Development of Enterprise Security Framework in SKK Migas Based on Integration of ISO 27000 and SABSA Model

Abstract

This paper presents the development of Enterprise Security Framework (ESF) for an Indonesian government institution called SKK Migas (Special Task Force for Upstream Oil and Gas Business Activities). The framework developed based on two security standard namely ISO 27000 and SABSA. The development is started by evaluating available information security standard and best practice used in enterprise scale. The next step is analyzing existing security policy and implementation regarding the Information Security Management System (ISMS) in SKK Migas and then perform gap analysis. The main step is the synthesis of security framework which intended to improve information security management in SKK Migas. The resulted security framework covers 14 security domains which will be used to control information security management within the institution.