1. Purpose
This SOP serves as a reference for regional government agencies within the East Kutai Regency Government when they detect or suspect a cyber incident, so that the report reaches KUTIM-CSIRT as soon as possible, evidence is not lost, and handling can begin without waiting for administrative processes.
2. Scope
- Applies to all regional government agencies and their employees, including administrators of websites and applications on the *.kutaitimurkab.go.id domain, official email accounts, work devices, and office networks.
- This also applies to regional government agency systems developed or hosted by third parties.
- Examples of events that must be reported: the site's appearance has changed (defacement), gambling content or unfamiliar links have appeared (judol), unknown files or accounts are on the server, phishing emails target employees, an official account has been taken over, files have been encrypted or a ransom is demanded (ransomware), a suspected data leak, and services brought down by an attack.
- Unconfirmed suspicions should still be reported. Whether an event is an incident is determined by KUTIM-CSIRT during triage.
3. Legal Basis
- Law Number 27 of 2022 on Personal Data Protection.
- BSSN (National Cyber and Crypto Agency) Regulation No. 1 of 2024 on Cyber Incident Management.
- East Kutai Regent Decree Number 555/K.557/2024 on the Establishment of the East Kutai Computer Security Incident Response Team (KUTIM-CSIRT), issued on 17 September 2024.
4. Definitions
- Cyber incident: an event that threatens or disrupts the confidentiality, integrity, or availability of the electronic systems and data of a regional government agency.
- Discoverer: an employee, system administrator, or third party who first becomes aware of the event.
- Technical contact: an employee appointed by the head of the regional government agency to manage electronic systems and communicate with KUTIM-CSIRT.
- Evidence: screenshots, logs, suspicious files, original emails with full headers, and time notes showing what happened.
- Ticket Number and Token: codes issued immediately after the /lapor form is submitted, used to monitor the status at /lacak-tiket.
- TLP: Traffic Light Protocol 2.0. Handling reports from KUTIM-CSIRT to regional government agencies are labeled TLP:AMBER, meaning they are shared only with people in the recipient organization who need to know.
5. Parties Involved
- Head of the regional government agency: accountable for the agency's electronic systems and approves actions that affect services.
- Technical contact of the regional government agency: the main reporter and liaison throughout the handling.
- Discoverer: reports the event to the technical contact or directly to KUTIM-CSIRT.
- Third parties (application developers, hosting providers): provide access, logs, and fixes as requested by the regional government agency.
- KUTIM-CSIRT: receives reports, performs triage, and assists with handling in accordance with SOP-KUTIMCSIRT-01.
6. Procedure
| No. | Activity | Performed by | Output | Time |
|---|---|---|---|---|
| 1 | Record what was seen and when it was first noticed (date, time, WITA). Take screenshots that show the URL, the time, and any messages displayed. | Discoverer | Initial notes and screenshots | Immediately when the event becomes known |
| 2 | Report the event to the technical contact of the regional government agency. If the contact cannot be reached and the event appears serious, the discoverer reports directly to KUTIM-CSIRT. | Discoverer | Technical contact aware of the event | Immediately |
| 3 | Secure evidence before changing anything: copy the web server, application, and authentication logs covering the time of the event; save copies of suspicious files without opening them; keep phishing emails in their original form (.eml files or with full headers). Malware files are stored in a ZIP/7z archive protected with the password infected. | Technical contact; third party if the system is managed by a third party | Copies of the evidence stored in a location separate from the affected system | Before step 5 |
| 4 | Report to KUTIM-CSIRT via the /lapor form (jpg, png, gif, webp, or pdf attachments, up to 5 files of 5 MB each) or by email to csirt@kutaitimurkab.go.id. Both are accepted 24 hours a day, 7 days a week. The telephone line (0549) 2021207 can be used Monday to Friday from 08.00 to 16.00 WITA, after which the report is completed via the form or email. Reports from regional government agencies are not sent anonymously so that the team can get back to the reporter. For sensitive information, use the PGP key available on the Contact page. | Technical contact | Ticket Number and Token, or report email sent | Immediately after the initial evidence is secured, without waiting for an official letter |
| 5 | Take initial protective actions that do not destroy evidence: disconnect infected devices from the network (unplug the cable or turn off Wi-Fi) without powering them off; change the passwords of accounts suspected of being taken over, using another, clean device. Do not delete files or webshells, restore from backup, reformat, contact the attacker, or pay a ransom before coordinating with KUTIM-CSIRT. | Technical contact, with the knowledge of the head of the regional government agency | Record of actions already taken, with their times | After the report is sent, or earlier if the damage is spreading |
| 6 | Inform the head of the regional government agency of the event, the ticket number, and the actions taken. If necessary, the head of the regional government agency follows up with an official letter to the Head of Diskominfo SP as the KUTIM-CSIRT Chair. | Technical contact; head of the regional government agency | Head of the regional government agency informed; official letter if required | On the same day |
| 7 | Respond to information requests from KUTIM-CSIRT, provide access, logs, and backups, and contact the relevant third parties. Logs or files that cannot be uploaded through the form (types other than images/PDF or larger than 5 MB) are handed over when requested by the team through an agreed method. | Technical contact; third party | Information and access available | While the ticket status is Awaiting Reporter Info or In Progress |
| 8 | If the incident involves personal data, the head of the regional government agency, as the personal data controller, fulfills the obligation to give notice of a personal data protection failure in accordance with Law Number 27 of 2022. KUTIM-CSIRT helps assess the scope of the affected data. | Head of the regional government agency | Notification as required by regulations | As required by Law Number 27 of 2022 |
| 9 | Carry out the recovery and remediation recommendations from KUTIM-CSIRT, including closing the vulnerability used as the point of entry, then notify the team when the fix is complete so it can be verified. | Technical contact; third party | System restored and vulnerability closed | According to the recommendations and the incident priority |
| 10 | Receive the TLP:AMBER handling report and share it only with those who need to know. Do not publish incident details on social media or open groups. | Head of the regional government agency; technical contact | Handling report received and archived | After the ticket is Resolved |
Minimum report information
- The reporter's name, position, regional government agency, email, and telephone number.
- Short description: what was seen or what happened.
- A brief chronology, including the time of the event or when it was first detected.
- The observed impact, for example a service cannot be accessed or the site's appearance has changed.
The following information is helpful and should be included if already available: the affected system, URL, or IP address; the incident category as chosen in the form; actions already taken; and evidence such as screenshots and logs. Evidence helps but is not required to start a report.
7. Related Documents and Forms
- Incident Report Form (formulir-laporan-insiden.docx), for reports submitted offline or attached to an email.
- KUTIM-CSIRT Service Standards (priorities, target times, service hours).
- SOP-KUTIMCSIRT-01 Receiving and Handling Cyber Incident Reports.
- Guides and Privacy Policy.
8. Revision History
| Version | Date | Remarks |
|---|---|---|
| 1.0 | 5 October 2026 | First issue. |