1. Purpose
This SOP serves as the working reference for the KUTIM-CSIRT team in receiving, recording, assessing, handling, and closing cyber incident reports, so that every report is handled consistently, documented, and within the target times set in the Service Standards.
2. Scope
- Applies to cyber incident reports concerning the electronic systems of regional government agencies within the East Kutai Regency Government, including websites and applications on the *.kutaitimurkab.go.id domain.
- Report sources: the /lapor form, email to csirt@kutaitimurkab.go.id, telephone (0549) 2021207 during service hours, the team's own security monitoring, and notifications from external parties such as Gov-CSIRT Indonesia (BSSN).
- Reports in the Kerentanan Keamanan (security vulnerability) category without signs of exploitation are handled under SOP-KUTIMCSIRT-03 (Handling Vulnerability Reports). If there are signs that the vulnerability is being exploited, the report is handled under this SOP.
- Reports from the public about systems outside our constituency are still accepted and forwarded to the competent authorities.
3. Legal Basis
- Law Number 27 of 2022 on Personal Data Protection.
- BSSN (National Cyber and Crypto Agency) Regulation No. 1 of 2024 on Cyber Incident Management.
- East Kutai Regent Decree Number 555/K.557/2024 on the Establishment of the East Kutai Computer Security Incident Response Team (KUTIM-CSIRT), issued on 17 September 2024.
4. Definitions
- Cyber incident: an event that threatens or disrupts the confidentiality, integrity, or availability of electronic systems and data, for example unauthorized access, defacement, phishing, malware/ransomware, data leaks, DoS/DDoS, account misuse, and injection of gambling/SEO content (judol).
- Ticket: a report record in the KUTIM-CSIRT system with a Ticket Number and Token. Reporters monitor the status at /lacak-tiket.
- Ticket status, in order: Received, Triage, In Progress, Awaiting Reporter Info, Resolved, Closed. The Awaiting Reporter Info status is used whenever the team needs additional information from the reporter.
- Triage: verifying the report and determining the category, priority, affected assets, and system owner.
- Priority: Critical, High, Medium, or Low, set during triage based on impact and scope according to the criteria in the Service Standards. The severity chosen by the reporter is used as a starting point.
- System owner: the regional government agency that owns or is responsible for the affected electronic system.
- Working hours / working days: Monday to Friday, 08.00 to 16.00 WITA, excluding national public holidays.
- IOC (indicator of compromise): technical artifacts that indicate an attack, such as IP addresses, domains, file hashes, or webshell file names.
- TLP: Traffic Light Protocol 2.0. Publications are labeled TLP:CLEAR; handling reports to regional government agencies TLP:AMBER; information for specific recipients TLP:AMBER+STRICT or TLP:RED.
- Lessons learned: a post-incident review covering the root cause, what went well or poorly, and recommendations to prevent recurrence.
5. Parties Involved
- Steering and accountable officials: provide direction and receive reports on Critical incidents.
- KUTIM-CSIRT Chair: decides on escalation to Gov-CSIRT Indonesia (BSSN) and law enforcement, as well as emergency actions that stop a service.
- Secretary: ticket administration, official correspondence, and archiving.
- Coordinator of the Incident Response and Recovery Team: sets the final priority, assigns sub-teams, and monitors target times.
- Information Security Sub-Team: triage, analysis, evidence preservation, and IOCs.
- Network and Server Management Sub-Team: containment and recovery on networks, servers, and infrastructure.
- Website Administration and Applications Sub-Team: containment and recovery on websites and applications.
- Reporter: the party submitting a report, including anonymous reporters.
- System owner (regional government agency): provides access, logs, and backups, and carries out remediation.
- External parties: Gov-CSIRT Indonesia (BSSN), law enforcement, service providers, or application developers.
6. Procedure
| No. | Activity | Performed by | Output | Time |
|---|---|---|---|---|
| 1 | Receive the report. Reports submitted via the /lapor form automatically become tickets with the status Received. Reports received by email, telephone, monitoring, or from external parties are recorded as tickets by staff. Reporters who call by telephone are asked to complete their report via the form or email. | Secretary; team member who received the report | Ticket with status Received | When the report is received |
| 2 | Read the report, set a provisional priority, and send an initial response to the reporter (unless anonymous) containing the ticket number and next steps. Critical reports are immediately notified to the Coordinator and the Chair. The status is changed to Triage. | Information Security Sub-Team | Initial response sent; status Triage | Critical ≤ 1 hour; High ≤ 4 working hours; Medium ≤ 1 working day; Low ≤ 2 working days |
| 3 | Triage: confirming that the report is an incident, confirming that the asset belongs to our constituency, setting the category and priority, identifying the affected assets and system owner, and checking links to other tickets. Vulnerability reports without signs of exploitation are redirected to SOP-KUTIMCSIRT-03. Assets outside the constituency are forwarded to the competent authorities. | Information Security Sub-Team; Coordinator sets the final priority | Triage notes on the ticket | Immediately after the initial response |
| 4 | If the information is insufficient, request additional information from the reporter and change the status to Awaiting Reporter Info. The status is changed back once the information is received. Anonymous reporters cannot be contacted, so the team works with the information available. | Information Security Sub-Team | Information request recorded | As needed; target times may be exceeded while in this status |
| 5 | Assign a ticket owner and the executing sub-team according to the type of asset. The status is changed to In Progress. | Coordinator | Assignment recorded; status In Progress | After triage |
| 6 | Notify the system owner (the head of the regional government agency and the technical administrator) under the TLP:AMBER label, request the necessary evidence preservation and access, and ask that the system not be cleaned or restored before the evidence is secured. | Ticket owner; Secretary for official letters | Notification to the system owner | Immediately after assignment |
| 7 | Collect and secure evidence: logs (web server, application, authentication, firewall), copies of suspicious files with their hashes, screenshots, and, if necessary, a snapshot or image of the system. Record who collected it, when, and where the evidence is stored. Malware samples are stored in a ZIP/7z archive protected with the password infected. | Information Security Sub-Team together with the system owner | Evidence and evidence-preservation notes | Before cleaning the system |
| 8 | Analyze the evidence to determine the point of entry, the scope, the affected accounts and data, and the IOCs. | Information Security Sub-Team | Analysis notes and IOC list | Ongoing throughout handling |
| 9 | Containment: for example isolating hosts, blocking IOCs, disabling misused accounts, or temporarily disabling affected pages. Actions that stop a service are taken with the approval of the system owner. For Critical incidents that cannot wait, the action is decided by the Chair and the system owner is notified immediately. | Network and Server Management Sub-Team; Website Administration and Applications Sub-Team; system owner | Containment action notes | As soon as possible according to priority |
| 10 | Provide initial handling recommendations to the system owner and the reporter. | Ticket owner | Initial handling recommendation | Critical ≤ 24 hours; High ≤ 2 working days; Medium ≤ 3 working days; Low ≤ 5 working days |
| 11 | Eradication and recovery: removing attacker artifacts (webshells, backdoors, unauthorized accounts, injected content), closing the vulnerability used as the point of entry, changing credentials, restoring from a clean backup, and checking the system before it is reopened to the public. | System owner with support from the relevant sub-team | System restored and vulnerability closed | Depending on the complexity of the incident |
| 12 | Send status updates to the reporter until the incident has been handled. | Ticket owner | Status updates on the ticket | Critical every 24 hours; High every 2 working days; Medium when there is progress, at the latest every 5 working days; Low when there is progress |
| 13 | Escalation where necessary: to Gov-CSIRT Indonesia (BSSN) if the incident exceeds the capability or authority of KUTIM-CSIRT, and to law enforcement if a criminal offense is involved. If personal data is involved, remind the system owner of its obligations as a personal data controller under Law Number 27 of 2022. | Chair; Secretary for correspondence | Escalation letter or email; evidence handover record if any | When the need for escalation is identified |
| 14 | Verify that attacker artifacts are gone, the vulnerability has been closed, and there are no signs of a repeat attack during post-recovery monitoring. Prepare a TLP:AMBER handling report for the system owner. The status is changed to Resolved, and the reporter is notified and asked to complete a satisfaction survey. | Ticket owner; approved by the Coordinator | TLP:AMBER handling report; status Resolved | After recovery is verified |
| 15 | Prepare lessons learned: mandatory for Critical and High incidents, and for recurring Medium or Low incidents. The results may take the form of updated detection rules, IOC lists, advisories, guides, or recommendations to regional government agencies. | Coordinator together with the handling sub-team | Lessons-learned notes and follow-up actions | After the Resolved status, before the ticket is Closed |
| 16 | Close the ticket: ensure the chronology, evidence, reports, and lessons learned are archived. Data used for public statistics is presented under the TLP:CLEAR label without the reporter's personal data. The status is changed to Closed. | Secretary; Coordinator | Ticket Closed and complete archive | After step 15 |
Critical incidents are also handled outside working hours. Reports of other priorities received outside working hours are counted from the next working day. Time is counted from when the report is recorded and the ticket number is issued.
7. Related Documents and Forms
- KUTIM-CSIRT Service Standards (priority criteria and target times).
- Incident Report Form (formulir-laporan-insiden.docx), for offline reports.
- SOP-KUTIMCSIRT-02 Incident Reporting by Regional Government Agencies.
- SOP-KUTIMCSIRT-03 Handling Vulnerability Reports (VDP).
- KUTIM-CSIRT RFC 2350 and Privacy Policy.
8. Revision History
| Version | Date | Remarks |
|---|---|---|
| 1.0 | 5 October 2026 | First issue. |