Currently, information has become a commodity or basic need, it can even be said that we are already in an "information-based social" era. It is undeniable that the ability to access and ensure the availability of information quickly and accurately has become a very essential component for an organization, whether in the form of social or commercial organizations, educational institutions such as universities, government agencies, and individuals. Various channels were created to regulate access rights to information, to prevent unauthorized people from accessing it, to minimize losses for the owner of the information. Based on the results of interviews with the research object of XX college, there are still frequent disruptions to information system security such as attacks on servers that result in server downtime, attacks on institutional e-mails that result in being unable to receive or even send e-mails, and other disturbances. This certainly harms information services at the tertiary institution, therefore an information system security audit is required. This study aims to measure the level of information system security capabilities using the Cobit 5 framework in the APO13 and DSS05 domains. Based on the results of the audit, it was found that the GAP value was 3.6 for the APO13 domain or at level 1 while 3.4 for the GAP DSS05 value or at level 2, it can be concluded that the information system security maturity level is still very low so that it needs improvement. It is recommended to make SOPs and documentation of maintenance, control, and periodic security evaluation, install an antivirus that has high and up to date protection accuracy, and make regular maintenance reports both on software and hardware.

For a company, employees are the spearhead for the company because they have a function as Customer Service, customer satisfaction is obtained after interacting with the company through the performance of its employees. Employees are expected to meet all customer needs with the applicable regulations in the company and become a source of income for the company. To get reliable employees, one way is to assess the suitability of their placement in the appropriate position. With the assessment of the suitability of positioning, companies can consider and determine the provision of rewards, promotions, punishments, training, coaching, counseling, or transfers for their employees. The choice of method used to assess the suitability of employee placement in a company is Fuzzy Mamdani. With the Fuzzy Mamdani method, a system that is completely measurable and human assessments that tend to be immeasurable can be bridged. Assessment of the suitability of employee placement using the resulting fuzzy method, is expected to be an alternative solution for companies to give positions to their employees.

The implementation of IT requires good IT governance mechanisms to conduct comprehensive oversight so that the business goals of an organization can truly be achieved effectively and efficiently. All levels of IT managers must understand that risk is uncertain and harms a goal to be achieved. Risk can be a big challenge for any organization or institution that must be able to perform risk management as best it can. With well-managed risk management, it will be able to protect IT assets and add value to IT management. STIKES Garuda Putih is one of the nonprofit organizations that operate in the field of health education. To ensure excellent service for all communities and stakeholders related to IT services, it is necessary to conduct IT governance analysis activities to see if it is working properly. The analysis activity will be done using the COBIT framework 5. In this study, the capability model as a measuring tool for respondents' answers from the questionnaire is made based on the cobit framework 5. Based on the results of the process maturity level analysis on IT management (capability) is in the 3.6 to 1.4 the gap, so that concluded that IT governance has been implemented, but there is still the domain must be improved to achieve the maximum level. It is recommended that SOPs and IT performance management achievement reports, IT risk management, IT management strategy improvement, and the need for an internal control structure of IT governance be established