Information Security Management System (SMPI) under BSSN Regulation 8/2020

BSSN Regulation 8/2020 defines the Information Security Management System (Sistem Manajemen Pengamanan Informasi or SMPI) in Article 1(6). It is the legal obligation for Electronic System Operators (PSE) to apply risk-based information security management.

Legal Position

Article 2 states that electronic system security is implemented through SMPI, executing Article 24(4) of Government Regulation (PP) Number 71 of 2019. For private operators, Article 5(2) covers operators regulated or supervised by ministries or agencies. In addition, it covers Owners of online portals or applications processing personal data in public services tied to electronic transactions.

Why It Matters in Practice

Operators perform a Self-Assessment (Penilaian Mandiri). Furthermore, Report the results to BSSN for verification, classifying the system as strategic, high, or low (Articles 6–7). All three categories reference SNI ISO/IEC 27001 among their required standards (Article 9). Certification is conducted by BSSN-recognized certification bodies (Article 26). An SMPI Certificate is valid for up to three years, must be renewed at least three months before expiry (Article 28). In addition, Requires surveillance audits at least once a year (Article 33). Non-compliance such as failing to report self-assessments draws written warnings (Article 37).

Related terms: Information Security (Article 1(7)), Indeks KAMI readiness evaluation tool (Article 1(13), Article 12), and SMPI Certificate (Article 1(11)).

Legal basis: BSSN Regulation Number 8 of 2020 Articles 1(6), 1(7), 1(11), 1(13), 2, 5–7, 9, 12, 26, 28, 33, and 37. PP Number 71 of 2019 Article 24(4).