The Design of Information Security Risk Management: A Case Study Human Resources Information System at XYZ University

Human Resource Information System (HRIS) as one of the vital information systems at XYZ University, is expected to provide support in accelerating the achievement of XYZ University's strategic goals as a healthy university based on Good University Governance (GUG) through accelerating the provision of relevant, timely, and quality information. However, the management of HRIS is still not in compliance with information security standards, as can be seen from several incidents and the management of these incidents, which are still accidental. The purpose of this study was to obtain a design for HRIS information security risk management. This study uses a qualitative method where data collection is done by interview, observation, and literature review. ISO/IEC 27005:2018 is used as an information security risk assessment, while risk control recommendation uses SNI ISO/IEC 27001:2013. This study resulted in 40 of these risks: 12 High risks, 19 Moderate risks, six Low risks, and three Very Low risks. The results of this study are the design of HRIS's information security risk management at XYZ University.