Cyber Security Risk Management in the Indonesian Capital Market

2.1 Risk management

Risk management, as a step to mitigate incidents and provide alternative solutions, is crucial for increasing efficiency and effectiveness in performance, as well as improving public services [1]. Therefore, our study of risk management aims to mitigate potential incidents that could lead to losses, as well as the steps that must be taken to address these issues. Risk management is all processes undertaken solely to minimize or even prevent company risks. It encompasses identification, planning, strategy, action, monitoring, and evaluation of potential negative outcomes. Risk management requires careful consideration of both internal and external factors [2]. Risk management is a theory that must be applied in building a business. Without proper management, entrepreneurs cannot detect potential adverse events. Ironically, companies can experience decline or collapse without knowing the cause. Beyond its theoretical foundation, risk management functions as a systematic mechanism for anticipating uncertainty and preventing organizational decline caused by unidentified or unmanaged risks.

Risk management has specific components that distinguish it from other business management systems. These instruments must be present within management to ensure optimal implementation. The effectiveness of risk management depends on the presence of clearly defined components, governance structures, and decision-making instruments that enable consistent implementation across organizational units.

ISO 31000 provides a universal framework for risk management applicable across industries, including financial services [3]. It emphasizes a principles-based approach, focusing on risk identification, assessment, treatment, and monitoring within an organization's context. Unlike NIST, ISO 31000 is not prescriptive, allowing flexibility in implementation. This adaptability makes it suitable for diverse organizational structures and risk environments, including the heterogeneous landscape of Indonesian financial systems, which range from large banks to fintech startups. For the IRMCM, ISO 31000's flexibility is a key advantage, enabling organizations to tailor risk management processes to local regulatory requirements and cultural nuances. Its emphasis on stakeholder involvement aligns well with Indonesia's collaborative regulatory approach, where coordination between Bank Indonesia, OJK, and private entities is critical. However, ISO 31000's lack of specific cybersecurity guidance may require supplementation with other standards, such as ISO 27001, to address the growing threat of cyber-attacks in digital financial systems.

The IRMCM operates in a dynamic environment characterized by rapid digital adoption, diverse market players, and unique regulatory requirements. Both NIST and ISO frameworks offer valuable insights but require customization to address Indonesia-specific challenges, such as limited cybersecurity infrastructure in rural areas, varying levels of financial literacy, and compliance with local regulations. ISO 31000 offers critical flexibility as integration of both frameworks can enhance risk management effectiveness, ensure resilience, and compliance in Indonesia's rapidly evolving financial sector. This condition underscores the importance of an integrated risk management approach that combines general risk management principles with cybersecurity frameworks to enhance resilience, effectiveness, and regulatory compliance in Indonesia’s rapidly evolving capital market.

2.2 Indonesian capital market

According to the Indonesia Stock Exchange (IDX), the capital market is a market for various long-term, tradable financial instruments, including debt securities (bonds), equities (shares), mutual funds, derivative instruments, and other instruments. The capital market serves as a funding source for companies and other institutions (e.g., the government) and serves as a platform for investment activities [4]. Thus, the capital market facilitates various means and infrastructure for buying and selling, and other related activities. The Indonesian capital market plays a crucial role in the national economy. By offering investment instruments such as stocks, bonds, and mutual funds, it enables investors to support company and infrastructure development while granting companies access to essential expansion capital.

The President Director of the IDX, Iman Rachman, acknowledged that the performance of the Indonesian capital market has improved with the implementation of digital technology innovations. This progress is expected to further enhance the transparency of investor fund management by listed companies. Digitization also increases transparency and the availability of information for investor decision-making. Furthermore, digitalization increases the efficiency and speed of transactions and provides broader access to investment information and education. This helps attract more investors, especially the younger generation, and ultimately supports corporate funding and national economic growth. However, there are challenges to overcome, including digital transaction data security issues, the rapid pace of technological development that demands regulatory adaptation, the need for improved public literacy, limited access to technology in some regions, and competition with conventional capital markets. These challenges indicate that the digital transformation of the Indonesian capital market introduces not only operational efficiencies but also increased exposure to systemic and cyber-related risks. As digital platforms become integral to capital market operations, effective risk management becomes a critical requirement to maintain market integrity, investor confidence, and operational continuity.

2.3 Cyber security regulations in Indonesia

According to Presidential Regulation of the Republic of Indonesia No. 82 of 2022 on the Protection of Critical Information Infrastructure (CII PR), cybersecurity is defined as an adaptive and innovative effort to protect all layers of cyberspace—including the information assets contained therein—from cyber threats and attacks, both technical and social in nature [5]. The regulatory framework that supports the implementation of cybersecurity in Indonesia, as part of the government's efforts to enhance cybersecurity across various sectors, includes the following: Electronic Information and Transactions (EIT) Law and its amendments, Law No. 11 of 2008, Law No. 19 of 2016, and Law No. 1 of 2024; Law No. 27 of 2022 on Personal Data Protection (PDP Law); Government Regulation No. 71 of 2019 on the Operation of Electronic Systems and Transactions; Government Regulation No. 80 of 2019 on Electronic-Based Trading; Presidential Regulation No. 82 of 2022 on the Protection of Critical Information Infrastructure; Presidential Regulation No. 47 of 2023 on the National Cybersecurity Strategy and Cyber Crisis Management; BSSN Regulation No. 8 of 2020 on Security Systems for Electronic System Operators (PSE); and BSSN Regulation No. 1 of 2024 on Cyber Incident Management. Collectively, these regulations form Indonesia’s national cybersecurity governance framework, defining obligations for data protection, electronic system security, critical infrastructure protection, and incident response across sectors, including the financial and capital markets.

One of the key references for the before mentioned cybersecurity regulations is the NIST Cybersecurity Framework 2.0. NIST identifies six core functions to enhance cybersecurity implementation: Govern, Identify, Protect, Detect, Respond, and Recover [6]. These functions establish a structured, lifecycle-based approach to cybersecurity, emphasizing governance, risk management, and informed decision-making rather than focusing solely on technical controls. Furthermore, in the context of cyber risk management, the regulatory framework frequently refers to various international standards such as ISO 31000:2018 – Risk Management Guidelines; ISO/IEC 27005 on Information Security Risk Management, Cybersecurity, and Privacy Protection; NIST SP800-30 Guide for Conducting Risk Assessments; CRAMM (The Central Risk Analysis and Management Method); and other frameworks such as OCTAVE, COSO, and COBIT 5 for Risk. These standards collectively reflect a multi-layered approach to cybersecurity risk management, combining enterprise risk management principles, technical risk assessment methodologies, and governance-oriented control frameworks. However, the coexistence of multiple frameworks and standards may lead to fragmented implementation, as organizations often adopt them selectively without a unified integration model tailored to sector-specific characteristics. In the context of the Indonesian capital market, where regulatory compliance, digital infrastructure, and cybersecurity risks intersect, this regulatory landscape underscores the need for an integrated approach that aligns national regulations with international standards while supporting consistent and effective cyber risk management practices.

2.4 Cyber security risk in the capital market

Research findings have emphasized the need to enhance cybersecurity measures to mitigate cyber threat risks in the financial sector [7, 8]. The correlation between post-cyber threat costs and the net profit of financial institutions illustrates the urgency of protecting this sector. Using descriptive analysis tools, the study summarizes variables such as post-cybercrime costs, net profit of the banking industry, and financial sector performance (as a percentage of GDP). Correlation analysis establishes the relationship and significance between post-attack costs and industry performance. Data was collected from secondary sources, including Statista and the U.S. Bureau of Economic Analysis, covering the period from 2007 to 2022. A negative correlation was found between rising annual costs due to cyberattacks and declining financial sector performance, highlighting the potentially detrimental effects of cybercrime. This highlights the necessity for robust cybersecurity measures in the financial sector. While this stream of research effectively captures the macro-level financial impacts of cybersecurity incidents, it remains largely outcome-oriented and offers limited insight into structured risk management frameworks for proactive prevention and mitigation.

A literature review [3] on topics such as cybersecurity risks and safeguards in the banking sector presents best practices in implementing cybersecurity risk management. It explores methodologies tailored for the banking industry, including quantitative risk assessments, threat modelling, and scenario analysis. Best practices emphasize the proactive integration of threat intelligence, continuous monitoring, and incident response planning. Advanced technologies, such as artificial intelligence and machine learning, are noted for improving the efficiency of risk assessment. Human factors also play a crucial role in cybersecurity, underscoring the importance of training and awareness programs in mitigating risks associated with human error and social engineering attacks. Although this body of work effectively addresses technical and operational controls at the organizational level, it remains largely domain-specific and provides limited integration with broader governance structures and sector-wide risk management perspectives.

A study on the risk management of the Indonesian Ministry of Finance's application system, known as Agency Level Financial Application System (SAKTI) [9, 10], revealed that the system lacked mechanisms to ensure service availability. The risk management framework developed for SAKTI identified 25 risk scenarios and designated responsible parties for mitigation. The process involved establishing context, assessing risk using ISO 27005 and NIST standards, treating risk, and accepting risk. The resulting framework serves as a mitigation guide in case of disruptions, ensuring data availability for operational continuity. While this study demonstrates the practical application of international standards within a specific organizational setting, its scope is confined to a single system and does not address sector-level integration or comparative cyber risk profiling across financial market participants.

Rahman et al. [11] identified attributes of cybercrime in Bangladesh's banking sector and examined the role of board oversight in cybersecurity. The empirical analysis was based on a comprehensive survey involving board members of ten commercial banks. Researchers identified probable cyber risks and sources, applied Enterprise Risk Management tools, and assessed the impact and likelihood of cybercrime over time. The study found that active board involvement is essential in reducing cybersecurity risks. However, most banks lack dedicated IT committees, and few board members possess IT expertise, which hinders the effective implementation of cybersecurity plans. These results underscore the importance of governance structures and organizational maturity in cybersecurity risk management. Nonetheless, governance-focused studies often remain disconnected from operational and technical risk assessment processes and lack standardized measurement frameworks for integrated cyber risk evaluation.

Cybersecurity risk management in the financial sector extends beyond banking. It also applies to the capital market, insurance, and other financial components. The previous studies [12-19] suggested that cyber threats can significantly harm electronic system operators, necessitating risk profiles tailored for financial systems to minimize such impacts. Technological advancement presents challenges for system operators in maintaining business continuity. Therefore, developing risk-based frameworks such as the integrated risk management model is crucial in addressing and mitigating cybersecurity risks. Overall, prior studies demonstrate that cybersecurity risks in the financial sector are multifaceted, encompassing economic impact, technical vulnerabilities, governance challenges, and compliance requirements. However, these dimensions are frequently addressed in isolation rather than through an integrated risk management perspective.

4.1 Development of an integrated risk management capital market

The assessment criteria for each risk refer to National Cyber and Crypto Agency Regulation Number 7 of 2023 concerning the Identification of Vital Information Infrastructure (IIV). This model defines nine criteria: Probability, Operational Impact, Impact on Data/Information, Financial Impact, General Impact, Interdependence Impact, Reputation Impact, Legal Impact, and Other Impacts/Aspects. This risk assessment model will also undergo a validation process by the IDX and cybersecurity experts, ensuring that the criteria and impact scale align with the Indonesian Digital Payment System ecosystem. The model used in developing this assessment instrument will be referred to as IRMCM.

The assessment is conducted to measure each risk based on the established criteria. The results of this assessment are then used to determine the impact scale, from probability to impact, for each risk. The ten highest-scoring risks will be processed into the Indonesian Capital Market Cyber Risk Profile Book. Respondents to the cyber risk assessment instrument are companies involved in the Indonesian payment system. The preparation of the Indonesian Capital Market Cyber Risk Assessment Instrument is part of a series of activities to prepare the Indonesian Capital Market Cyber Risk Profile, which was carried out for 3 months, with the following stages (Figure 2).

Figure 2. Schedule of Integrated Risk Management Framework for the Indonesian Capital Market (IRMCM) development

The proposed cyber risk catalogue refers to the primary reference, the cybersecurity & data privacy risk management model (C|P-RMM) 2025 [20]. The proposed draft cyber risk catalogue contains 33 (thirty-three) cyber risks divided into seven risk groups: Access Control, Asset Management, Business Continuity, Exposure, Governance, Incident Response, and Situational Awareness.

The risk criteria in the IRMCM model utilize five impact scales and nine assessment criteria. This IRMCM risk assessment model will undergo a validation process by Bank Indonesia, the IDX, and Cyber Security Experts to ensure that the criteria and impact scales align with the Indonesian Digital Payment System ecosystem.

To align with the integrated cyber risk assessment pillars that capture the unique nature of digital threats [21], this methodology utilizes a multi-dimensional approach to evaluate risk. Several criteria are employed to assess each risk, including Probability, Operational Impact, Data/Information Impact, Financial Impact, General Impact, Interconnectivity Impact, Legal Impact, and Reputational Impact. Each risk criterion utilizes a five-level impact scale, where each level is tailored to relevant cyber risk scenarios by considering likelihood, consequences, and other contributing factors. These levels are categorized as: Low (L), Low to Moderate (LTM), Moderate (M), Moderate to High (MTH), and High (H). The tiered hierarchical structure of each point facilitates the quantification of subjective nuances, providing the necessary data granularity for empirical statistical testing [22].

Figure 3 shows the complete assessment method that will be used to obtain a value for each cyber risk.

Figure 3. Complete assessment method that will be used to obtain a value for each cyber risk

Figure 4 is an example of mapping one of the risks on the cyber risk list, namely "Improper assignment of privileged functions or improper granting of privileges by administrators." This risk is mapped to the criteria and impact scale as follows.

Figure 4. Example of risk mapping

The measurement essentially uses the Probability and Impact Matrix concept to assess and prioritize risks based on two main factors: the probability of the risk occurring and the impact it will have if it occurs. The matrix provides a visual representation in tabular form, with one column showing the probability scale and the other showing the impact scale. Each cell in the matrix represents a combination of probability and impact and provides a corresponding risk value. The aforementioned criteria are used to classify cyber risk levels based on two primary parameters: the Probability Scale (P) and the Impact Scale (D). Specifically, there is one criterion for probability and five distinct criteria for impact. In this study, each respondent provides values for P and D corresponding to the risk-related questions presented. To determine the overall impact value from the five criteria for each respondent, an average score is calculated. Once the probability and impact values are obtained, each risk is mapped onto the scale—(L), (LTM), (M), (MTH), (H)—to determine its final risk classification. The matrix used for risk value measurement is shown in Figure 5.

Figure 5. Probability and impact matrix of risk

Upon identifying the risk scale for each respondent, the data is grouped to determine the total frequency of each scale (L, LTM, M, MTH, and H). Subsequently, the final weight is calculated by multiplying the frequency of each scale by its respective predetermined coefficient. The IRMCM Model will generate a list of identified Criteria Aspects and Impact Scales, which will then be assessed using the Assessment Instrument and risk measurement. The results of these measurements will indicate a list of the top cyber risks based on their risk weighting.

4.2 Data collection and assessment

Data collection was conducted through a structured survey method using a questionnaire developed based on the IRMCM framework. This questionnaire was designed as an instrument to assess inherent cyber risks at the sector level. The survey approach was chosen to reach a broad sample of respondents and collect empirical data that could be statistically analysed. The population of this study included all entities in the Digital Payment System industry in Indonesia, consisting of banks, non-bank financial institutions, and electronic payment service providers. The research sample consisted of PSE of Payment Systems specifically selected by the IDX. The IDX's involvement as a Self-Regulatory Organization (SRO) in the IRMCM industry ensures that the selected sample represents the overall landscape of the payment system industry in Indonesia. This provides strong validity to the research findings, as the sample assessed includes key entities that collectively reflect the dynamics and diversity of the sector. Each respondent assessed 33 cyber risks, grouped into seven main categories: Access Control, Asset Management, Business Continuity, Exposure, Governance, Incident Response, and Situational Awareness. The assessment was conducted by assigning a score to each risk based on the probability and impact criteria established in the questionnaire. Respondents assigned a score to each criterion using a five-point rating scale tailored to the relevant cyber conditions in their organization.

4.3 Data analysis

The data analysis flow is carried out sequentially and in detail, as explained below:

1. Calculation of probability value and impact of cyber risk

Based on questionnaires completed by various payment system companies, probability and impact scores were obtained for each cyber risk. The probability (P) score for each cyber risk was calculated based on a scale of 1-5 (L, LTM, M, MTH, and H) provided by all respondents. The impact (D) score for each risk was calculated based on the average score from the five impact criteria assessed by the respondents. Selecting the highest impact score ensures that even if the probability of a cyber risk occurring is low, it has a high impact. Therefore, it can be considered a priority risk for optimal management.

2. Risk value calculation

The risk value is then calculated as a function of probability (P) and impact (D). These values are mapped using a probability and impact matrix. The matrix in Figure 5 serves as a visual representation that identifies the appropriate risk value for each combination of probability and impact.

3. Rate values calculation for cyber risk ranking development

Once the cyber risk scores are obtained, a cyber risk ranking is performed based on the weighted value of each cyber risk. This weighting value serves as a quantitative metric that aggregates the collective assessment of each risk from all respondents. The final risk score for the ranking is calculated using a quantitative approach:

R=f(P,D)=(1*L)+(2*LTM)+(3*M)+(4*MTH)+(5*H)

The numbers 1, 2, 3, 4, and 5 above are numerical coefficients that assign different weights to each scale level, so that higher rankings proportionally contribute more to the final weighted score. As shown in Figure 6, the final score is generated based on the multiplication of each coefficient for each scale. Next, the final risk scores for each risk are ranked from highest to lowest. This ranking produces a list of the top 10 cyber risks that are the highest priority for the digital payment system sector in Indonesia.

Figure 6. Risk ranking based on weight value

4.4 Preparation of risk profiles and alternative solutions

Through a process of analysing and ranking cyber risks, this study has identified the top 10 cyber risks out of a total of 33 assessed. This list represents the most significant cyber risks and is a priority for management by the IRMCM industry. The following is a list of the top 10 cyber risks, along with a summary of strategic recommendations for each risk (Table 1).

Table 1. Summary of top 10 cyber risks

The emergence of these ten primary risks manifests a dynamic interaction between accelerated digital transformation and limited defensive capabilities, which can be interpreted across three key domains. Within the Technical Domain, risks such as Software Vulnerabilities and End-of-Life (EoL) Device Risk are driven by technological factors—particularly legacy systems—that broaden the exposure criteria and weaken asset management. In the Organizational Domain, Talent Scarcity and Weak Identity Proofing arise from deficiencies in governance and access control criteria, where regulatory drivers often misalign with internal budget availability and human resource competencies. Meanwhile, in the Operational Domain, phenomena such as Ransomware as a Service (RaaS) and Third-Party Risk reflect a shift toward a more organized cybercrime ecosystem, directly challenging an organization's incident management, business continuity, and situational awareness in the face of complex external threats.

The survey was conducted on 50 Indonesian capital market (PSE) companies selected by the IDX. The IDX selected a sample of PSEs to represent the payment system in Indonesia. Data collection was conducted through an inherent cyber risk mapping survey using the IRMCM (Intrinsic Risk Management) as an instrument to assess cyber risk at the sector level, including the Capital Market. Each respondent assessed 28 inherent cyber risks based on a validated cyber risk catalogue. From the 28 assessed risks, a ranking data analysis was performed to determine priority cyber risks, resulting in the top 10 cyber risks:

1. Talent Scarcity in Cybersecurity.

2. Critical Information Infrastructure Vulnerability.

3. Misuse of Personal Data Information.

4. Social Engineering.

5. Risk of Mobile Phone Number Misuse.

6. Weak Identity Proofing.

7. Third-Party Operational Risk.

8. Software Vulnerabilities.

9. End-of-Support/End-of-Life Device Risk.

10. Malware and Ransomware as a Service.

This activity is supported by the Research Cluster for Mathematical Modeling and Optimization, Diponegoro University, Semarang, Indonesia. My appreciation also goes to the Indonesian National Cyber and Crypto Agency (BSSN), which supported me in completing my research. I warmly welcome any constructive criticism and suggestions regarding this research, as they are invaluable to my growth and improvement.