Model Konseptual Penguatan Instrumen Penilaian Kematangan Keamanan Siber (IKAS) menggunakan Pendekatan Sosioteknis melalui Pemetaan Keselarasan terhadap NIST CSF 2.0 dan ISO/IEC 27001:2022

Abstract

The Cybersecurity Maturity Assessment Instrument (IKAS) underpins the protection roadmap of Vital Information Infrastructure in Indonesia, so any weakness in its design propagates directly into national policy. Its alignment with international frameworks and the balance of its sociotechnical composition, however, have never been examined academically. This study maps the alignment of IKAS version 1.2.1 against NIST CSF 2.0 and ISO/IEC 27001:2022 bidirectionally, diagnoses the gaps through Leavitt’s Diamond, and designs a conceptual strengthening model named IKAS-ST. A descriptive qualitative content analysis was applied to 181 IKAS items, 106 NIST CSF 2.0 subcategories, and 93 ISO/IEC 27001:2022 Annex A controls. The instrument proves substantially aligned, with an average forward coverage of 81.2% (Largely Achieved), yet 12 white spots remain, concentrated in the governance and recovery functions. The decisive finding is that Task is the only under-represented scope, with an extreme deficit in the Detection domain where items measure the ownership of detection technology rather than the procedures that operate it. The merit of IKAS-ST lies not in adding items but in three testable properties: every added item is traceable to an identified white spot, so no addition is speculative; the restructuring addresses the root cause, namely the absence of an explicit procedural scope; and all 181 original items are retained, preserving the comparability of historical assessment results. The model is conceptual and awaits expert validation and field testing.