ISO 27001: Keamanan Informasi — ISMS, Kontrol, & Sertifikasi

# ============================================
# KOMPONEN UTAMA ISMS
# ============================================

# 1. INFORMATION SECURITY POLICY
#    - Kebijakan keamanan informasi tingkat tinggi
#    - Disetujui oleh top management
#    - Menetapkan tujuan dan kerangka kerja keamanan

# 2. RISK ASSESSMENT & TREATMENT
#    - Identifikasi aset informasi
#    - Identifikasi ancaman dan kerentanan
#    - Analisis dan evaluasi risiko
#    - Pilih kontrol untuk mengelola risiko

# 3. STATEMENT OF APPLICABILITY (SoA)
#    - Daftar kontrol yang dipilih dari Annex A
#    - Alasan pemilihan atau pengecualian
#    - Status implementasi setiap kontrol

# 4. RISK TREATMENT PLAN (RTP)
#    - Rencana implementasi kontrol yang dipilih
#    - Timeline, penanggung jawab, anggaran
#    - Milestone dan target

# 5. SECURITY CONTROLS
#    - Kontrol teknis (firewall, enkripsi, dll.)
#    - Kontrol manajerial (kebijakan, prosedur, dll.)
#    - Kontrol fisik (access control, CCTV, dll.)
#    - Kontrol people (training, awareness, dll.)

# 6. INTERNAL AUDIT PROGRAM
#    - Audit berkala terhadap implementasi ISMS
#    - Verifikasi kepatuhan terhadap standar
#    - Identifikasi ketidaksesuaian (non-conformity)

# 7. MANAGEMENT REVIEW
#    - Review berkala oleh top management
#    - Evaluasi efektivitas ISMS
#    - Keputusan perbaikan dan alokasi sumber daya

# 8. CONTINUAL IMPROVEMENT
#    - PDCA cycle — terus menerus meningkatkan ISMS
#    - Learning from incidents
#    - Benchmarking dengan best practices

# ============================================
# CLAUSE 4: CONTEXT OF THE ORGANIZATION
# ============================================

# 4.1 Understanding the Organization and Its Context
# Identifikasi faktor internal dan eksternal yang mempengaruhi ISMS

INTERNAL_FACTORS = {
    "organizational_structure": "Struktur organisasi, departemen, unit bisnis",
    "culture": "Budaya organisasi — attitude terhadap keamanan",
    "resources": "SDM, anggaran, teknologi yang tersedia",
    "existing_controls": "Kontrol keamanan yang sudah ada",
    "contracts": "Kontrak dengan pihak ketiga, SLA",
    "maturity": "Tingkat kematangan keamanan saat ini",
}

EXTERNAL_FACTORS = {
    "regulations": "UU PDP, UU ITE, OJK, BI, regulasi sektor",
    "market": "Persaingan pasar, kebutuhan pelanggan",
    "threats": "Lanskap ancaman cyber saat ini",
    "technology": "Perkembangan teknologi dan tren",
    "partners": "Ekosistem mitra bisnis dan supply chain",
    "geopolitics": "Faktor geopolitik yang mempengaruhi operasi",
}

# 4.2 Interested Parties
# Identifikasi pihak-pihak yang berkepentingan

INTERESTED_PARTIES = [
    {"party": "Top Management", "needs": "Governance, risk reporting, ROI"},
    {"party": "Employees", "needs": "Training, tools, clear policies"},
    {"party": "Customers", "needs": "Data protection, service availability"},
    {"party": "Regulators", "needs": "Compliance, audit trails, reporting"},
    {"party": "Partners/Vendors", "needs": "Integration security, SLA"},
    {"party": "Shareholders", "needs": "Risk management, brand protection"},
]

# 4.3 Scope of ISMS
# Menentukan ruang lingkup ISMS

ISMS_SCOPE = {
    "in_scope": [
        "Sistem informasi departemen IT",
        "Data pelanggan dan data pribadi",
        "Infrastructure cloud dan on-premise",
        "Aplikasi bisnis utama",
        "Jaringan kantor pusat dan cabang",
    ],
    "out_of_scope": [
        "Sistem pihak ketiga yang dikelola vendor",
        "Proyek pengembangan yang belum di-deploy",
    ],
    "physical_locations": [
        "Kantor pusat — Jakarta",
        "Data center — BSD",
        "Kantor cabang — Surabaya, Bandung",
    ],
}

# ============================================
# PROSES RISK ASSESSMENT ISO 27001
# ============================================

# LANGKAH 1: IDENTIFIKASI ASET INFORMASI
# ==========================================
ASSETS = [
    {
        "id": "A001",
        "name": "Database Pelanggan",
        "type": "Digital",
        "owner": "Head of IT",
        "classification": "Confidential",
        "description": "Database utama berisi data pribadi pelanggan",
        "location": "Cloud AWS - ap-southeast-1",
    },
    {
        "id": "A002",
        "name": "Sistem ERP",
        "type": "Application",
        "owner": "Head of Finance",
        "classification": "Confidential",
        "description": "Sistem Enterprise Resource Planning",
        "location": "On-premise data center",
    },
    {
        "id": "A003",
        "name": "Email Server",
        "type": "Infrastructure",
        "owner": "Head of IT",
        "classification": "Internal",
        "description": "Server email korporat",
        "location": "Microsoft 365",
    },
    {
        "id": "A004",
        "name": "Backup Media",
        "type": "Physical",
        "owner": "IT Operations",
        "classification": "Confidential",
        "description": "Media backup external",
        "location": "Safe deposit box",
    },
]

# LANGKAH 2: IDENTIFIKASI ANCAMAN & KERENTANAN
# ==========================================
THREATS = [
    {"id": "T001", "name": "Ransomware Attack", "category": "Malicious"},
    {"id": "T002", "name": "Insider Threat", "category": "Human"},
    {"id": "T003", "name": "DDoS Attack", "category": "Technical"},
    {"id": "T004", "name": "Natural Disaster", "category": "Environmental"},
    {"id": "T005", "name": "Data Breach", "category": "Technical"},
    {"id": "T006", "name": "Social Engineering", "category": "Human"},
]

VULNERABILITIES = [
    {"id": "V001", "name": "Unpatched Systems", "asset": "A001"},
    {"id": "V002", "name": "Weak Access Control", "asset": "A002"},
    {"id": "V003", "name": "No Security Awareness Training", "asset": "All"},
    {"id": "V004", "name": "Lack of Backup Testing", "asset": "A004"},
]

# LANGKAH 3: ANALISIS RISIKO
# ==========================================

# Risk = Likelihood x Impact

LIKELIHOOD_SCALE = {
    1: "Sangat Rendah — hampir tidak mungkin terjadi",
    2: "Rendah — bisa terjadi tapi jarang",
    3: "Sedang — bisa terjadi sewaktu-waktu",
    4: "Tinggi — kemungkinan besar terjadi",
    5: "Sangat Tinggi — hampir pasti terjadi",
}

IMPACT_SCALE = {
    1: "Tidak Signifikan — dampak minimal",
    2: "Minor — dampak kecil, bisa ditangani",
    3: "Moderate — dampak sedang, mempengaruhi operasi",
    4: "Major — dampak besar, mempengaruhi bisnis",
    5: "Critical — dampak kritis, mengancam kelangsungan bisnis",
}

RISK_MATRIX = {
    # Format: (likelihood, impact) → risk level
    (5, 5): "CRITICAL (25)", (5, 4): "HIGH (20)",     (5, 3): "HIGH (15)",
    (5, 2): "MEDIUM (10)",   (5, 1): "LOW (5)",
    (4, 5): "HIGH (20)",     (4, 4): "HIGH (16)",     (4, 3): "MEDIUM (12)",
    (4, 2): "MEDIUM (8)",    (4, 1): "LOW (4)",
    (3, 5): "HIGH (15)",     (3, 4): "MEDIUM (12)",   (3, 3): "MEDIUM (9)",
    (3, 2): "LOW (6)",       (3, 1): "LOW (3)",
    (2, 5): "MEDIUM (10)",   (2, 4): "MEDIUM (8)",    (2, 3): "LOW (6)",
    (2, 2): "LOW (4)",       (2, 1): "LOW (2)",
    (1, 5): "LOW (5)",       (1, 4): "LOW (4)",       (1, 3): "LOW (3)",
    (1, 2): "LOW (2)",       (1, 1): "LOW (1)",
}

# ============================================
# RISK TREATMENT OPTIONS
# ============================================

# ISO 27001 mendefinisikan 4 opsi risk treatment:

# 1. MODIFY (Mitigate) — Mengurangi risiko dengan kontrol
#    Contoh: Implement firewall untuk mengurangi risiko DDoS
#    Paling umum digunakan — sesuai dengan Annex A controls

# 2. AVOID — Menghentikan aktivitas yang menyebabkan risiko
#    Contoh: Tidak menyimpan data kartu kredit jika tidak perlu
#    Cocok untuk risiko yang terlalu tinggi dan tidak ekonomis

# 3. SHARE — Memindahkan risiko ke pihak lain
#    Contoh: Asuransi cyber, outsourcing ke managed security provider
#    Risiko tidak hilang, tetapi dampak finansial ditransfer

# 4. RETAIN — Menerima risiko (risk appetite)
#    Contoh: Menerima risiko minor yang biaya mitigasinya lebih tinggi
#    Harus didokumentasikan dan disetujui oleh management

# ===== CONTOH RISK TREATMENT PLAN =====

RISK_TREATMENT = [
    {
        "risk_id": "R001",
        "risk": "Ransomware mengenkripsi database pelanggan",
        "inherent_risk": "HIGH (20)",
        "treatment": "MODIFY",
        "controls": [
            "A.8.13 — Information backup",
            "A.8.7 — Protection against malware",
            "A.5.29 — ICT readiness for business continuity",
        ],
        "residual_risk": "MEDIUM (8)",
        "owner": "CISO",
        "deadline": "2026-Q3",
        "budget": "Rp 500.000.000",
    },
    {
        "risk_id": "R002",
        "risk": "Data breach dari insider threat",
        "inherent_risk": "HIGH (15)",
        "treatment": "MODIFY",
        "controls": [
            "A.6.1 — Screening",
            "A.6.2 — Terms and conditions of employment",
            "A.6.6 — Confidentiality or NDA agreements",
            "A.8.3 — Information access restriction",
            "A.8.15 — Logging",
        ],
        "residual_risk": "LOW (4)",
        "owner": "CISO + HR",
        "deadline": "2026-Q2",
        "budget": "Rp 200.000.000",
    },
]

# ============================================
# ANNEX A.5 — ORGANIZATIONAL CONTROLS (37)
# ============================================

# Policies for Information Security
A.5.1  — Policies for information security
A.5.2  — Information security roles and responsibilities
A.5.3  — Segregation of duties
A.5.4  — Management responsibilities

# Organization of Information Security
A.5.5  — Contact with authorities
A.5.6  — Contact with special interest groups
A.5.7  — Threat intelligence                    [BARU]
A.5.8  — Information security in project management
A.5.9  — Inventory of information and assets
A.5.10 — Acceptable use of information assets
A.5.11 — Return of assets
A.5.12 — Classification of information
A.5.13 — Labelling of information
A.5.14 — Information transfer

# People Controls (termasuk di organizational)
A.5.15 — Access control
A.5.16 — Identity management
A.5.17 — Authentication information
A.5.18 — Access rights
A.5.19 — Information security in supplier relationships
A.5.20 — Addressing information security within supplier agreements
A.5.21 — Managing information security in the ICT supply chain
A.5.22 — Monitoring, review, and change management of supplier services
A.5.23 — Information security for cloud services        [BARU]
A.5.24 — Incident management planning and preparation
A.5.25 — Assessment and decision on information security events
A.5.26 — Response to information security incidents
A.5.27 — Learning from information security incidents
A.5.28 — Collection of evidence
A.5.29 — ICT readiness for business continuity           [BARU]
A.5.30 — Legal, statutory, regulatory, and contractual requirements
A.5.31 — Intellectual property rights
A.5.32 — Protection of records
A.5.33 — Privacy and protection of PII
A.5.34 — Information security independent review
A.5.35 — Compliance with policies, rules, and standards
A.5.36 — Documented operating procedures
A.5.37 — Change management

# ============================================
# ANNEX A.8 — TECHNOLOGICAL CONTROLS (34)
# ============================================

# User Endpoint Devices
A.8.1  — User endpoint devices

# Privileged Access Rights
A.8.2  — Privileged access rights

# Information Access Restriction
A.8.3  — Information access restriction

# Access to Source Code
A.8.4  — Access to source code

# Secure Authentication
A.8.5  — Secure authentication

# Capacity Management
A.8.6  — Capacity management

# Protection Against Malware
A.8.7  — Protection against malware

# Technical Vulnerability Management
A.8.8  — Management of technical vulnerabilities

# Configuration Management
A.8.9  — Configuration management                [BARU]

# Information Deletion
A.8.10 — Information deletion                    [BARU]

# Data Masking
A.8.11 — Data masking                            [BARU]

# Data Leakage Prevention
A.8.12 — Data leakage prevention                 [BARU]

# Information Backup
A.8.13 — Information backup

# Redundancy of Information Processing
A.8.14 — Redundancy of information processing facilities

# Logging
A.8.15 — Logging

# Monitoring Activities
A.8.16 — Monitoring activities                   [BARU]

# Clock Synchronization
A.8.17 — Clock synchronization

# Use of Privileged Utility Programs
A.8.18 — Use of privileged utility programs

# Installation of Software
A.8.19 — Installation of software on operational systems

# Network Security
A.8.20 — Networks security

# Security of Network Services
A.8.21 — Security of network services

# Segregation of Networks
A.8.22 — Segregation of networks

# Web Filtering
A.8.23 — Web filtering                           [BARU]

# Use of Cryptography
A.8.24 — Use of cryptography

# Secure Development Life Cycle
A.8.25 — Secure development life cycle

# Application Security Requirements
A.8.26 — Application security requirements

# Secure System Architecture and Engineering
A.8.27 — Secure system architecture and engineering principles

# Secure Coding
A.8.28 — Secure coding                           [BARU]

# Security Testing in Development and Acceptance
A.8.29 — Security testing in development and acceptance

# Outsourced Development
A.8.30 — Outsourced development

# Separation of Development, Test, and Production
A.8.31 — Separation of development, test, and production environments

# Change Management
A.8.32 — Change management

# Test Information
A.8.33 — Test information

# Protection of Information During Audit Testing
A.8.34 — Protection of information during audit testing