Risk Exposure and Zero Trust Maturity Assessment Using ISO/IEC 27005, CISA ZTMM, and PPTG: A Case Study of a Hybrid-Infrastructure Bank in Indonesia

Cybersecurity risk in Indonesia's financial sector has become systemic rather than episodic. In 2024, Indonesia's National Cyber and Crypto Agency (BSSN) reported more than 330 million anomalous cyber-traffic events, 1,367 cyber-incident notifications, 241 suspected data leaks, and more than 56 million darknet-exposed records, with 47 notifications concerning the financial sector [1] (Figure 1). The 2023 LockBit 3.0 attack on Bank Syariah Indonesia, which disrupted mobile-banking and ATM services and was reportedly followed by the leak of customer and employee data, illustrates the exposure Indonesian banks face; the incident did not involve the anonymized bank studied here. Cyberattacks in digital financial services create financial, reputational, and regulatory consequences in addition to direct technical loss [2].

This exposure is compounded by an infrastructural shift already under way. Banks are migrating, gradually and unevenly, from on-premise systems toward hybrid models that combine core banking platforms with public and private cloud services. The migration expands the attack surface: identities, devices, applications, and data now routinely operate beyond the perimeter that conventional security controls were built to defend. A perimeter-based model, which trusts entities by default once inside the network, offers little resistance to credential compromise, lateral movement, or cloud-workload exploitation.

tu_pian_10.png

Figure 1. Indonesia national cyber-incident indicators, 2024

Zero Trust Architecture (ZTA) responds by replacing implicit trust with continuous, per-request verification: no access decision rests on network location alone. NIST SP 800-207 formalizes the target-state architecture around three components, the Policy Engine, Policy Administrator, and Policy Enforcement Point, while CISA's Zero Trust Maturity Model (ZTMM) v2.0 operationalizes readiness across five pillars, Identity, Devices, Networks, Applications & Workloads, and Data, and three cross-cutting capabilities: Visibility & Analytics, Automation & Orchestration, and Governance [3].

Despite their widespread use, ISO/IEC 27005:2022 and CISA ZTMM v2.0 are usually applied separately: risk assessment identifies urgent threat scenarios, while maturity assessment indicates the distance from a target state. Few studies test whether the two identify the same organizational weaknesses, a distinction that matters in Indonesia, where POJK No. 11/POJK.03/2022, PADG No. 24 of 2024, and Law No. 27 of 2022 impose obligations on specific risk and control domains rather than on a composite maturity score.

This study therefore integrates ISO/IEC 27005:2022 risk-assessment results with CISA ZTMM v2.0 maturity measurements, analyzed through a People-Process-Technology-Governance (PPTG) lens and benchmarked against NIST SP 800-207 and current Indonesian financial regulations. The inquiry centers on Bank XYZ, an anonymized national commercial bank operating a hybrid cloud infrastructure and holding an active ISO/IEC 27001:2022 certification.

The research proceeds through three analytical phases: mapping the Bank's threat profile via ISO/IEC 27005:2022, measuring Zero Trust readiness via CISA ZTMM v2.0 across its five core pillars and three cross-cutting capabilities, and reading the two results jointly through the PPTG analytical lens against the NIST SP 800-207 target state and prevailing national regulations. The principal contribution is case-based evidence showing how joint risk–maturity analysis can identify specific points where elevated risk and weak maturity coincide, while also revealing cases in which high-risk domains retain relatively high aggregate maturity and the underlying weakness is visible only at the item level.

3.1 Research design and setting

This study uses a qualitative single-case-study design [22], triangulating quantitative and qualitative data. The research was conducted at a national commercial bank with hybrid infrastructure, supervised by the Financial Services Authority and certified to ISO/IEC 27001:2022 for its Mobile Banking and Online Onboarding scope. The evaluation boundary covers components under the Bank's direct operational control and excludes core banking systems operated by third parties.

The first author served as an insider researcher, holding the Chief Information Security Officer (CISO) role at the Bank throughout the study. This position gave direct access to internal policy documents, operational data, and informants with deep working knowledge of the Bank's security practice, but it also carries an evident risk of bias. Six control measures were applied to manage this risk: informant participation was voluntary and anonymized and was not linked to performance evaluation; informants were selected by role relevance rather than reporting relationship to the researcher; findings were triangulated across the seven data sources; the coding and evidence-mapping process was documented as an audit trail; interpretations were confirmed with informants through member checking and discussed with the academic supervisor to counter confirmation, authority, and social-desirability bias; and empirical data are reported separately from researcher interpretation. These measures partially, rather than fully, offset the independence risk: the Risk Management Committee and the Cyber Risk function sit outside the CISO's direct reporting line within the Bank's organizational structure, which gives the validation of Likelihood and Consequence ratings a degree of structural independence, whereas the corroboration by the SOC and DevOps teams and business-unit leads, who are not necessarily independent of the CISO's reporting line, is better read as technical verification of specific evidence, such as vulnerability-assessment findings and phishing-simulation results, than as an independent authority check.

3.2 Research procedure

The study proceeded through a preparatory phase followed by three analytical stages. Throughout all three stages, findings are read against a common reference point: the three-component target-state architecture of NIST SP 800-207 (Policy Engine, Policy Administrator, Policy Enforcement Point), which supplies the vocabulary connecting the risk-domain findings of Stage 1 to the PPTG-pillar findings of Stage 2, rather than being introduced only at the interpretation stage.

The preparatory phase comprised a literature review and preliminary field engagement with the Bank to scope the research problem and confirm access to informants and documentation. Stage 1 applied ISO/IEC 27005:2022 to identify, analyze, and evaluate the Bank's principal threat scenarios, producing a Risk Level classification for each scenario. Stage 2 measured Zero Trust maturity across the five CISA ZTMM v2.0 core pillars and three cross-cutting capabilities using the 45-respondent questionnaire and triangulated evidence; these eight analytical dimensions were then aggregated for case-level comparison and organized into the four PPTG pillars. Stage 3 read the two sets of results jointly, examining where Critical or High risk scenarios were associated with weaker maturity at the domain or item level, and where risk remained elevated despite relatively strong aggregate maturity, interpreted against the NIST SP 800-207 target state and applicable national regulations.

Each stage produced a documented, traceable deliverable: the risk register, the domain and pillar score set, and the joint risk-maturity reading, rather than an undocumented intermediate judgment.

3.3 Instruments and data sources

Data were triangulated from seven instruments during the collection phase: (1) semi-structured interviews with 45 respondents comprising five strategic-level, 17 tactical-level, and 23 operational-level informants, each session exploring risk perception, control practice, and incident history relevant to the informant's role; (2) a 15-item CISA ZTMM v2.0 maturity questionnaire administered to the same 45 respondents; (3) participatory observation of infrastructure configuration and operational routines; (4) analysis of six internal policy and procedure documents; (5) an independent cloud and on-premise vulnerability assessment; (6) Key Risk Indicator (KRI) and IT security dashboard data covering January-April 2026; and (7) an internal phishing-simulation report. The first five instruments informed the risk assessment and the maturity assessment; the KRI dashboard and phishing-simulation data corroborated specific risk scenarios discussed later.

Content validity of the maturity questionnaire was reviewed by two senior information-security practitioners prior to administration. The 15-item instrument showed high pooled internal consistency (Cronbach's alpha, α = 0.932), but this pooled coefficient does not establish reliability at the individual domain level. Domain-level alpha, computed for the six dimensions represented by two or more items, is uneven: Networks (α = 0.813) and Data (α = 0.798) reach levels conventionally regarded as good to acceptable, Identity (α = 0.737) reaches a level conventionally regarded as acceptable, while Governance (α = 0.615), Devices (α = 0.584), and Applications & Workloads (α = 0.563) fall below the 0.70 threshold commonly used for acceptable internal consistency.

Because Devices, Networks, Applications & Workloads, Data, and Governance are each estimated from only two items, their alpha coefficients are statistically less stable than Identity's three-item estimate and should be interpreted with caution regardless of whether they individually clear the 0.70 threshold. Visibility & Analytics and Automation & Orchestration, each measured by a single item, cannot be assessed for internal consistency. Each item was mapped to the corresponding CISA ZTMM v2.0 element based on its technical content, as shown in Table 1. Item allocation is intentionally uneven because CISA ZTMM v2.0 distinguishes five core pillars from three cross-cutting capabilities rather than defining eight equivalent constructs [3]. Accordingly, this study treats the eight elements as eight analytical dimensions for descriptive comparison, not as eight psychometrically equivalent scales. Domain scores are therefore interpreted as indicative composite measures and are triangulated with technical, documentary, observational, and organizational evidence rather than treated as uniformly reliability-validated constructs.

Table 1. Mapping of questionnaire items to CISA Zero Trust Maturity Model (ZTMM) v2.0 domains and dominant People-Process-Technology-Governance (PPTG) pillar

Source: compiled by the authors based on CISA ZTMM v2.0 [3].

Table 2. Wording of the 15-item CISA Zero Trust Maturity Model (ZTMM) v2.0 maturity questionnaire (n = 45 respondents)

Source: developed by the authors based on CISA ZTMM v2.0 [3], administered as a self-assessment questionnaire scored on a four-level scale (Traditional = 1, Initial = 2, Advanced = 3, Optimal = 4).

Table 2 reports the wording of all 15 items is translated from the Indonesian-language instrument administered to respondents; the English wording was prepared by the authors for reporting purposes and was not the version shown to respondents.

Q14 and Q15 are classified under Governance rather than Visibility & Analytics because both measure the presence and enforcement of an organizational policy, vendor access governed by least-privilege (Q14) and application usage governed by an acceptable-use boundary (Q15), rather than a specific infrastructure capability. Q15's wording, "detect and block," reflects policy enforcement rather than the passive telemetry centralization that Visibility & Analytics (Q12) measures.

3.4 Risk identification and scoring procedure

Risk identification and scoring follows the ISO/IEC 27005:2022 process end to end, from establishing the asset context through to a validated Risk Level, in five sequential steps.

Step 1: Identify assets, threats, and vulnerabilities. Risk identification used an asset-based approach: the Bank's hybrid infrastructure was first partitioned into six information-asset categories within the evaluation boundary of the study. For each asset category, threats and vulnerabilities were identified by triangulating the seven data sources, vulnerability-assessment findings, interviews, participatory observation, document analysis, KRI data, and the phishing-simulation report, rather than drawn from a generic threat catalog. Table 3 summarizes the six asset categories, and their associated threats are listed; this identification step produced the four threat scenarios (R-01 to R-04) carried into Steps 2-5.

R-04 (access policy misaligned with identity) cuts across A-01 and A-04, since it concerns the policy governing how external parties reach identity and network assets rather than a single asset category.

Step 2: Rate Likelihood (L). Each of the four scenarios identified in Step 1 is rated on a five-level ordinal scale, from Rare (L = 1) to Almost Certain (L = 5), using evidence recorded in the risk register. The evidence base includes vulnerability-assessment findings, incident or simulation history, observed control effectiveness, and documented threat activity where available. Table 4 defines the observable indicators are defined to distinguish the five levels; the resulting assignments are traceable to the scenario evidence rather than to theoretical estimation alone.

Table 3. Information-asset categories and associated threats (ISO/IEC 27005:2022 identification stage)

Table 4. Likelihood and consequence rating scales (ISO/IEC 27005:2022)

Step 3: Rate Consequence (C). Each scenario is rated on a five-level ordinal scale, from Insignificant (C = 1) to Catastrophic (C = 5), covering financial, operational, legal, and reputational impact. Because the Bank did not maintain documented numeric thresholds for every consequence level at the time of assessment, the scale is explicitly semi-quantitative; the study does not claim that the ratings represent measured probabilities or monetary loss estimates.

These indicators remain semi-quantitative rather than fully quantitative: only the Major consequence level is anchored to a hard numeric threshold (service disruption exceeding 24 hours), since the Bank did not, at the time of assessment, maintain a documented Risk Appetite Statement or KRI dashboard specifying numeric thresholds such as loss amounts or affected-customer counts for every level. The indicators nonetheless make each Likelihood and Consequence assignment traceable to a specific evidentiary condition. To avoid implying false precision, the study reports the resulting ratings as ordinal expert-assessment categories and uses the L × C product only as a consistent classification rule.

Step 4: Compute the Risk Level. A Threat Rating (TR) score is calculated from the Likelihood (L) and Consequence (C) ratings assigned in Steps 2 and 3, as shown in Eq. (1):

$TR=L\times C$        (1)

TR is then classified against a threshold: TR ≥ 16 is Critical, TR 10-15 is High, TR 5-9 is Medium, and TR ≤ 4 is Low. This quantitative threshold supplements the qualitative two-dimensional risk matrix conventionally used under ISO/IEC 27005:2022 and resolves borderline cases consistently.

Step 5: Validate. Because the first author's dual role as CISO and researcher placed sole initial responsibility for the Likelihood and Consequence ratings, each rating was cross-checked against an independent or corroborating source appropriate to the evidence type before being finalized. The Risk Management Committee reviewed the full risk profile in a closed session, providing structural independence from the CISO reporting line, while Strategic-level informants provided additional corroboration. The SOC and DevOps teams verified the technical basis of scenarios tied to vulnerability-assessment findings, and business-unit leads confirmed the phishing-simulation evidence underlying the credential-compromise scenario. These latter groups were not treated as fully independent because they may fall within the CISO's reporting influence. No rating was retained on the researcher's judgment alone. Only scenarios rated Critical or High after validation are carried forward as priority domains for the maturity assessment.

3.5 Maturity scoring procedure

CISA ZTMM v2.0 maturity results and PPTG analytical scores are derived through three sequential steps applied to the 15-item questionnaire (n = 45). The eight CISA elements are retained as analytical dimensions for comparison; the aggregation below does not imply that CISA defines the five core pillars and three cross-cutting capabilities as eight equivalent psychometric constructs.

Step 1: Score each item and compute item statistics. Every respondent rates each of the 15 items on the four-level CISA ZTMM scale (Traditional = 1, Initial = 2, Advanced = 3, Optimal = 4). This produces 45 raw numeric ratings per item, one per respondent, denoted xi for respondent i's rating. Two descriptive statistics are computed directly from these 45 raw ratings for each item: the Item Mean, defined in Eq. (2), and the Item Median.

$Item~Mean=\left( 1/n \right)\times \Sigma x,~n=45$          (2)

The two statistics serve different purposes and are not interchangeable. The Median is reported per item as the primary statistic for labeling that item's qualitative maturity level (for example, a Median of 3.0 is labeled "Advanced"), following established guidance that the Median rather than the Mean is the appropriate central-tendency statistic for assigning a category to ordinal Likert-type data [23, 24]. The Mean, by contrast, is the statistic carried forward into Step 2 to build the domain-level composite index, because averaging several items into one domain score is an arithmetic aggregation task for which the Mean is the conventional and more distribution-sensitive choice. This dual use, Median for per-item labeling, Mean for cross-item aggregation, follows standard practice for composite indices built from ordinal survey items. Table 5 reports both statistics, alongside the standard deviation, are computed directly from the n = 45 raw responses for all 15 items.

Q13 is the only item with a Median below 3.0 (Initial rather than Advanced) and also records the lowest Mean (2.42) and the second-highest standard deviation among the 15 items (SD = 1.011, after Q3's 1.031), indicating that low ratings dominate but a minority of Operational-level respondents rated it higher, a pattern examined further below. The Mean for each item is not a single respondent's answer or an assumption; it is the arithmetic average of that item's 45 individual numeric ratings. Because the 45 respondents are not a homogeneous group, they span five Strategic, 17 Tactical, and 23 Operational informants with different vantage points on the same systems, the same item mean can be produced by very different underlying response patterns.

Table 6 decomposes each domain’s score by hierarchical level, using the mean of that level's respondents on the domain's mapped items, to show how the ratings that feed the item means are distributed across the organization rather than concentrated in one group.

Table 5. Item-level descriptive statistics and maturity level (n = 45)

Table 6. Domain scores by hierarchical respondent level (unweighted level means)

Two patterns stand out. First, Tactical-level respondents rate every domain at or below the Strategic-level rating, and often well below the Operational-level rating; this group has direct operational visibility into implementation gaps without either the Strategic level's summary reporting or the Operational level's hands-on familiarity with day-to-day workarounds, a pattern consistent with the caution against unvalidated self-assessment raised by Yeoh et al. [6]. Second, Automation & Orchestration is the only domain where Strategic and Tactical respondents agree exactly (2.00), indicating that this weakness is recognized at the leadership level rather than being visible only to operational staff. The domain scores used in the remainder of the analysis are computed from the pooled n = 45 response-level data, not from averaging the three level columns; the level breakdown here is diagnostic context, not an alternative calculation path.

These descriptive patterns were checked against inferential testing. A Kruskal-Wallis test comparing the three hierarchical levels found a statistically significant difference in only two of the eight domains: Networks (H = 8.44, p = .015) and Automation & Orchestration (H = 7.14, p = .028); the remaining six domains showed no significant level-based difference (p > .05). Post-hoc Mann-Whitney U tests on these two domains located the significant difference specifically between the Tactical and Operational levels: Networks (U = 91.5, p = .003) and Automation & Orchestration (U = 107.5, p = .013). This result narrows the first pattern above: Tactical-level respondents rating most domains lower is a consistent descriptive trend across level breakdown, but it reaches statistical significance only for Networks and Automation & Orchestration, and specifically as a Tactical-versus-Operational gap rather than a Tactical-versus-Strategic one. This check is exploratory and complements the qualitative-quantitative triangulation central to the study's single-case design; it is not an inferential hypothesis test that the design was powered to support, and it is reported here to substantiate, rather than to independently establish, the level-based patterns visible in the level breakdown.

Step 2: Aggregate items to analytical-dimension scores. Each item is pre-mapped to one of the five CISA ZTMM v2.0 core pillars or three cross-cutting capabilities. A dimension score is the average of the Item Mean values from Step 1 for its mapped items, as shown in Eq. (3), where k is the number of items mapped to that CISA element. This equal item contribution is an analytical convention for descriptive comparison; it is not presented as a CISA-defined weighting scheme.

$Domain~score=(1 / k) \times \Sigma Item ~Mean { }_{\mathrm{i}}$          (3)

Because each Item Mean is itself already an average of the same 45 individual respondents, averaging Item Means within a domain is mathematically equivalent to computing one combined mean directly from all of that domain's individual ratings, in turn equivalent to a proportional weighted average across the three hierarchical strata (5 Strategic, 17 Tactical, 23 Operational respondents) rather than an unweighted average of three separately computed level means; this prevents the five Strategic responses from being over-weighted relative to the 23 Operational responses. Table 7 shows this computation using the Item Mean values from Step 1. Domain scores are computed from Item Means carried at full arithmetic precision, not from the two-decimal values displayed in Table 5; consequently, a domain score will not always reproduce exactly from multiplying or averaging Table 5's rounded display values by hand (for example, Networks averages Q6 and Q7 at full precision, 2.8667 and 2.7778, to 2.822, which rounds to 2.82, rather than averaging the rounded 2.87 and 2.78 shown in Table 5, which would round to 2.83).

Step 3: Aggregate analytical dimensions to PPTG pillars. Each CISA dimension is assigned to the PPTG organizational dimension primarily responsible for implementing or governing it. People, Process, and Governance each receive explicitly assigned dimensions; Visibility & Analytics is treated as cross-cutting and therefore contributes 0.5 to Process and 0.5 to Technology. The 0.5/0.5 allocation is a transparent non-preferential convention adopted because the study has no empirical basis in this single case for assigning a different organizational weight. The pillar score is the weighted mean of the contributing dimension scores, as shown in Eq. (4). This PPTG aggregation is an analytical device developed for this study and should not be interpreted as a formal component structure of CISA ZTMM or NIST SP 800-207.

$Pillar~score =(1 / m) \times \Sigma Domain~score { }_{\mathrm{j}}$            (4)

Table 8 shows this aggregation explicitly. The pillar scores were computed as People = Identity (2.90); Process = (Applications & Workloads + Automation & Orchestration + 0.5 × Visibility & Analytics) / 2.5 = (2.89 + 2.42 + 1.39) / 2.5 = 2.68; Technology = (Devices + Networks + Data + 0.5 × Visibility & Analytics) / 3.5 = (2.68 + 2.82 + 2.81 + 1.39) / 3.5 = 2.77; and Governance = 2.83. The overall analytical mean of 2.77 is calculated separately as the equal mean of the eight analytical-dimension scores. It is used only as a descriptive case-level benchmark against the 3.00 Advanced reference point; neither the 2.77 index nor the PPTG pillar scores are presented as CISA-defined composite metrics.

Table 7. Domain score computation from item-level response means (n = 45)

Table 8. People-Process-Technology-Governance (PPTG) pillar score computation from domain scores

Visibility & Analytics is split evenly across the Process and Technology pillars, consistent with its dual classification in the item mapping and with CISA ZTMM v2.0's characterization of Visibility & Analytics as a cross-cutting capability not uniquely anchored to one organizational pillar.

Self-reported questionnaire scores in both tables were cross-checked against the vulnerability-assessment and document-analysis evidence, consistent with recommended practice for guarding against self-assessment overestimation [21]. The resulting values are the domain and pillar scores.

This study integrated ISO/IEC 27005:2022 risk assessment with CISA ZTMM v2.0 maturity assessment to evaluate Zero Trust readiness in a national commercial bank operating a hybrid infrastructure. The assessment identified three Critical and one High risk scenarios, while the overall analytical maturity mean reached 2.77 out of 4. Automation & Orchestration recorded the Bank's lowest analytical dimension score (2.42), contributing to Process being the lowest of the four PPTG pillars (2.68), although only modestly below Technology (2.77) and Governance (2.83). Reading risk and maturity together shows that convergence is selective rather than uniform: Automation & Orchestration clearly combines elevated risk relevance with the weakest maturity, while several other risk-implicated dimensions retain relatively high aggregate scores. Item-level analysis nevertheless exposes specific weaknesses, such as Q3 user-behavior analytics, that aggregate dimension scores can mask. The principal implication is therefore methodological: risk and maturity assessments are most informative when read jointly at both aggregate and item levels.

This study shows that risk assessment and maturity assessment should be interpreted together because each provides different insights into an organization's security posture. A maturity score alone may overlook Critical exposure, whereas a risk assessment identifies urgent issues without explaining the procedural factors behind them. Integrating both assessments through the People, Process, Technology, and Governance perspective provides a more effective basis for prioritizing Zero Trust implementation. Although this assessment approach can be applied in other organizations, the results reported in this study are specific to the investigated bank.

This study is limited by its single-case design, the use of partially self-reported maturity data, and the first author's dual role as CISO and researcher. A further instrument limitation concerns reliability: domain-level Cronbach's alpha, computed for the six dimensions with two or more items, ranges from 0.563 (Applications & Workloads) to 0.813 (Networks), with three dimensions, Devices, Applications & Workloads, and Governance, falling below the 0.70 threshold conventionally used for acceptable internal consistency; Visibility & Analytics and Automation & Orchestration, each measured by a single item, cannot be assessed for internal consistency. The pooled α=.932 should therefore not be interpreted as evidence that all eight analytical dimensions are equally reliable. Dimension and pillar scores are interpreted as indicative composite measures rather than uniformly reliability-validated scales, with corroborating evidence used to strengthen interpretation of the single-item dimensions. Validation drawing on the Risk Management Committee and the Cyber Risk function, both outside the CISO's direct reporting line, offers a degree of structural independence, but corroboration from the SOC, DevOps, and business-unit informants, who are not necessarily independent of that reporting line, cannot be treated as equivalent to an external check. The PPTG mapping and 0.5/0.5 allocation for Visibility & Analytics are analytical conventions developed for this case rather than formal CISA or NIST structures. Future studies should engage an assessor entirely external to the organization, expand and psychometrically refine the questionnaire to strengthen item-level reliability across all eight analytical dimensions, validate the integrated approach across multiple banking institutions, and develop empirically justified weighting or quantitative prioritization models for Zero Trust implementation planning.

The item-, domain-, and pillar-level results are available from the corresponding author on reasonable request. Interview transcripts, internal incident and audit documents, and individual questionnaire responses remain confidential under the Bank’s data-sharing terms and are not publicly deposited.