Is a bank, in Indonesia

Government Regulation No. 71 of 2019 (PP PSTE), Pasal 24(3) · Read the law's page

• On a system failure or disruption with a serious impact resulting from another party's act against your Electronic System, such as an attack or intrusion, secure the affected Electronic Information and/or Electronic Document.
• Report the incident immediately, at the first opportunity, to law enforcement officials and the relevant Ministry or Agency; the Government Regulation states no numeric clock for this report, only immediacy.
• A violation can draw the same Article 100 administrative sanctions (written warning, an administrative fine of an amount this Government Regulation does not itself fix, temporary suspension, access termination, or removal from the operator registry) as this jurisdiction's security-system duty.
• This binds the same Electronic System Operator as this jurisdiction's Article 23/24(1)-(2) security-system duty; it adds an incident-reporting duty rather than reaching a different party.

Peraturan Presiden Nomor 82 Tahun 2022 tentang Pelindungan Infrastruktur Informasi Vital, Pasal 1, 4, 6, 9, 10, 12 dan 22 · Read the law's page

• This binds an operator of vital information infrastructure, a state body, business entity or organization that a ministry or agency has designated as the operator of an electronic system in the energy and mineral resources, transportation, finance, health, information and communication technology, food, defense or government administration sector (reached by declaring that you operate an essential service, with the finance and health sectors reached by declaring that you provide financial services or handle health records). It applies from 24 May 2022 (article 27).
• If you operate an electronic system in a vital sector, whether or not a ministry or agency has yet designated you, identify your vital information infrastructure at least once a year and report the result with the relevant information to your sector's ministry or agency (article 6).
• Apply the information security standards and other security standards set by the ministry, agency or the National Cyber and Crypto Agency (article 9).
• Apply cybersecurity risk management effectively and report the result to the ministry or agency (article 10).
• Form an organizational Cyber Incident Response Team (article 12).
• Measure your cybersecurity maturity yourself at least once a year and report the result to the ministry or agency (article 22).

Peraturan Presiden Nomor 82 Tahun 2022 tentang Pelindungan Infrastruktur Informasi Vital, Pasal 13 dan 14 · Read the law's page

• This binds an operator of vital information infrastructure, a state body, business entity or organization that a ministry or agency has designated as the operator of an electronic system in a vital sector (reached by declaring that you operate an essential service, with the finance and health sectors reached by declaring that you provide financial services or handle health records). It applies from 24 May 2022 (article 27).
• Report each cyber incident on your vital information infrastructure to your sector's incident response team, copied to the national team, no later than 24 hours after it is found, or to the ministry or agency of your sector where no sectoral team has been formed (article 13).
• Handle each cyber incident on your vital information infrastructure through your organizational Cyber Incident Response Team, with recovery, notice to the parties concerned and dissemination of information (article 14).

Peraturan Otoritas Jasa Keuangan Nomor 11/POJK.03/2022 tentang Penyelenggaraan Teknologi Informasi oleh Bank Umum, arts. 21 to 27 · Read the law's page

• This binds a commercial bank (Bank Umum), conventional or sharia, which includes the branch office of a bank domiciled abroad and a sharia business unit (reached by declaring that you are a bank).
• Maintain cyber resilience through processes that at least cover identifying assets, threats and vulnerabilities, protecting assets, detecting cyber incidents, and responding to and recovering from cyber incidents, supported by an adequate cyber resilience information system (Article 21).
• Carry out a self-assessment of your cyber security maturity level every year, as at the end of December, and submit the result to the Financial Services Authority as part of your current IT report (Article 22(1), (2) and (4)).
• Test your cyber security on the basis of vulnerability analysis, periodically, and on the basis of scenarios, at least once in one year, and submit the vulnerability-analysis results to the Financial Services Authority as part of your current IT report (Articles 23, 24 and 25(1)).
• Report the result of scenario-based cyber security testing to the Financial Services Authority within 10 working days after the testing is completed (Article 25(3)).
• Form a unit or function that handles your cyber resilience and cyber security and is independent of your IT management function (Article 26).

Peraturan Otoritas Jasa Keuangan Nomor 11/POJK.03/2022 tentang Penyelenggaraan Teknologi Informasi oleh Bank Umum, arts. 60 and 63 · Read the law's page

• This binds a commercial bank (Bank Umum), conventional or sharia, which includes the branch office of a bank domiciled abroad and a sharia business unit (reached by declaring that you are a bank).
• Where an IT incident has or may have caused a significant loss or disrupted the smooth running of your operations, send the Financial Services Authority an initial notification within 24 hours after the incident becomes known, and an IT incident report within 5 working days after it becomes known (Article 60(1)). An IT incident is a critical event, misuse or crime in the operation of IT, in the form of a cyber incident or a non-cyber incident (elucidation of Article 60(1)).
• Send the initial notification in writing by electronic means, on the basis of the initial information available (Article 60(2)).
• Where another authority's rules set a faster deadline for the notification or report than Article 60(1), also send it to the Financial Services Authority at the same time as you send it to that authority (Article 60(4)).