IndonesiaPresidential Regulation 82 of 2022, protection of vital information infrastructure
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2024. Publisher's page: https://peraturan.bpk.go.id/Download/205174/Perpres%20Nomor%2082%20Tahun%202022.pdfIn force since .
A sector security regimes rule binding public and private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Security, Governance
As of .
What it requires
- This binds an operator of vital information infrastructure, a state body, business entity or organization that a ministry or agency has designated as the operator of an electronic system in the energy and mineral resources, transportation, finance, health, information and communication technology, food, defense or government administration sector (reached by declaring that you operate an essential service, with the finance and health sectors reached by declaring that you provide financial services or handle health records). It applies from (article 27).
- Identify your vital information infrastructure at least once a year and report the result with the relevant information to your sector's ministry or agency (article 6).
- Apply the information security standards and other security standards set by the ministry, agency or the National Cyber and Crypto Agency (article 9).
- Apply cybersecurity risk management effectively and report the result to the ministry or agency (article 10).
- Form an organizational Cyber Incident Response Team (article 12).
- Measure your cybersecurity maturity yourself at least once a year and report the result to the ministry or agency (article 22).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The ministry or agency that supervises and regulates the operator's sector (article 1, item 7).
What this law does
Article 1 defines an operator of vital information infrastructure as a state body, business entity or organization that owns or operates vital information infrastructure. Article 4 lists the sectors of vital information infrastructure, among them energy and mineral resources, transportation, finance, health, information and communication technology, food and defense.
Article 6 has the ministry or agency determine the electronic system as vital information infrastructure and the operator of the system in a vital sector as an IIV operator. Article 6 requires every electronic system operator in a vital sector to identify its vital information infrastructure at least once a year. Article 9 requires an operator to apply the information security standards and other security standards that the ministry or agency, or the Agency, sets.
Article 10 requires every operator to apply cybersecurity risk management effectively. Article 12 requires the operator to form an organizational Cyber Incident Response Team. Article 22 requires an operator to measure its cybersecurity maturity itself at least once a year. The Regulation was promulgated at Jakarta on .
When LexLint raises it
When your app profile says your app runs an essential service, provides financial services or handles health records.