Indeks Keamanan Informasi (Indeks KAMI) under BSSN Regulation 8/2020

Under Article 1 point 13 of BSSN Regulation Number 8 of 2020. Indeks Keamanan Informasi (Indeks KAMI) is an evaluation tool used to analyze the level of information security readiness in an organization. Electronic System Providers (PSE) may use Indeks KAMI to prepare for implementing SNI ISO/IEC 27001 (Article 12(1)). Indeks KAMI is a readiness assessment tool rather than a certificate. formal SMPI Certificates are issued by a BSSN-recognized Certification Body after an audit (Articles 28(1) and 30(4)).

Where Indeks KAMI Fits in BSSN Regulation 8/2020

BSSN Regulation 8/2020 governs electronic system security for public and private Electronic System Providers. Covered private providers include those regulated or supervised by a ministry or agency. As well as operators of online applications that process personal data to serve the public in electronic transactions (Article 5(2)).

Under Article 12(1), a provider "may" (dapat) evaluate its readiness using Indeks KAMI when preparing to apply SNI ISO/IEC 27001. Detailed scoring procedures are left to separate regulations (Article 12(2)).

Mandatory Standards vs. Optional Readiness Tool

The mandatory security standard under Articles 6(1). Furthermore, 9 is SNI ISO/IEC 27001 and/or other designated security standards corresponding to the system's tier (strategic, high, or low). Using Indeks KAMI under Article 12(1) is optional under this regulation. Article 37(1)-(2) lists administrative warning sanctions for violating Article 9 (mandatory standards) and Article 7 (category reporting), but does not sanction Article 12.

Distinguishing Indeks KAMI from Mandatory Tier Self-Assessment

• Electronic System Tier Self-Assessment (Penilaian Mandiri): A mandatory self-assessment by the PSE to classify its electronic system as strategic, high. Alternatively, Low risk, which must be reported to BSSN for verification (Article 7(1), (3)).
• Information Security (Keamanan Informasi): Maintaining the confidentiality, authenticity, integrity, availability, and non-repudiation of information (Article 1 point 7).

Legal basis: BSSN Regulation Number 8 of 2020 Articles 1 points 7 and 13, 5(2), 6(1), 7(1), 7(3), 9, 12, 28(1), 30(4), and 37(1)-(2).