Electronic System Security Infrastructure

Under Article 1 point 7 of BSSN Regulation Number 8 of 2020. Keamanan Informasi (Information Security) is defined as maintaining five core properties of information. Confidentiality, authenticity, integrity, availability, and non-repudiation.

What the Five Properties Mean in Practice

• Confidentiality (Kerahasiaan): Information can only be opened or accessed by authorized parties.
• Authenticity (Keaslian): Information genuinely originates from the stated source or identity.
• Integrity (Keutuhan): The content of the information is not altered by unauthorized parties.
• Availability (Ketersediaan): Information is accessible when needed by authorized users.
• Non-Repudiation (Kenirsangkalan): A party performing an action cannot deny having performed it.

Regulatory Framework: PP 71/2019 and SMPI

BSSN Regulation 8/2020 implements Article 24(4) of PP Number 71 of 2019. This Requires Electronic System Providers (PSE) to maintain security procedures and facilities (Article 24(1)) and deploy security systems covering threat prevention and response (Article 24(2)). BSSN Regulation 8/2020 operationalizes this duty through a risk-based Information Security Management System (Sistem Manajemen Pengamanan Informasi or SMPI, Article 1 point 6. Article 2).

Through mandatory self-assessment reported to BSSN for verification, electronic systems are classified into strategic, high, or low tiers (Articles 6 and 7). SNI ISO/IEC 27001 is listed across all three tiers alongside tier-specific standards (Article 9).

Covered Private Providers and Administrative Sanctions

For Private-Scope Electronic System Providers (individuals, business entities. Alternatively, The public under Article 1 point 4). Article 5(2) applies SMPI to providers regulated or supervised by a ministry or agency, as well as operators of portals, websites. Alternatively, Online applications processing personal data for public service operations related to electronic transactions. Failure to report tier self-assessments or apply required standards carries an administrative sanction of written warnings (Article 37).

Related Term

Indeks KAMI: An optional evaluation tool to analyze organizational readiness before implementing SNI ISO/IEC 27001 (Article 1 point 13. Article 12(1)).

Legal basis: BSSN Regulation Number 8 of 2020 Articles 1 points 4, 6, 7, and 13, 2, 5(2), 6, 7, 9, 12(1), and 37. PP Number 71 of 2019 Article 24(1), (2), and (4).