Tailoring e-Government’s ICT Readiness for Business Continuity based on Cyber-Risk Approach

There is an increase in cyber attacks targeting government services or government-owned businesses, especially in some countries where the government owns and operates critical infrastructure. As governments increasingly rely on electronic systems to deliver essential services, the need for Information Communication Technology (ICT) Business Continuity Planning (BCP) becomes paramount. The primary purpose of ICT BCP in government operations is to ensure the uninterrupted availability, integrity, and confidentiality of systems and data, even in the face of unexpected incidents or disruptions. ISO/IEC 27031:2016 provides guidance and best practices for developing and implementing business continuity plans tailored to ICT systems. The standard focuses on the unique aspects of ICT systems and their role in supporting organizations’ business processes as a framework for ICT Readiness for Business Continuity (IRBC). This paper proposed a design steps for IRBC based on framework of ISO/IEC 27031:2016. The steps was then carried out in the office of the local government in Indonesia as a use case. Risk assessment was conducted by adopting the processes in NIST SP 800-30 Revision 1. Risks with the high ratings feed as inputs for the Business Impact Analysis (BIA) processes according to NIST SP 800-34 guidelines. The proposed steps resulted in 121 controls recommendation which then be categorized based on the six IRBC elements of ISO/IEC 27031:2016, as 18 controls for skills and knowledge, 10 controls for facilities, 30 controls for technology, 25 controls for data, 31 controls for processes, and 7 controls for suppliers.