriate cybersecurity improvement priorities. However, conventional maturity assessments generally apply uniform weighting and therefore do not fully consider the relative risk of each category. This study aims to develop a Risk-Weighted Cybersecurity Maturity Index (RWCMI) based on the NIST Cybersecurity Framework (CSF) 2.0 by integrating maturity scores and risk weights at the category level. A quantitative approach was applied through a case study involving 11 entities within a multi entity organization. Cybersecurity maturity was assessed across 22 NIST CSF 2.0 categories, while risk weights were derived from expert judgments of probability and impact, mapped using an internal organizational risk matrix, and subsequently normalized. The results show that RWCMI scores ranged from 0.44 to 4.78, with five entities exceeding the target score of 3.00, one approaching the target, and five remaining below it. Compared with conventional maturity assessment, the differences in aggregate scores were relatively small; however, RWCMI was able to identify high-risk categories that were not supported by adequate maturity levels. Therefore, RWCMI can complement conventional maturity assessment by supporting inter-entity comparisons, cybersecurity improvement prioritization, and risk-based resource allocation.
| Item Type: | Thesis (Masters) |
|---|---|
| Uncontrolled Keywords: | kematangan keamanan siber, Risk-Weighted Cybersecurity Maturity Index, NIST Cybersecurity Framework 2.0, risiko keamanan siber, organisasi multi-entitas, cybersecurity maturity, Risk-Weighted Cybersecurity Maturity Index, NIST Cybersecurity Framework 2.0, cybersecurity risk, multi-entity organization. |
| Subjects: | T Technology > T Technology (General) > T174.5 Technology--Risk assessment. T Technology > T Technology (General) > T58.5 Information technology. IT--Auditing |
| Divisions: | Interdisciplinary School of Management and Technology (SIMT) > 61101-Master of Technology Management (MMT) |
| Depositing User: | Ekky Cahya Dhitia |
| Date Deposited: | 28 Jul 2026 07:11 |
| Last Modified: | 28 Jul 2026 07:11 |
| URI: | http://repository.its.ac.id/id/eprint/138692 |
Actions (login required)
 |
View Item |