RUU on Cybersecurity Tightens Security Standards for the Supply Chain

Draft Bill on Cybersecurity and Defense (Rancangan Undang-Undang Kemanan dan Ketahanan Siber- “ RUU KKS ”) is currently under government review, which includes provisions addressing supply chain security standards. These standards are necessary to protect the national digital infrastructure.

“Information Infrastructure (Infrastruktur Informasi- “ II ”) Operators, Critical Information Infrastructure (Infrastruktur Informasi Kritikal- “ IIK ”) Operators, and/or providers of Products with Digital Elements (Produk dengan Elemen Digital- “ PDED ”) must implement supply chain security standards applicable to II, IIK, and PDED,” said Hernadi, Director of Legislative Harmonization I at the Ministry of Law, in an interview with Hukumonline.

The security standards are intended to prevent, detect, and mitigate cyber threats. These standards encompass protection throughout all stages, including the design, procurement, projection, distribution, maintenance, and decommissioning of II, IIK, and PDED.

The government also places significant emphasis on security standards for third parties acting as suppliers. These third parties include vendors, subcontractors, or external service providers supplying components, software, services, or personnel integrated into the infrastructure or digital products.

Under the draft regulation, infrastructure providers must identify and inventory all suppliers and/or third-party suppliers; assess the risks associated with each supplier; implement contractual requirements; and evaluate the activities and performance of suppliers.