Recommendations for Information Security Governance Referencing ISO/IEC 27001:2022 for Government Agencies

Abstract

Information security is crucial for local government agencies, especially those managing the Electronic-Based Government System (SPBE) infrastructure. Many agencies still lack clear and documented information security governance. This issue is evident at the Communication, Informatics, and Statistics Office (Diskominfo) X, where security operations remain reactive, and the KAMI Index rating is “Insufficient.”The study aims to perform a gap analysis and design recommendations for information security governance at Diskominfo X, based on ISO/IEC 27001:2022 standards. It is a qualitative study using interviews, observations, and internal document reviews. Findings indicate that although Diskominfo has a regional legal basis and operational security practices, compliance with the standard is mostly “Not Yet Implemented.” Information security management is still informal and not integrated into an Information Security Management System (ISMS) framework.The study outputs include draft SOP documents, operational forms, work regulations, and responsibility distribution drafts. Recommendations urge the institution to formalize these documents, standardize technical activities, and conduct regular internal audits and security awareness training for all employees.