Assessing CI/CD Pipeline Governance Maturity Using the ITIL v4 Framework: A Case Study of an Indonesian Digital Wallet

Garvin Moses Tanuwihardjo; Sfenrianto Sfenrianto

doi:10.59261/jequi.v8i4.410

Authors

Garvin Moses Tanuwihardjo Universitas Bina Nusantara
Sfenrianto Sfenrianto Universitas Bina Nusantara

DOI:

https://doi.org/10.59261/jequi.v8i4.410

Keywords:

CI/CD, Fintech, IT Governance, ITIL v4, Maturity Assessment

Abstract

Background: Digital wallet services depend on frequent software delivery while operating under stringent requirements for availability, security, and accountability. In such environments, extensive CI/CD automation does not necessarily imply an equally mature governance framework.

Objective: This study assesses the extent to which technical automation in a CI/CD pipeline is accompanied by mature governance practices in an Indonesian digital wallet organization using five ITIL 4 practice domains.

Methods: A single-case mixed-methods design combined Likert-scale maturity scoring with semistructured interviews, direct observation, and document review. The assessment covered Change Enablement, Release Management, Deployment Management, Continual Improvement, and Information Security Management, with quantitative findings triangulated against operational evidence.

Results: Change Enablement (3.4), Release Management (3.0), Deployment Management (3.4), and Information Security Management (3.2) were classified at the Defined maturity level, whereas Continual Improvement (2.6) remained at the Repeatable maturity level. Gap analysis against an ideal score of 4.5 identified the largest gap in Continual Improvement (1.9), followed by Release Management (1.5), Information Security Management (1.3), and Change Enablement and Deployment Management (1.1 each).

Conclusion: The case demonstrates that substantial CI/CD automation can coexist with uneven governance maturity. Governance is comparatively standardized across change, release, deployment, and security practices, but continual improvement remains less institutionalized, indicating that technical capabilities have advanced faster than systematic organizational learning and performance improvement.

Downloads

Download data is not yet available.

References

Baradari, I., Shoar, M., & Nezafati, N. (2023). Defining the relationship between IT Service management and knowledge management: Towards improved performance. Knowledge Management Research & Practice, 21(2), 384–396. https://doi.org/10.1080/14778238.2021.1903349

Belmonte, Z. J. A., Prasetyo, Y. T., Cahigas, M. M. L., Nadlifatin, R., & Gumasing, M. J. J. (2024). Factors influencing the intention to use e-wallet among generation Z and millennials in the Philippines: An extended technology acceptance model (TAM) approach. Acta Psychologica, 250, 104526. https://doi.org/10.1016/j.actpsy.2024.104526

Capatina, A., Juarez-Varon, D., Micu, A., & Micu, A. E. (2024). Leveling up in corporate training: Unveiling the power of gamification to enhance knowledge retention, knowledge sharing, and job performance. Journal of Innovation & Knowledge, 9(3), 100530.

Denny, E., & Weckesser, A. (2022). How to do qualitative research? Qualitative research methods. BJOG: An International Journal of Obstetrics & Gynaecology, 129(7), 1166–1167. https://doi.org/10.1111/1471-0528.17150

Ernawati, Y., & Wang, G. (2023). Assessing IT services management with ITIL framework V3: A case study. Journal of System and Management Sciences, 13(4), 152–164. https://doi.org/10.33168/JSMS.2023.0409

Fluri, J., Fornari, F., & Pustulka, E. (2024). On the importance of CI/CD practices for database applications. Journal of Software: Evolution and Process, 36(12), e2720. https://doi.org/10.1002/smr.2720

Gazi, M. A. I., Al Mamun, A., Al Masud, A., Senathirajah, A. R. bin S., & Rahman, T. (2024). The relationship between CRM, knowledge management, organization commitment, customer profitability and customer loyalty in telecommunication industry: The mediating role of customer satisfaction and the moderating role of brand image. Journal of Open Innovation: Technology, Market, and Complexity, 10(1), 100227.

Ghaleb, T. A., Abduljalil, O., & Hassan, S. (2026). CI/CD Configuration Practices in Open Source Android Apps: An Empirical Study. ACM Transactions on Software Engineering and Methodology, 35(2), 1–40. https://doi.org/10.1145/3736758

Hamsavath, P. N., Katti, V. S., & Pathak, A. (2025). Automated CI/CD Pipeline: A DevOps Approach for Deploy Containerized Applications. Advances in Communication and Applications: Proceedings of ERCICA 2024, Volume 2, 1398, 201–210. https://doi.org/10.1007/978-981-96-4679-1_17

Loureiro, E., Gomes, B., Varajão, J., & Silva, C. (2024). Information systems project success surveys - Insights from the last 30 years. Heliyon, 10(23), e40619. https://doi.org/10.1016/j.heliyon.2024.e40619

Manolov, V., Gotseva, D., & Hinov, N. (2025). Practical Comparison Between the CI/CD Platforms Azure DevOps and GitHub. Future Internet, 17(4), 153. https://doi.org/10.3390/fi17040153

Naeem, M., Ozuem, W., Howell, K., & Ranfagni, S. (2023). A Step-by-Step Process of Thematic Analysis to Develop a Conceptual Model in Qualitative Research. International Journal of Qualitative Methods, 22, 1–18. https://doi.org/10.1177/16094069231205789

Pan, Z., Shen, W., Wang, X., Yang, Y., Chang, R., Liu, Y., Liu, C., Liu, Y., & Ren, K. (2024). Ambush From All Sides: Understanding Security Threats in Open-Source Software CI/CD Pipelines. IEEE Transactions on Dependable and Secure Computing, 21(1), 403–418. https://doi.org/10.1109/TDSC.2023.3253572

Rostami Mazrae, P., Mens, T., Golzadeh, M., & Decan, A. (2023). On the usage, co-usage and migration of CI/CD tools: A qualitative analysis. Empirical Software Engineering, 28(2), 52. https://doi.org/10.1007/s10664-022-10285-5

Saleh, S. M., Madhavji, N., & Steinbacher, J. (2024). A Systematic Literature Review on Continuous Integration and Deployment (CI/CD) for Secure Cloud Computing. Proceedings of the 20th International Conference on Web Information Systems and Technologies (WEBIST 2024), 331–341. https://doi.org/10.5220/0013018500003825

Santosa, I., & Mulyana, R. (2023). The IT Services Management Architecture Design for Large and Medium-sized Companies based on ITIL 4 and TOGAF Framework. JOIV: International Journal on Informatics Visualization, 7(1), 30–36. https://doi.org/10.30630/joiv.7.1.1590

Stamme, F. (2022). Literature Review on Agile IT-Service Management. In Seminar IT-Management in the Digital Age (Winter 2022). FH Wedel. https://www.fh-wedel.de/fileadmin/Mitarbeiter/Records/Stamme_2023_-_Literature_Review_on_Agile_IT-Service_Management.pdf

Truong, B. T. T., Nguyen, P. V, & Vrontis, D. (2024). Enhancing firm performance through innovation: the roles of intellectual capital, government support, knowledge sharing and knowledge management success. Journal of Intellectual Capital, 25(1), 188–209.

Wright, R., Chapla, K., Booth, A., Nelson, K. E., Peeler, A., Swain, C., Won, S., & Wu, D. S. (2026). Enhancing rigor, quality, and patient engagement in qualitative research: A step-by-step guide to applying reflexive thematic analysis to the experience-based co-design methodology. Qualitative Health Research, 36(9), 915–930.

Zmuda, R., Graves, R., Shepherd, M., & Brookes, S. (2025). SoK: Understanding CI/CD Security: A Comprehensive Review of Architecture, Attacks, and Defenses. 2025 IEEE Secure Development Conference (SecDev), 58–68.