Risk Analysis of Cloud-Based Academic Information System Implementation Using ISO 31000:2018 (Case Study: UNIBI Bandung)

Abstract

The Academic Information System (SIAKAD) is the backbone of higher education academic services, making its reliability crucial. Universitas Informatika dan Bisnis Indonesia (UNIBI) currently operates SIAKAD on a Virtual Private Server infrastructure and is beginning to consider a migration to a cloud computing environment. However, this discourse has not been accompanied by a structured risk analysis foundation, while previous studies generally focused on on-premise infrastructure and have not examined the context of cloud migration planning. This study aims to identify, analyze, and evaluate the feasibility of UNIBI's SIAKAD cloud migration plan from a risk management perspective using the ISO 31000:2018 framework. The approach used is descriptive quantitative based on a questionnaire administered to four infrastructure management staff, assessing likelihood and consequence on a scale of 1-5 to produce a Risk Score. The results identified fourteen risks across four clusters, with two risks categorized as Extreme (data privacy regulatory conflicts and operational cost overruns), seven High risks dominated by security and human resources aspects, and five Medium risks, with no risks categorized as Low. The findings also indicate a gap between quantitative scores and practitioner perceptions, where human error is viewed as the most critical risk despite not having the highest score. The study concludes that the migration is worth considering but is not yet feasible for execution without fulfilling mitigation prerequisites, particularly regulatory compliance, comprehensive cost calculations, strengthening human resource competencies, and phased migration trials. The use of four respondents is explicitly stated here to provide a clear picture of the research scope.