Compliance Audit of Application in Credit System Againts ISO/IEC 27002 Using The COBIT 5 Framework

Authors

  • Angelly Vincentsia Rondonuwu Magister Sistem Informasi, Universitas Komputer Indonesia
  • Yeffry Handoko Putra Magister Sistem Informasi, Universitas Komputer Indonesia

DOI:

https://doi.org/10.34010/jtk3ti.v12i2.21335

Abstract

This study assesses the security capabilities and technical control compliance of the Credit Information System at PT BPR Prisma Dana Manado, referencing ISO/IEC 27002:2013 guidelines and COBIT 5 domains (APO13 and DSS05). Using a mixed approach that combined RACI-based surveys with work product triangulation, we found that DSS05 reached Level 1 capability (88.83%), whereas APO13 stayed at Level 0 (75.83%). Meanwhile, ISO/IEC 27002:2013 compliance averaged 83.95% (Partially Compliant). Measured against the target Level 3 (Established Process), gap analysis showed a 2-level deficit in DSS05 and a 3-level deficit in APO13. These gaps stem mainly from irregular audit trail reviews, weak risk management practices, outdated policy reviews, and insufficient vulnerability management. To reach the target levels, the study suggests formalizing security SOPs, running routine audit log reviews and vulnerability assessments, and setting up clear information security KPIs.

Downloads

Published

2026-08-12

Issue

Vol. 12 No. 2 (2026): Agustus 2026

Section

Articles

License

Copyright (c) 2026 Jurnal Tata Kelola dan Kerangka Kerja Teknologi Informasi

Creative Commons License

This work is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License.

All articles published in Jurnal Tata Kelola dan Kerangka Kerja TI (JTK3TI) are licensed under the Creative Commons Attribution-ShareAlike 4.0 International (CC BY-SA 4.0) license.

Under this license:

  1. Granted Rights:

    • Anyone is free to copy, distribute, display, and create derivative works of the article, for both commercial and non-commercial purposes.

    • Reuse, remixing, and adaptation are permitted without additional permission.

  2. Attribution Requirements:

    • You must provide appropriate credit, including: author’s name, article title, journal name (JTK3TI), year of publication, and DOI link (if available).

    • A link to the CC BY-SA 4.0 license (https://creativecommons.org/licenses/by-sa/4.0/) must be included.

    • You must indicate if any changes or modifications were made.

  3. ShareAlike Condition (SA):

    • If you remix, transform, or build upon the material, you must distribute your contributions under the same license (CC BY-SA 4.0).

  4. Rights Retained:

    • Copyright remains with the author, but first publication rights are granted to JTK3TI.

    • Authors are allowed to self-archive or redistribute their published articles on institutional repositories, personal websites, or other media, provided proper citation is included.

  5. Disclaimer:

    • JTK3TI is not responsible for the use, adaptation, or redistribution of articles by third parties.

How to Cite

[1]
“Compliance Audit of Application in Credit System Againts ISO/IEC 27002 Using The COBIT 5 Framework”, JTK3TI, vol. 12, no. 2, pp. 191–200, Aug. 2026, doi: 10.34010/jtk3ti.v12i2.21335.

Most read articles by the same author(s)

1 2 > >>