Analysis of Government Employees’ Information Security Awareness: A Case Study of Pusinfowas BPKP

Abstract

The utilization of information technology as a tool that is widely believed to facilitate business processes within organizations is inseparable from challenges related to information security threats. According to the 2024 cyber incident report issued by the National Cyber and Crypto Agency (BSSN), data exposure threats accounted for 58.34%, with most incidents originating from the government administration sector. Humans are considered the weakest link in information security; therefore, the primary effort to improve security can begin with measuring the level of security awareness. Among the various work units within BPKP, Pusinfowas, as the central information technology management unit, is considered an appropriate sample for evaluation and is expected to contribute to improving information security awareness across other units. This study employs the Human Aspects of Information Security Questionnaire (HAIS-Q) model to measure the level of information security awareness among employees at Pusinfowas. The HAIS-Q model consists of three dimensions—knowledge, attitude, and behavior—and seven focus areas: password management, email use, internet use, social media use, mobile device use, information handling, and incident reporting. The results indicate that employees’ information security awareness is at a “Good” level, with scores ranging between 80% and 100% across all HAIS-Q dimensions and focus areas.