SOP for Security Service Requests

1. Purpose

This SOP governs how regional government agencies request security services from KUTIM-CSIRT and how the team delivers them, so that every test is based on a request and written approval from the system owner, runs according to the agreed schedule, and its results are shared on a limited basis.

2. Scope

Types of service: vulnerability assessment and pentest; security assessment; malware sample and log analysis; consultation; assistance and technical training.
Applies to electronic systems owned by or under the responsibility of the requesting regional government agency within the East Kutai Regency Government. The services are free of charge for regional government agencies.
An ongoing incident does not wait for a service request and is reported in accordance with SOP-KUTIMCSIRT-02.

3. Legal Basis

Law Number 27 of 2022 on Personal Data Protection.
BSSN (National Cyber and Crypto Agency) Regulation No. 1 of 2024 on Cyber Incident Management.
East Kutai Regent Decree Number 555/K.557/2024 on the Establishment of the East Kutai Computer Security Incident Response Team (KUTIM-CSIRT), issued on 17 September 2024.

4. Definitions

Vulnerability assessment: identification and evaluation of vulnerabilities in an asset through scanning and targeted checks, without further exploitation.
Pentest: penetration testing that attempts to exploit vulnerabilities in a controlled manner to prove their impact.
Security assessment: an evaluation of the configuration, architecture, or security governance of an electronic system.
Security Testing Agreement (rules of engagement): a document signed by the system owner and KUTIM-CSIRT setting out the asset scope, type of testing, time window, limitations, emergency contacts, and confidentiality of results.
Testing window: the agreed range of dates and hours for testing.
Retest: repeat testing limited to previous findings to confirm that the fixes were successful.
TLP:AMBER: the Traffic Light Protocol 2.0 label for result reports that are shared only with people at the recipient regional government agency who need to know.

5. Parties Involved

Head of the regional government agency: signs the request letter and the Security Testing Agreement as the system owner.
Technical contact of the regional government agency: technical liaison, provider of access and test accounts, and emergency contact during testing.
Third parties (application developers, hosting providers): grant permission and support when the asset is managed by a third party.
KUTIM-CSIRT Chair (Head of Diskominfo SP): receives requests and signs the Security Testing Agreement on behalf of KUTIM-CSIRT.
Secretary: recording requests, correspondence, and archiving.
Coordinator of the Incident Response and Recovery Team: reviews requests, schedules work, and assigns staff.
Information Security Sub-Team, Website Administration and Applications Sub-Team, Network and Server Management Sub-Team: deliver the service according to the type of asset.

6. Procedure

No.	Activity	Performed by	Output	Time
1	Prepare a request letter signed by the head of the regional government agency and addressed to the Head of Diskominfo SP as the KUTIM-CSIRT Chair, stating the type of service, the assets (name, URL or IP, owner), the proposed schedule, and the technical contact. The letter is sent via /permohonan-layanan or by email to csirt@kutaitimurkab.go.id as a scanned PDF.	Head of the regional government agency; technical contact	Request letter sent	Before the proposed schedule
2	Record the request and send a receipt to the requester.	Secretary	Request recorded	When the request is received
3	Review completeness and eligibility: the asset is owned by or under the responsibility of the requester, the scope is clear, and third-party permission is available if the asset is managed by a third party. If anything is missing, ask the requester to complete it.	Coordinator	Review results	Part of the step 4 deadline
4	Send the requester a confirmation stating whether the request is accepted or rejected and why, the implementation schedule, the staff assigned, and, for vulnerability assessments, pentests, or security assessments, a draft Security Testing Agreement.	Coordinator; Secretary	Confirmation letter or email and schedule	≤ 3 working days after the request is received
5	The Security Testing Agreement is signed by the system owner and KUTIM-CSIRT. Testing does not start before both parties have signed this document.	Head of the regional government agency; KUTIM-CSIRT Chair	Signed Security Testing Agreement	Before testing begins
6	Preparation by the requester: back up the assets to be tested, prepare test accounts if testing is done with a login, and inform any third party managing the assets of the testing window.	Technical contact; third party	Backup and test accounts ready	Before the testing window
7	Carry out the vulnerability assessment, pentest, or security assessment only on the assets, types of testing, and time window listed in the Security Testing Agreement. If a service is disrupted, testing stops and the emergency contact is called. Critical findings are reported to the contact immediately without waiting for the final report. If there are signs that the system has already been compromised (for example a webshell), testing stops and handling switches to SOP-KUTIMCSIRT-01.	Executing sub-team	Implementation notes and findings data	According to the agreed testing window
8	Malware sample and log analysis: the requester sends samples in a ZIP/7z archive protected with the password infected, together with the origin of the sample and when it was found. Logs are sent in their original, unedited form, with a note of the time range and time zone. Samples are never sent without a password-protected archive.	Technical contact; Information Security Sub-Team	Analysis results and IOCs	According to the agreed schedule
9	Consultation: discussion by email or in a meeting according to the agreed schedule.	Relevant sub-team	Consultation notes and recommendations	According to the agreed schedule
10	Assistance and technical training: agreeing on the material, participants, venue, and technical needs, then carrying out the activity.	Relevant sub-team; requesting regional government agency	Materials and attendance list	According to the agreed schedule
11	Prepare a TLP:AMBER result report containing the scope, methods, findings with their risk levels and evidence, and remediation recommendations. The report is delivered to the head of the regional government agency and the technical contact through official channels, not through chat groups or public media.	Executing sub-team; approved by the Coordinator	TLP:AMBER result report	After implementation is complete
12	Fix the findings according to the recommendations. As a reference, the VDP remediation targets are Critical ≤ 30 days, High ≤ 60 days, and Medium/Low ≤ 90 days.	Requesting regional government agency; third party	Fix completed	According to the remediation plan of the regional government agency
13	Request a retest by email, referring to the result report. The retest is limited to previous findings, under the Security Testing Agreement if still valid or a new agreement if the testing window has ended.	Technical contact; executing sub-team	TLP:AMBER retest report	Schedule confirmed ≤ 3 working days after the request is received
14	Close the request and archive the request letter, the Security Testing Agreement, the result report, and the retest report.	Secretary	Complete archive	After the retest, or after the result report is received if there is no retest

7. Related Documents and Forms

Security Service Request Letter (surat-permohonan-layanan-keamanan.docx).
Security Testing Agreement (persetujuan-pengujian-keamanan.docx).
KUTIM-CSIRT Service Standards and Service Catalog.
SOP-KUTIMCSIRT-01 Receiving and Handling Cyber Incident Reports.
SOP-KUTIMCSIRT-02 Incident Reporting by Regional Government Agencies.

8. Revision History

Version	Date	Remarks
1.0	5 October 2026	First issue.