IndonesiaOJK Regulation on Information Technology in Commercial Banks, Cyber Resilience and Cyber Security Testing
In force.
A sector security regimes rule binding private bodies.
- Private right of action
- No
- Instrument type
- a regulation made under an act
- Obligation class
- Security, Governance
As of .
What it requires
- This binds a commercial bank (Bank Umum), conventional or sharia, which includes the branch office of a bank domiciled abroad and a sharia business unit (reached by declaring that you are a bank).
- Maintain cyber resilience through processes that at least cover identifying assets, threats and vulnerabilities, protecting assets, detecting cyber incidents, and responding to and recovering from cyber incidents, supported by an adequate cyber resilience information system (Article 21).
- Carry out a self-assessment of your cyber security maturity level every year, as at the end of December, and submit the result to the Financial Services Authority as part of your current IT report (Article 22(1), (2) and (4)).
- Test your cyber security on the basis of vulnerability analysis, periodically, and on the basis of scenarios, at least once in one year, and submit the vulnerability-analysis results to the Financial Services Authority as part of your current IT report (Articles 23, 24 and 25(1)).
- Report the result of scenario-based cyber security testing to the Financial Services Authority within 10 working days after the testing is completed (Article 25(3)).
- Form a unit or function that handles your cyber resilience and cyber security and is independent of your IT management function (Article 26).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Financial Services Authority (Otoritas Jasa Keuangan), which imposes the administrative sanctions in Article 27: a written warning and, where the bank has still not complied, a ban on issuing new products, a freeze on certain business activities, or a lower governance score in its soundness rating.
Settledness
- As of
- Open questions
- What period counts as 'periodically' for the vulnerability-analysis testing that Article 24(1) requires, given that the Regulation states no interval?
What this law does
Article 21(1) requires a commercial bank to maintain cyber resilience, through processes that at least cover identifying assets, threats and vulnerabilities, protecting assets, detecting cyber incidents, and responding to and recovering from cyber incidents. Article 22(1) requires a commercial bank to carry out a self-assessment of its cyber security maturity level annually, as at the end of December.
Article 22(4) requires the bank to submit the result of that self-assessment to the Financial Services Authority as part of its current IT report. Article 23 requires a commercial bank to test its cyber security on the basis of vulnerability analysis and scenarios. Article 24(1) requires vulnerability-analysis testing to be carried out periodically. Article 25(1) requires scenario-based cyber security testing at least once in one year.
Article 25(3) requires the bank to report the result of scenario-based testing to the Financial Services Authority within 10 working days after the testing is completed. Article 26 requires a commercial bank to form a unit or function that handles cyber resilience and cyber security and is independent of the IT management function.
Article 27 provides for a written warning for a bank that violates Article 21(1), 22(1), 22(4), 23, 24, 25(1) or 26(1), and, if the bank has still not complied, a ban on issuing new products, a freeze on certain business activities, or a lower governance score in its soundness rating. The Regulation applies to a commercial bank, which includes the branch office of a bank domiciled abroad and a sharia business unit.
Article 73 provides that the Regulation takes effect after three months from the date of its promulgation. The Regulation was promulgated in Jakarta on .
When LexLint raises it
When your app profile says your app is a bank.