Duty LXD-7117
Runs an essential service, in Indonesia
Government Regulation on the Operation of Electronic Systems and Transactions, security-incident reporting dutysince 3 lines
Government Regulation No. 71 of 2019 (PP PSTE), Pasal 24(3) · Read the law's page
- On a system failure or disruption with a serious impact resulting from another party's act against your Electronic System, such as an attack or intrusion, secure the affected Electronic Information and/or Electronic Document.
- Report the incident immediately, at the first opportunity, to law enforcement officials and the relevant Ministry or Agency; the Government Regulation states no numeric clock for this report, only immediacy.
- A violation can draw the same Article 100 administrative sanctions (written warning, an administrative fine of an amount this Government Regulation does not itself fix, temporary suspension, access termination, or removal from the operator registry) as this jurisdiction's security-system duty.
- This binds the same Electronic System Operator as this jurisdiction's Article 23/24(1)-(2) security-system duty; it adds an incident-reporting duty rather than reaching a different party.
Presidential Regulation 82 of 2022, protection of vital information infrastructuresince 6 lines
Peraturan Presiden Nomor 82 Tahun 2022 tentang Pelindungan Infrastruktur Informasi Vital, Pasal 1, 4, 6, 9, 10, 12 dan 22 · Read the law's page
- This binds an operator of vital information infrastructure, a state body, business entity or organization that a ministry or agency has designated as the operator of an electronic system in the energy and mineral resources, transportation, finance, health, information and communication technology, food, defense or government administration sector (reached by declaring that you operate an essential service, with the finance and health sectors reached by declaring that you provide financial services or handle health records). It applies from (article 27).
- If you operate an electronic system in a vital sector, whether or not a ministry or agency has yet designated you, identify your vital information infrastructure at least once a year and report the result with the relevant information to your sector's ministry or agency (article 6).
- Apply the information security standards and other security standards set by the ministry, agency or the National Cyber and Crypto Agency (article 9).
- Apply cybersecurity risk management effectively and report the result to the ministry or agency (article 10).
- Form an organizational Cyber Incident Response Team (article 12).
- Measure your cybersecurity maturity yourself at least once a year and report the result to the ministry or agency (article 22).
Presidential Regulation 82 of 2022, reporting of cyber incidents on vital information infrastructuresince 3 lines
Peraturan Presiden Nomor 82 Tahun 2022 tentang Pelindungan Infrastruktur Informasi Vital, Pasal 13 dan 14 · Read the law's page
- This binds an operator of vital information infrastructure, a state body, business entity or organization that a ministry or agency has designated as the operator of an electronic system in a vital sector (reached by declaring that you operate an essential service, with the finance and health sectors reached by declaring that you provide financial services or handle health records). It applies from (article 27).
- Report each cyber incident on your vital information infrastructure to your sector's incident response team, copied to the national team, no later than 24 hours after it is found, or to the ministry or agency of your sector where no sectoral team has been formed (article 13).
- Handle each cyber incident on your vital information infrastructure through your organizational Cyber Incident Response Team, with recovery, notice to the parties concerned and dissemination of information (article 14).