IndonesiaPresidential Regulation 82 of 2022, reporting of cyber incidents on vital information infrastructure
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2024. Publisher's page: https://peraturan.bpk.go.id/Download/205174/Perpres%20Nomor%2082%20Tahun%202022.pdfIn force since .
A vulnerability and incident reporting rule binding public and private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Reporting
As of .
What it requires
- This binds an operator of vital information infrastructure, a state body, business entity or organization that a ministry or agency has designated as the operator of an electronic system in a vital sector (reached by declaring that you operate an essential service, with the finance and health sectors reached by declaring that you provide financial services or handle health records). It applies from (article 27).
- Report each cyber incident on your vital information infrastructure to your sector's incident response team, copied to the national team, no later than 24 hours after it is found, or to the ministry or agency of your sector where no sectoral team has been formed (article 13).
- Handle each cyber incident on your vital information infrastructure through your organizational Cyber Incident Response Team, with recovery, notice to the parties concerned and dissemination of information (article 14).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The ministry or agency that supervises and regulates the operator's sector (article 1, item 7).
What this law does
Article 13 requires the organizational Cyber Incident Response Team to report a cyber incident on vital information infrastructure to the sectoral team. Article 13 sets the deadline for that report at no later than 24 hours after the incident is found. Article 13 has the report go to the ministry or agency of the sector where no sectoral team has been formed. Article 14 requires the organizational team to handle the cyber incident on the infrastructure within its organization. The Regulation was promulgated at Jakarta on .
When LexLint raises it
When your app profile says your app runs an essential service, provides financial services or handles health records.