Regulations

BSSN Regulations & Guidance

The role of Indonesia's National Cyber and Crypto Agency (BSSN) in national cybersecurity governance — and what your organization should prepare.

TL;DR

  • BSSN is Indonesia's national cybersecurity agency — from detection and incident response to technical guidance for public institutions and industry.
  • Its guidance shapes how organisations prepare for and respond to cyber incidents.
  • Continuous external monitoring supports BSSN-aligned incident readiness.

Summary

BSSN is the Indonesian government agency responsible for national cybersecurity — from detection and incident response to issuing technical guidance for public institutions and industry sectors.

What is the framework?

Indonesia's cybersecurity governance rests on several instruments: the ITE Law, Government Regulation 71/2019 on Electronic Systems and Transactions (PSTE), and the PDP Law. Within this framework BSSN acts as the national cybersecurity and incident-response coordinator, including the official cyber incident reporting channel.

BSSN also issues technical guidance — for example on information security management systems and information security governance — that serves as a reference for implementing security controls in both public and private sectors. BSSN regulations on its organization and working procedures reinforce this mandate.

What does it require?

Incident reporting duties are further reinforced by the PDP Law, which requires announcing personal data breaches within 3x24 hours to data subjects and the authority.

  • Protect electronic systems according to applicable security standards
  • Implement information security governance and an information security management system
  • Report cyber incidents through official channels (e.g. BSSN/IDSIRT) within the required timeframe
  • Maintain incident-response readiness and service recovery
  • Conduct regular security guidance reviews and audits

What does it mean for vendor risk?

When an incident happens at a vendor, your organization still bears the regulatory and reputational consequences. Vendor risk assessment should therefore cover vendor incident readiness: detection capability, reporting speed, and past incident history.

Continuous vendor security monitoring helps meet cybersecurity governance expectations across your digital supply chain.

How can CyberRank help?

CyberRank complements an organization's cybersecurity governance with measurable external risk visibility.

  • Early detection of exposure and leaks via darknet monitoring
  • Security ratings to assess vendor security readiness
  • Continuous-monitoring evidence for incident reporting and audits
  • Prioritized remediation recommendations based on findings

References

  1. Law No. 27 of 2022 on Personal Data Protection
  2. Government Regulation No. 71 of 2019 on Electronic Systems and Transactions
  3. Law No. 11 of 2008 on Electronic Information and Transactions
  4. BSSN Regulation No. 6 of 2021 on the Organization and Working Procedures of BSSN
  5. Official BSSN website — cybersecurity technical guidance portal

Frequently asked questions

Related links

Get your free security rating

Run a free CyberRank security rating for any organisation and see the same vendor risk signals our customers use.

Get your free security rating

← Back to all regulations