The National Cyber and Encryption Agency is not a new agency, but rather a consolidation of two, namely the National Encryption Agency and the Directorate of Information Security, as well as the Indonesia Security Incident Response Team on Internet Infrastructure (ID-SIRTII), which is under the Directorate General of Applications and Informatics, Ministry of Communication and Informatics. Initially, this non-ministerial government institution was under to and accountable to the President through the Coordinating Ministry for Political, Legal, and Security Affairs. However, this agency and its regulation was strengthened to make it an independent agency directly responsible to the President.
This regulation applies to administrators of public and private electronic systems. The electronic systems was categorized based on the risk principle: a. strategic (have a serious impact on the public interest, public services, the smooth running of the state, or the defense and security of the state); b. high (limited impact on the interests of certain sectors and/or regions); and c. low (other that previously stated). The categorization is determined based on independent assessment by the electronic system operator against its electronic system, which the format is attached in the Appendix, and must be reported to the National Cyber and Encryption Agency for verification no later than 10 working days. Electronic system operators must implement: a. INS ISO/IEC 27001; b. other safety standards related to cyber security set by the National Cyber and Encryption Agency; And c. other safety standards related to cyber security set by the Ministry or Institution.
Self-assessment based on the Information Security Index is carried out by electronic system operators according to the latest version of the Index publish on the official website of the National Cyber and Encryption Agency. Self-assessment is done by evaluating several aspects: a. governance (evaluating the completeness of the policy, information security management, procedures, functions, duties and responsibilities); b. risk management (evaluating the risk of the policy as well as the risk of information security management, procedures, functions, duties and responsibilities); c. information security framework (evaluating the completeness of information security documents and the effectiveness of their implementation which includes several documents: a. business continuity plans; b. disaster recovery plans; c. management of information security incidents; d. secure software development; e. information security implementation strategy; and f. compliance with information security regulations); d. asset management (evaluating the completeness of safeguarding information assets, including the entire asset usage cycle and continuous checking for physical security); e. technology and information security (evaluating the completeness, consistency, and effectiveness of the use of technology in securing information assets). The implementation of this information security index by electronic system operators must be verified by the National Cyber and Encryption Agency and will produce a final score indicating the readiness level of electronic system operators in fulfilling the criteria of INS ISO/IEC 27001: a. Good (645-610); b. pretty good (609-536); c. fulfillment of the basic framework (535-334); d. not feasible (333-0)