Bank Indonesia (PBI 2/2024) Compliance Guide

Bank Indonesia Regulation No. 2 of 2024 on Information System Security and Cyber Resilience, often referred to as ISSCR, strengthens cyber defenses across Indonesia's payment ecosystem. It applies to payment service providers, known as PJP, and payment system infrastructure operators, known as PIP, that operate under Bank Indonesia supervision. The regulation responds to the rising volume and sophistication of attacks on payment rails, where availability and trust are essential. Its aim is to raise the baseline of cyber risk management for both bank and non-bank players in the payment system.

The regulation expects providers to maintain adequate risk-management policies and standard operating procedures that govern how information systems are secured and how cyber risk is handled. Service availability is a specific concern, since disruption to payment services affects the wider economy. Providers are also expected to plan for recovery, with a disaster recovery plan that is not just documented but tested on a regular basis. Governance, documentation, and repeatable testing run through the regulation. Because the payment ecosystem includes many interconnected players, weakness at one provider can ripple outward, which is why the baseline expectations apply consistently across bank and non-bank participants.

A distinctive requirement is that providers must run a cyber resilience simulation at least once a year. This is an exercise-based expectation: it is not enough to describe resilience on paper, providers must practice how they would detect, respond to, and recover from a cyber event. The human layer is a natural part of such simulations, because the people who receive, report, and respond to suspicious activity are central to whether an attack succeeds. Providers are also expected to report their ISSCR implementation to Bank Indonesia.

This page offers general information and is not legal advice; PJP and PIP should confirm the precise scope, timelines, and reporting format that apply to them with qualified counsel and their Bank Indonesia supervisory contacts. Claro supports the human-layer elements of ISSCR, including awareness, phishing simulation as part of resilience exercises, and the evidence to back them up, but Claro alone does not make a provider compliant. Compliance depends on the full risk-management, availability, recovery, and reporting program the regulation requires.