Incident-Driven Information System Risk Management Using ISO 31000:2018, STRIDE, and CIA Triad: A Case Study of an Indonesian Manufacturer

2.1 Information system risk management

IS risk management is a structured process that identifies, analyses and treats threats to CIA of information assets [20]. Tambunan et al. [21] argued that ISO-based frameworks allow organizations to mitigate cyber risk in a measurable manner while reinforcing operational resilience through systematic control.

2.2 CIA Triad and STRIDE threat modelling

The CIA Triad has, since its formalization in the ISO/IEC 27000 series, been the dominant lens for classifying information-security risks [4, 22]. Confidentiality protects against unauthorized disclosure, Integrity preserves accuracy against unauthorized modification, and Availability ensures information access when required. STRIDE, developed by Microsoft [17], complements this lens at the threat modelling level by classifying threats into Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service and Elevation of Privilege. While ISO 31000 governs the process, CIA captures security outcomes and STRIDE captures threat characteristics; the three are therefore frequently used together rather than as alternatives.

2.3 ISO 31000:2018 framework

ISO 31000:2018 [22] is a generic, principle-based standard organised in three components: Principles (Clause 4), Framework (Clause 5) and Process (Clause 6). Clause 6 specifies an iterative cycle: Communication & Consultation (6.2), Scope/Context/Criteria (6.3), Identification (6.4.2), Analysis (6.4.3), Evaluation (6.4.4), Treatment (6.5), Monitoring & Review (6.6), and Recording & Reporting (6.7). This cycle encompasses both content and governance dimensions of the risk process [23, 24]. Compared with NIST SP 800-30, COBIT 5 and ISO/IEC 27001, which presuppose maturity in security or governance, and ISO/IEC 27005 [25], which assumes an existing Information Security Management System, ISO 31000 makes minimal prerequisites and therefore suits organizations without a formal risk function. The studies [26, 27] recently underlined the cross-sectoral adaptability of the standard for quality-management and strategic-planning contexts.

2.4 Prior implementations and research gap

Recent studies have applied ISO 31000:2018 in domains adjacent to the present study. In service-oriented systems, including e-commerce and learning management systems, the standard has been shown to help organizations without a pre-existing risk framework formalize previously implicit practices, particularly through the Identification and Treatment stages [5, 8]. Similar evidence has also been reported in operational contexts, where 109 operational risks were identified in the textile industry using ISO 31000:2018 [6]. However, evidence from the Indonesian banking sector suggests a more complex financial trajectory: ISO 31000 adoption may have a negative short-term effect on Return on Equity because implementation costs can temporarily outpace financial benefits, even though governance and resilience may improve over the longer term [12]. These studies therefore generally agree that ISO 31000 strengthens governance, but they differ in their assessment of its short-term financial implications. A common limitation is that few studies report on the full eight-stage cycle; Communication & Consultation, Monitoring & Review, and Recording & Reporting are often treated only briefly. Although a rapid-assessment model has been proposed to address some of these limitations, it does not fully incorporate the iterative monitoring loop that is central to ISO 31000 [7]. More recently, the Indonesian SPBE Risk Management Guidelines have been applied to assess IS audit tools in a government context, demonstrating the feasibility of formal risk frameworks in the Indonesian public sector [28]. The present study extends this line of work by applying the international ISO 31000:2018 standard to the manufacturing sector, with the additional dimension of incident-anchored risk identification.

Synthesising these findings, three observations emerge. First, ISO 31000:2018 is empirically tractable across sectors but is rarely applied in its entirety. Second, Indonesian manufacturing, in contrast to e-commerce, banking and education, is under-represented in the IS risk-management literature despite its accelerating digitalization under the national Making Indonesia 4.0 roadmap [29]. Third, to the best of our knowledge, no published implementation starts from actual IS incident data and uses STRIDE and CIA jointly to enrich the Identification stage. The present study addresses these three points simultaneously.

4.1 Respondent profile and risk perception

Thirty employees from Finance (26.7%), Warehouse (16.7%), IT (16.7%), Operations (13.3%), Production (13.3%) and HR (13.3%) participated in the perception survey. The six interview informants comprised the IT Applications, IT Technical, Data Analyst, Functional Analyst, and Quality Assurance Managers from the Information Technology Division, and one Compliance Analyst (Internal Audit and Risk Management) from the Compliance and Risk Division. Four of six informants (67%) had at least two years' tenure, giving longitudinal insight into recurring risk patterns.

The perception score for each aspect was the mean Likert response across the 30 respondents. Across the ten ISO 31000-aligned aspects, the overall mean was 3.78/5 ("Good"). The highest score was on Operational Impact (4.03), reflecting strong awareness of business consequences when IS fails. Process Maturity scored the lowest (3.57), pointing to inconsistent periodic evaluation and documentation.

Beyond the means, Table 3 reports the standard deviation and the share of respondents who rated each aspect 4 or 5. Dispersion is moderate (standard deviations from 0.76 to 1.14), and agreement tracks the means, highest for Operational Impact (73%) and lowest for Process Maturity (57%). The survey is treated descriptively, to support and not replace the qualitative findings.

Table 3. Perception by aspect: Mean, standard deviation, and agreement (N = 30)

Perception also varies by work unit (Table 4). Because the per-unit samples are small (n = 4 to 8), the differences are descriptive only and no significance tests were applied.

Table 4. Mean perception by work unit

The contrast between the highest and lowest aspects is itself a finding: employees recognize the consequences of IS failure but lack systematic mechanisms (periodic review, documented procedures, structured CAPA) to act on that awareness. This converges with the interviews, where informants reported that technical controls operate while formal evaluation and documentation remain inconsistent. The work-unit pattern points the same way: perception is highest in IT and lowest in Human Resources and Warehouse, confirming that risk practice is uneven across units. Together these results give the awareness-maturity gap independent support and motivate the governance-oriented treatments in Section 4.4.

4.2 Risk identification (Clause 6.4.2)

Identification proceeded in two passes. Pass 1 classified the three actual 2024 incidents against STRIDE to characterize the threat vectors observed in practice. The result is shown in Table 5.

Table 5. STRIDE classification of the three actual incidents (2024)

Note: S = Spoofing, T = Tampering, R = Repudiation, I = Information Disclosure, D = Denial of Service, E = Elevation of Privilege.

Web-shell backdoor (September 2024). The portal was compromised when login credentials captured from an unmanaged personal endpoint were reused to reach the server, and a script uploaded through a profile-image feature executed because the upload directory permitted execution, leading to portal defacement and about four hours of downtime. The incident is analytically instructive because it shows how weak controls cascade: the absence of endpoint management enabled credential capture, weak access control allowed the credentials to be reused, and an unrestricted upload directory turned an ordinary content feature into an execution path. As classified in Table 5 it spans five of the six STRIDE categories, and its effect falls mainly on Integrity and Availability. The underlying weaknesses are therefore matters of access governance and configuration rather than any single technical flaw.

SQL injection (October 2024). An input field in the document-search module that was not consistently validated allowed an attacker to read and alter database contents and to expose part of the employee data. The significance of the incident lies less in the technique than in what it reveals: secure-development practice, and input validation in particular, was applied unevenly across the portal’s modules, so one unprotected field was enough to compromise confidentiality and data integrity. It maps to Tampering and Information Disclosure (Table 5) and affects Confidentiality and Integrity. The study therefore treats it as a systemic application-security risk rather than an isolated coding error.

GCPW authentication failure (February 2024). An operating-system update conflicted with a third-party authentication component and blocked logins to the ERP and other core applications. Warehouse, finance, and sales staff lost access for more than an hour, which disrupted order processing and delayed distribution, sales reporting, and stock updates. Unlike the first two incidents this was not an attack but an availability failure rooted in change management, where an uncontrolled update combined with dependence on an external authentication service. It maps to Denial of Service (Table 5) and affects Availability, and it shows that operational risk in an integrated environment can arise from routine maintenance as readily as from external threats. The breadth of STRIDE coverage in a single year confirms the multi-dimensional character of IS risk in an integrated manufacturing environment and motivates Pass 2.

Pass 2 consolidated 14 IS risks through triangulation of interviews, evaluation forms, observation notes, and incident records. The risks are distributed across five domains: Application, Data, Access and Security, Change and Operations, and Compliance and Continuity. The consolidated risk register is summarized in Table 6, listing each risk with its source, affected unit, and CIA dimension.

Table 6. Risk register of identified IS risks (Clause 6.4.2)

Following the CIA definitions in the Methodology, each risk was tagged on one or more dimensions where evidence supported it.

Availability and Integrity dominate (10 and 9 risks respectively), consistent with the operational-critical character of ERP, WMS, and Sales Order systems where service interruption directly halts production and distribution. The three Confidentiality-affecting risks (R08, R09, R10), although fewer in number, carry significant regulatory and reputational consequences.

4.3 Risk analysis and evaluation (Clauses 6.4.3-6.4.4)

Using the scale and four-level scheme defined in the Methodology, each risk's L × I score places it in the heatmap (Figure 2).

Two risks reach the Extreme level: application service downtime (R01) and low data quality (R04), both scoring 20. Both combine very high impact (5) with high likelihood (4) and lie at the centre of operational continuity. Nine risks are High, with operational drivers (defect leakage, ETL failures, change/release control, access governance) dominating. Three risks are Medium, concerning third-party dependence, hardware failure, and audit readiness.

Following ISO 31000:2018 Clause 6.4.4, risks were ranked first by score and then by impact severity (where scores tied, higher impact ranked first). Three priority tiers were assigned: P1 for risks requiring immediate treatment (both Extreme risks and High risks with maximum impact of 5); P2 for High risks with score 12 requiring structural treatment within the planning horizon; and P3 for Medium risks managed through routine controls and monitoring. The full ranking is shown in Table 7.

Table 7. Risk ranking and priority assignment (Clause 6.4.4)

4.4 Risk treatment (Clause 6.5)

Treatment options were selected per risk from the ISO 31000:2018 set (Avoid, Reduce, Transfer, Accept), guided by feasibility within the case organisation's current capacity, the control gap identified in evidence, and cost-benefit balance. Reduce dominates because the identified risks are predominantly internal and addressable through process and control strengthening. Avoid was selected only for R09 (data breach and privacy violation), which carries significant regulatory, reputational, and sanction risks, in combination with Reduce. Transfer and accept were not selected for any P1 or P2 risk, as the identified risks are addressable through internal control strengthening. Table 8 summarises the core treatment direction; the full plan with PIC, target time, and indicators is recorded in the project risk register.

Table 8. Risk treatment plan summary for P1 and P2 risks (Clause 6.5)

4.5 Monitoring, review, recording and reporting (Clauses 6.6-6.7)

Sustained effectiveness is operationalized through three mechanisms. First, a cross-functional IS risk-coordination forum, drawing IT, QA, Data and Compliance, meets monthly or quarterly to update the risk register, follow up CAPAs and align priorities. Second, a minimum KPI scheme is proposed: incident-frequency trend, defect-leakage rate, access-review compliance, MTTR, audit-evidence readiness and CAPA on-time closure rate, all reported quarterly to executive leadership (Table 9).

Table 9. KPI scheme with operational definitions (Clauses 6.6 and 6.7)

Third, risk review is integrated into the system-development life cycle so that risk identification becomes a planning-stage activity rather than a post-incident reaction. Recording and reporting are sustained through the risk register, ranking and treatment plan documented in this study, fulfilling the accountability requirement of Clause 6.7.

4.6 Discussion

4.6.1 Comparison with prior literature

The findings reinforce, but also extend, the prior literature. They reinforce previous findings [5, 8] that in organizations without a formal risk function, ISO 31000:2018 first delivers value by formalising existing implicit practice (testing, role-based access, post-incident response), then by standardizing what is missing (RCA/CAPA, change governance, KPI). They extend this by demonstrating that the full eight-stage cycle is feasible and beneficial, with Communication & Consultation, Monitoring & Review, and Recording & Reporting becoming explicit deliverables rather than implicit assumptions. Compared with earlier studies that identified many operational risks but few cross-domain interdependencies in textiles [6], the present case shows how integrated ERP-HRIS-portal landscapes propagate risk across CIA dimensions, motivating the joint use of STRIDE and CIA. Compared with previous findings that reported short-term financial drag [12], this study foregrounds operational resilience as the primary value channel for organizations that have not yet adopted the standard.

4.6.2 Practical implications for the case organisation's management

The findings yield three practical implications for the case organisation's management. First, the study indicates the need for more explicit top-management commitment to IS risk management. Interview findings suggest that current management support is more output-project oriented than formally directed at technical risk control. Top management therefore needs to establish formal risk-management policy, allocate adequate resources for control implementation, and directly lead the formation of a risk-aware culture across the organisation, consistent with Clause 5 of ISO 31000:2018 which positions leadership and commitment as the foundation of an effective risk-management framework [22].

Second, formalization of IT risk governance is required through clearly defined policy, procedure, and accountability structures. The current condition, in which risk management runs reactively and is based on individual experience, increases dependence on tacit knowledge held by key personnel and reduces organisational resilience to staff turnover. Such formalization becomes a strategic priority that affects not only information security but also operational continuity and corporate reputation [21].

Third, the study recommends that the management of the case organisation defines an explicit risk appetite as a reference for risk decision-making. A clearly defined risk appetite supports unit managers in determining acceptable risk tolerance, enabling more consistent and objective prioritization across functions. Without an explicit risk appetite, risks with significant impact may not receive proportional attention due to the absence of a uniform assessment standard across units.

4.6.3 Implications for Indonesian manufacturing sector

Beyond the case organisation, this study provides empirical evidence that ISO 31000:2018 can be effectively implemented as an IS risk-management framework in the Indonesian manufacturing sector undergoing digital transformation. Unlike prior research that has predominantly focused on the financial sector [12] or remained at a conceptual level [8], this study demonstrates a practical implementation grounded in actual incident data, offering an implementation model that can be adapted by other manufacturers with comparable characteristics.

The findings further confirm that operational resilience cannot be achieved through the strengthening of technical controls alone. It requires an integrated approach encompassing process formalization, documentation enhancement, human-resource capacity building, and the integration of risk management into the system-development life cycle. This broadens the understanding of operational resilience from a narrow technical-recovery capability to an organisational capability that is adaptive and sustainable [19].

Robin Lai: Conceptualization, Methodology, Investigation, Formal Analysis, Data Curation, Writing - Original Draft, Visualization. Nilo Legowo: Conceptualization, Methodology, Supervision, Validation, Writing - Review and Editing, Project Administration.

The first author is employed as the IT Manager of the case organisation; this insider position provided the study's access to systems and informants and was the basis for the risk scoring described in the Methodology. The authors declare no other competing interests.