This document discusses key concepts related to information security management systems (ISMS), including: 1. The ISMS family of standards led by ISO/IEC 27001 which provides a framework for organizations to develop and implement systems to manage the security of information assets. 2. Fundamental principles of an ISMS including risk assessment, security controls, prevention and detection of incidents, and continual reassessment. 3. Key concepts of ISMS including information, information security, and management as they relate to protecting information assets and achieving business objectives.

1. SASARANKENDALIPENCAPAIANTUJUAN
(CONTROLOBJECTIVE–BUSINESSOBJECTIVE)
KONSEP
Sarwono Sutikno, Dr.Eng.,CISA,CISSP,CISM,CSX-F
Penasihat KPK 2017-2021
v05
Presentasi di DAS BIN
Hotel Pesona Krakatau, Anyer, 6 September 2017

2. 2
Current: Penasihat KPK 2017-2021
Past:
• Anggota Pembina Yayasan Pendidikan Internal Audit
• Cybersecurity Nexus Liaison, ISACA Indonesia Chapter
• ISACA Academic Advocate at ITB
• SME for Information Security Standard for ISO at ISACA HQ
• Associate Professor at School of Electrical Engineering and Informatics, Institut Teknologi Bandung
• Ketua WG Layanan dan Tata Kelola TI, anggota WG Keamanan Informasi serta Anggota Panitia Teknis 35-01 Program
Nasional Penetapan Standar bidang Teknologi Informasi, BSN – Kominfo.
• Lead Asesor Lembaga Sertifikasi SMKI KAN-BSN
• Ketua Kelompok Kerja Evaluasi TIK Nasional, Dewan TIK Nasional (2007-2008)
• Plt Direktur Operasi Sistem PPATK (Indonesia Financial Transaction Reports and Analysis Center, INTRAC), April 2009 –
May 2011
Professional Certification:
• Professional Engineering (PE), the Principles and Practice of Electrical Engineering, College of Engineering, the University
of Texas at Austin. 2000
• IRCA Information Security Management System Lead Auditor Course, 2004
• ISACA Certified Information System Auditor (CISA). CISA Number: 0540859, 2005
• Brainbench Computer Forensic, 2006
• (ISC)2 Certified Information Systems Security Professional (CISSP), No: 118113, 2007
• ISACA Certified Information Security Manager (CISM). CISM Number: 0707414, 2007
Award:
• (ISC)2 Asia Pacific Information Security Leadership Achievements (ISLA) 2011 award in category Senior Information
Security Professional. http://isc2.org/ISLA
Sarwono Sutikno, Dr.Eng.,CISA,CISSP,CISM,CSX-F

3. KESEPAKATANDISKUSI
• Mohon maaf jika gaya/kebiasaan saya di ITB muncul dalam diskusi ini
• Niatnya agar Indonesia lebih berdaulat
• Boleh buka laptop dan akses internet
• Seluruh peserta harus bicara, bertanya, berpendapat, guyon sebagai pembuka
kreatifitas
• Sarwono Sutikno hanya fasilitator dan sedang belajar
• Semoga saya dan semua insan Indonesia menjadi orang merdeka !!!
• Semoga setiap insan Indonesia menjadi khalifah dalam arti tidak ada yang dapat
membatasi potensi seorang insan kecuali impian dirinya dan tuhannya.
Agar efektif berdiskusi

4. BLOOM’STAXONOMYOFEDUCATIONALOBJECTIVES
Apply
Comprehend
Remember
list, recite
explain, paraphrase
calculate, solve,
determine, apply
Analyze
compare, contrast, classify,
categorize, derive, model
Synthesize
create, construct, design,
improve, produce, propose
Evaluate
judge, critique, justify,
verify, assess, recommend

5. AGENDA
0. VUCA
1. Control, Control Objective, Risk
2. Sistem Manajemen Keamanan Informasi – ISO 27001
3. Sistem Manajemen Anti Penyuapan – ISO 37001
4. IA-CM (Internal Audit Capability Model)

6. AGENDA
0. VUCA
1. Control, Control Objective, Risk
2. Sistem Manajemen Keamanan Informasi – ISO 27001
3. Sistem Manajemen Anti Penyuapan – ISO 37001
4. IA-CM (Internal Audit Capability Model)

8. AGENDA
0. VUCA
1. Control, Control Objective, Risk
2. Sistem Manajemen Keamanan Informasi – ISO 27001
3. Sistem Manajemen Anti Penyuapan – ISO 37001
4. IA-CM (Internal Audit Capability Model)

10. RISK VS CONTROL

14. ERAMANAJEMENRISIKO

15. BATASANRISIKO
specific item being reviewed
2.67
review objective
statement describing what is to be achieved as a result of a review (2.65)
2.68
risk
effect of uncertainty on objectives
[SOURCE: ISO Guide 73:2009, 1.1, modified]
Note 1 to entry: An effect is a deviation from the expected — positive or negative.
Note 2 to entry: Uncertainty is the state, even partial, of deficiency of information related to, understanding or
knowledge of, an event (2.25), its consequence (2.14), or likelihood (2.45).
Note 3 to entry: Risk is often characterized by reference to potential events (2.25) and consequences (2.14), or a
combination of these.
Note 4 to entry: Risk is often expressed in terms of a combination of the consequences (2.14) of an event (2.25)
(including changes in circumstances) and the associated likelihood (2.45) of occurrence.
Note 5 to entry: In the context of information security (2.33) management systems (2.46), information security
(2.33) risks can be expressed as effect of uncertainty on information security (2.33) objectives (2.56).
Note 6 to entry: Information security (2.33) risk is associated with the potential that threats (2.83) will exploit
vulnerabilities (2.89) of an information asset or group of information assets and thereby cause harm to an
organization (2.57).
2.69

16. RISK-BASEDCATEGORIZATIONCONTROL

20. COBIT 5
SNI ISO 38500
Internal Control
Framework COSO
HUBUNGANANTAR KERANGKA
PP60/2008
Sistem Pengendalian Intern
Pemerintah
TataKelola
TataKelolaTI
ManajemenTI
Panduan Umum Tata Kelola TIK Nas
+
Kuesioner Evaluasi Pengendalian Intern TIK
SNI ISO 27001SNI ISO 20000
SNI ISO 15408

22. AGENDA
0. VUCA
1. Control, Control Objective, Risk
2. Sistem Manajemen Keamanan Informasi – ISO 27001
3. Sistem Manajemen Anti Penyuapan – ISO 37001
4. IA-CM (Internal Audit Capability Model)

23. 0.1OVERVIEW
Through the use of the ISMS family of standards,
organizations can develop and implement a framework
for managing the security of their information assets
including financial information, intellectual property, and
employee details, or information entrusted to them by
customers or third parties.

24. 0.2ISMSFAMILYOFSTANDARDS
• ISO/IEC 27000, Information security management systems — Overview and vocabulary
• ISO/IEC 27001, Information security management systems — Requirements
• ISO/IEC 27002, Code of practice for information security controls
• ISO/IEC 27003, Information security management system implementation guidance
• ISO/IEC 27004, Information security management — Measurement
• ISO/IEC 27005, Information security risk management
• ISO/IEC 27006, Requirements for bodies providing audit and certification of information security
management systems
• ISO/IEC 27007, Guidelines for information security management systems auditing

25. • ISO/IEC TR 27008, Guidelines for auditors on information security controls
• ISO/IEC 27009, Sector-specific application of ISO/IEC 27001 — Requirements
• ISO/IEC 27010, Information security management for inter-sector and inter-organizational
communications
• ISO/IEC 27011, Information security management guidelines for telecommunications organizations
based on ISO/IEC 27002
• ISO/IEC 27013, Guidance on the integrated implementation of ISO/IEC 27001 and ISO/IEC 20000-1
• ISO/IEC 27014, Governance of information security
• ISO/IEC TR 27015, Information security management guidelines for financial services
• ISO/IEC TR 27016, Information security management — Organizational economics
• ISO/IEC 27017, Code of practice for information security controls based on ISO/IEC 27002 for cloud
services
• ISO/IEC 27018, Code of practice for protection of personally identifiable information (PII) in public
clouds acting as PII processors
• ISO/IEC 27019, Information security management guidelines based on ISO/IEC 27002 for process
control systems specific to the energy utility industry

26. General
Organizations of all types and sizes:
a) collect, process, store, and transmit information;
b) recognize that information, and related processes, systems,
networks and people are important assets for achieving
organization objectives;
c) face a range of risks that may affect the functioning of assets;
and
d) address their perceived risk exposure by implementing
information security controls.

27. 3.2.1FUNDAMENTALPRINCIPLESOFANISMS
a) awareness of the need for information security;
b) assignment of responsibility for information security;
c) incorporating management commitment and the interests of stakeholders;
d) enhancing societal values;
e) risk assessments determining appropriate controls to reach acceptable levels of risk;
f) security incorporated as an essential element of information networks and systems;
g) active prevention and detection of information security incidents;
h) ensuring a comprehensive approach to information security management;
i) continual reassessment of information security and making of modifications as
appropriate

28. 3.2.2INFORMATION
Information is an asset that, like other important business assets, is
essential to an organization’s business and consequently needs to
be suitably protected.
Information can be stored in many forms, including: digital form
(e.g. data files stored on electronic or optical media), material form
(e.g. on paper), as well as unrepresented information in the form
of knowledge of the employees.
Information may be transmitted by various means including:
courier, electronic or verbal communication. Whatever form
information takes, or the means by which the information is
transmitted, it always needs appropriate protection.

29. 3.2.3INFORMATIONSECURITY
Information security ensures the confidentiality,
availability and integrity of information.
Information security involves the application and
management of appropriate controls that involves
consideration of a wide range of threats, with the aim of
ensuring sustained business success and continuity, and
minimizing consequences of information security
incidents.

30. Information security is achieved through the implementation of an
applicable set of controls, selected through the chosen risk
management process and managed using an ISMS, including
policies, processes, procedures, organizational structures, software
and hardware to protect the identified information assets.
These controls need to be specified, implemented, monitored,
reviewed and improved where necessary, to ensure that the
specific information security and business objectives of the
organization are met.
Relevant information security controls are expected to be
seamlessly integrated with an organization’s business processes.

31. 3.2.4 Management
Management involves activities to direct, control, and continually improve the
organization within appropriate structures.
Management activities include the act, manner, or practice of organizing,
handling, directing, supervising, and controlling resources.
Management structures extend from one person in a small organization to
management hierarchies consisting of many individuals in large organizations.
In terms of an ISMS, management involves the supervision and making of
decisions necessary to achieve business objectives through the protection of the
organization’s information assets.

32. 3.2.5 Management system
A management system uses a framework of resources to achieve an organization’s
objectives.
The management system includes organizational structure, policies, planning activities,
responsibilities, practices, procedures, processes and resources.
In terms of information security, a management system allows an organization to:
a) satisfy the information security requirements of customers and other stakeholders;
b) improve an organization’s plans and activities;
c) meet the organization’s information security objectives;
d) comply with regulations, legislation and industry mandates; and
e) manage information assets in an organized way that facilitates continual improvement
and adjustment to current organizational goals.

33. 3.3 Process approach
Organizations need to identify and manage many activities in order
to function effectively and efficiently.
Any activity using resources needs to be managed to enable the
transformation of inputs into outputs using a set of interrelated or
interacting activities; this is also known as a process.
The output from one process can directly form the input to
another process and generally this transformation is carried out
under planned and controlled conditions.
The application of a system of processes within an organization,
together with the identification and interactions of these
processes, and their management, can be referred to as a “process
approach”.

34. 3.4 Why an ISMS is important
Risks associated with an organization’s information assets need to be addressed.
Achieving information security requires the management of risk, and encompasses
risks from physical, human and technology related threats associated with all forms
of information within or used by the organization.
The adoption of an ISMS is expected to be a strategic decision for an organization
and it is necessary that this decision is seamlessly integrated, scaled and updated in
accordance with the needs of the organization.

35. BENEFITSOFSUCCESSFULISMS
a) achieve greater assurance that its information assets are
adequately protected against threats on a continual basis;
b) maintain a structured and comprehensive framework for
identifying and assessing information security risks, selecting
and applying applicable controls, and measuring and improving
their effectiveness;
c) continually improve its control environment; and
d) effectively achieve legal and regulatory compliance.

36. 3.5 Establishing, monitoring, maintaining and improving an ISMS
Overview
a) identify information assets and their associated information security
requirements (see 3.5.2);
b) assess information security risks (see 3.5.3) and treat information security risks
(see 3.5.4);
c) select and implement relevant controls to manage unacceptable risks (see 3.5.5);
d) monitor, maintain and improve the effectiveness of controls associated with the
organization’s information assets (see 3.5.6).

37. KEAMANAN INFORMASI VERSIISACA
Information security is a business enabler that is strictly bound to
stakeholder trust, either by addressing business risk or by creating value
for an enterprise, such as competitive advantage.
At a time when the significance of information and related technologies is
increasing in every aspect of business and public life, the need to mitigate
information risk, which includes protecting information and related IT
assets from ever-changing threats, is constantly intensifying.
ISACA defines information security as something that:
Ensures that information is readily available (availability), when
required, and protected against disclosure to unauthorised users
(confidentiality) and improper modification (integrity).

38. Presentation: KamInfo.ID18
18
KEAMANAN INFORMASI
......... pemerintah negara Indonesia yang melindungi segenap
bangsa Indonesia dan seluruh tumpah darah Indonesia dan untuk
memajukan kesejahteraan umum,
mencerdaskan kehidupan bangsa, dan ikut
melaksanakan ketertiban dunia yang berdasarkan kemerdekaan,
perdamaian abadi dan keadilan sosial........
Pemanfaatan INFORMASI sebagai darah nadi
kehidupan bangsa
dalam perspektif Pertumbuhan Ekonomi
untuk Kesejahteraan Rakyat

39. ISO27001PERSYARATAN:CLAUSE4-10

40. AGENDA
0. VUCA
1. Control, Control Objective, Risk
2. Sistem Manajemen Keamanan Informasi – ISO 27001
3. Sistem Manajemen Anti Penyuapan – ISO 37001
4. IA-CM (Internal Audit Capability Model)

41. ISO37001PERSYARATAN:CLAUSE4-10

42. AGENDA
0. VUCA
1. Control, Control Objective, Risk
2. Sistem Manajemen Keamanan Informasi – ISO 27001
3. Sistem Manajemen Anti Penyuapan – ISO 37001
4. IA-CM (Internal Audit Capability Model)

44. www.theiia.org/research
Internal Audit
Capability Model
(IA-CM)
for the Public Sector
Using the IA-CM as a
Self-assessment Tool
IA-CM

45. •Q&A