Control Design of Information Security Related to Privacy in The Smart SIM Business Process

Korlantas Polri has a main task as a supervisor and organizer of traffic functions at the central level, currently in the process of increasing its digitization capabilities, one of which is Smart SIM. This card has the advantage of integrating data such as traffic accident data, traffic violation data, police forensic data, and electronic money. Of course, with these advantages there are security holes that might occur if they do not have a standard that fit the needs of the Smart SIM itself. The security that will be discussed in this study is related to the driver's privacy data security factor which must always be maintained so that all data is not spread and misused by irresponsible parties. In achieving the expected objectives, this research needs to be carried out to implement the appropriate standardization of information systems in its development. These developments and problems create several standards to identify possible data privacy risks that may occur. The standards set in this study use ISO/IEC 27001:2013 and ISO/IEC 27701:2019. ISO/IEC 27701:2019 (Privacy Information Management System) is an extension to privacy from ISO/IEC 27001:2013 (Information Security Management System) that organization can use even without regard to location and measuring and regardless of whether it acts as a Personally Identifiable Information (PII) controller, PII processor or both. By using DRM (Design Research Methodology), the result of this research is an information security control design that is assessed from the results of risk assessment as well as Smart SIM information security policy and procedure documents with the aim of maintaining the privacy of driver data on Smart SIM. The control chosen is based on the results of the risk assessment from Annex An ISO/IEC 27001:2013 and ISO/IEC 27701:2019.