The more sophisticated a technology, the more possible vulnerabilities that will arise during the use of that technology. Information systems require good management in order to run optimally. For each possible vulnerability, system managers must know how to prevent, reduce, avoid, or even accept the impacts that arise as a result of these vulnerabilities, so that system management is needed, which is often called risk management. Knowing the possible risks that arise in the implementation of this information system will make it easier for companies to form strategies and increase the success and sustainability of the organization's vision and mission.