Assessment of Information Security Maturity Using the KAMI Index 5.0 Aligned with ISO/IEC 27001
TL;DR
This research evaluates the information security posture of the Padang City Communication and Informatics Office, focusing on its readiness to sustain digital transformation, and finds that while several protective processes are active, they lack formal documentation and optimal coordination.
Abstract
The advancement of digital government initiatives has led to a wider deployment of IT systems for public service delivery. Consequently, public sector agencies must establish robust cyber defenses to safeguard critical information and infrastructure. This research evaluates the information security posture of the Padang City Communication and Informatics Office, focusing on its readiness to sustain digital transformation. The assessment aligns with the ISO/IEC 27001 framework and utilizes the KAMI Index 5.0 as the primary diagnostic tool. Employing a qualitative descriptive methodology, the study collected empirical data through field observations, stakeholder interviews, and comprehensive policy reviews. The diagnostic results revealed a compliance score of 518, demonstrating that the organization has established the baseline requirements of the ISO/IEC 27001 standard. Nonetheless, the overall maturity remains at Level II, showing that while several protective processes are active, they lack formal documentation and optimal coordination. To bridge these gaps, structured action plans are formulated across seven key assessment domains: governance (5 actions), risk mitigation (14 actions), security policy framework (5 actions), asset classification (13 actions), technical infrastructure (6 actions), data privacy (11 actions), and third-party control (6 actions). These actionable steps provide a strategic roadmap to enhance the mature of city's electronic administration security.