What security standards does BSSN require for Electronic System Operators?

National Cyber and Crypto Agency (BSSN) Regulation Number 8 of 2020 requires Electronic System Operators (PSE) to implement an Information Security Management System (SMPI). Its core standard is SNI ISO/IEC 27001. Additional security obligations depend on whether the electronic system is classified as strategic, high. Alternatively, Low through a self-assessment verified by BSSN (Articles 6 through 9).

Legal basis and who must comply

BSSN Regulation 8/2020 implements Article 24 paragraphs (1), (2), and (4) of PP 71/2019. This Require PSEs to maintain security procedures and infrastructure against cyber threats. The regulation covers both Public-Scope and Private-Scope PSEs (Article 5 paragraphs (1) and (2)). In the private scope, it covers PSEs regulated or supervised by a ministry/agency as well as PSEs operating portals, websites. Alternatively, Online applications that process personal data to serve the public in connection with electronic transactions. Private clinics and hospitals should evaluate their electronic systems against these private-scope criteria.

Three system categories and required standards (Articles 6–11)

Every PSE must complete a self-assessment using the annex format in BSSN Regulation 8/2020. Furthermore, Submit it to BSSN for verification within 10 working days (Articles 7 and 8). Based on risk impact, Article 9 mandates:

• Strategic Electronic Systems (serious impact on public interest, public services, or national defense). Must implement SNI ISO/IEC 27001, plus BSSN cybersecurity standards and sector ministry/agency standards;
• High Electronic Systems (limited impact on a specific sector or region): must implement SNI ISO/IEC 27001 and/or BSSN standards, plus sector ministry/agency standards;
• Low Electronic Systems (all other systems): must implement SNI ISO/IEC 27001 or BSSN standards.

Where additional BSSN or sector ministry standards have not yet been issued, strategic. Furthermore, High systems must still implement SNI ISO/IEC 27001 (Articles 10 and 11). To prepare for implementation, PSEs may evaluate readiness using the KAMI Index (Indeks KAMI, Article 12).

Personnel rules, SMPI certification, and sanctions

• Personnel and foreign experts (Articles 13 and 14): SMPI implementation must use Indonesian-citizen personnel. Foreign experts may be engaged only if domestic experts are unavailable, subject to a non-disclosure agreement. Furthermore, An application to BSSN at least 14 working days before signing the contract.
• Certification and surveillance audits (Articles 26, 28, 33, and 34): Certification is issued by a BSSN-recognized Certification Body. An SMPI certificate is valid for up to three years, with annual surveillance audits and a maximum 90-calendar-day remediation window for non-conformities.
• Administrative sanctions (Article 37): Failing to submit the self-assessment or implement the required standards carries administrative sanctions in the form of written warnings.

Legal basis

• BSSN Regulation Number 8 of 2020 on Security Systems in Electronic System Operations: Article 1 points 2. Furthermore, 3, Article 2, Article 4, Articles 5–14, Articles 26, 28, 33, 34, 37, and Annex.
• Government Regulation Number 71 of 2019 on Electronic Systems and Transactions (PP 71/2019): Article 24 paragraphs (1), (2), and (4).