Manajemen Risiko Serangan Siber Menggunakan Framework NIST Cybersecurity Framework 2.0 pada Layanan Website di Kampus XYZ

The digitalization of academic services in Indonesian higher education has widened cybersecurity exposure, as reflected in the rising national network traffic anomalies reported by Indonesia's National Cyber and Crypto Agency (BSSN). A large public university, anonymized here as Campus XYZ, has experienced several real incidents, from academic-portal data exposure and website defacement to a Distributed Denial of Service (DDoS) attack that disrupted its server infrastructure for nearly a week. This study develops a cybersecurity risk management profile for the university's website services using the NIST Cybersecurity Framework (CSF) 2.0, combined with authorized technical testing through OWASP ZAP and Nikto and vulnerability scoring based on CVSS v3.1. The research follows the seven-step NIST CSF 2.0 implementation process, from Prioritize and Scope to Implementation Action Plan, with data collected through purposive interviews with six UPT TIK informants, field observation, document review, and an unauthenticated vulnerability assessment of the institution's public domains conducted with institutional permission. The study produces a Current Profile at an average of Tier 1.17 (Partial), a Target Profile of Tier 2.33, a risk-prioritized gap analysis (average gap of 1.17 Tier, largest on the Govern function), and a three-phase roadmap (0-24 months) of 22 action items. The roadmap is formulated as a target to help raise the institution's cybersecurity posture; its actual implementation and post-implementation evaluation are beyond the scope of this study. To protect the institution, specific domain names and vulnerability identifiers are anonymized.