Improving Cyber Security Incident Response Maturity of XYZ Organization Using TMPI

This thesis proposes to analyze how an organization can determine the condition of its incident handling capability and how an organization can plan activities for improvement and its relation to increasing resilience of an organization. The method to answer this question, the researcher measures the existing and expected capabilities of handling organizational incidents by using TMPI. The GAP obtained can be made recommendations based on the TMPI with reference to the specified Targets or Expectations. GAP is also analyzed with IPA (Imprortant Performance Analysis) to determine priority scale. In this research, the recommendation from TMPI is tested on the CRR (Cyber Resilience Review) to see if there is an improvement on the resilience side. The evaluation and validation process is carried out using the Interview and FGD method with SME (Subject Matter Experts). The results of the research show that TMPI can measure the current condition of an organization's incident handling ability so that a work plan recommendation can be prepared to improve its ability to refer to TMPI according to the desired target. With IPA it can be described Mapping of the priority areas for improvement, namely Post Incident Review, Lesson Learn, Maturity assessment, Threat analysis, Trend Analysis, The Recovery. The results also reveal that from the recommendations for increasing TMPI when measured by CRR, there is an increase in resilience in the Situational Awareness area was an increase of 66%, Incident Management 52%, External Dependency Management 23%, Training and Awareness 17% and the last is Service Continuity Management 8%. However, this thesis has not discussed in the Reality area in resilience. Such as how to apply Protection, Sustainability and Detection to protected assets in accordance with the Organization in cases faced by the organization in improving resilience operations. From the perspective of operational resilience, this study needs to be complemented by Resilience in the Realibility area, This is important because the organization cannot secure everything but the important thing is how the operational organization is running well and security can still be controlled