Effective since 5 October 2026 · TLP:CLEAR
1. Legal Basis
- East Kutai Regent Decree No. 555/K.557/2024 on the Establishment of the Kutai Timur Computer Security Incident Response Team (KUTIM-CSIRT).
- BSSN (National Cyber and Crypto Agency) Regulation No. 1 of 2024 on Cyber Incident Management.
- Law No. 27 of 2022 on Personal Data Protection, for managing reporter data.
2. Types of Service
- Receiving and handling incident reports: logging complaints, triage, initial recommendations, and coordinating response and recovery. Channels: the report form or email.
- Security alerts and advisories: advisories, CVE Catalog, IOC / threat feed.
- Handling of vulnerability reports from the public through the Vulnerability Disclosure Program.
- Service requests from regional government agencies: vulnerability assessment / pentest, security assessment, malware sample and log analysis, consulting, assistance, and technical training, through the service request form.
- Technical guidance and education: guides, "I've Been Hit…" emergency steps, SOPs and templates, phishing check, self-assessment.
All services are free of charge for constituents (regional government agencies of the East Kutai Regency Government). Reports from the public are still accepted and forwarded to the competent authorities if they fall outside the constituency.
3. Incident Priority Classification
Priority is set during triage based on impact and scope, not only on the reporter's choice. The severity selected by the reporter on the form is used as a starting point.
| Priority | Criteria | Examples |
|---|---|---|
| Critical | A key public service is down, data is actively leaking, or the attacker still controls the system. | Ransomware, defacement or injection of online gambling (judol) content on regional government websites, an active personal data leak, a hijacked administrator account. |
| High | An important system is disrupted or compromised, but not yet widespread. | Malware on OPD devices, active phishing targeting employees, a compromised official email account, a critical vulnerability being actively exploited. |
| Medium | A real threat with no direct impact on services. | Vulnerabilities without evidence of exploitation, mass failed login attempts, spam from an official account. |
| Low | Information, questions, or minor-impact events. | Port scans, consultation requests, general information reports. |
4. Service Time Targets (SLA)
Times are counted from when the report is logged and the ticket number is issued. "Working hours" and "working days" follow the service hours in section 5.
| Priority | Initial response | Initial handling recommendation | Status update to the reporter |
|---|---|---|---|
| Critical | ≤ 1 hour | ≤ 24 hours | every 24 hours until resolved |
| High | ≤ 4 working hours | ≤ 2 working days | every 2 working days |
| Medium | ≤ 1 working day | ≤ 3 working days | when there is progress, at the latest every 5 working days |
| Low | ≤ 2 working days | ≤ 5 working days | when there is progress |
- A ticket number is issued immediately after the form is submitted; its status can be checked on Track Ticket.
- Vulnerability reports (VDP): initial response ≤ 3 working days; remediation target for the system owner: Critical ≤ 30 days, High ≤ 60 days, Medium/Low ≤ 90 days after the report is validated.
- Service requests from regional government agencies: confirmation and scheduling ≤ 3 working days; carried out according to the agreed schedule.
- Critical incidents are also handled outside working hours. Other priorities received outside working hours are counted from the next working day.
- These targets may be exceeded if the reporter has not yet provided complete information (status "Menunggu Info Pelapor" — awaiting reporter information) or if handling depends on a third party.
5. Service Hours and Channels
- Service hours: Monday–Friday, 08.00–16.00 WITA, except national public holidays.
- Report form and email csirt@kutaitimurkab.go.id: received 24 hours a day, 7 days a week. Use the PGP key for sensitive information.
- Telephone: (0549) 2021207, during service hours.
- WhatsApp / hotline: not yet available. For now, please use email and the report form.
6. Reporter Requirements
- A report only needs the reporter's contact details, a description, a brief chronology, and the observed impact. Evidence (screenshots, logs) helps but is not required.
- Reporters are not asked to send their national ID number (NIK) or a photo of their ID card (KTP). Anonymous reports are accepted, with the consequence that the team cannot contact the reporter back.
- Reporter data is managed in accordance with the Privacy Policy.
7. Information Sharing Code (TLP)
KUTIM-CSIRT uses the Traffic Light Protocol (TLP) 2.0. All information published on this website is labeled TLP:CLEAR (may be shared freely). Information labeled TLP:GREEN, TLP:AMBER, TLP:AMBER+STRICT, or TLP:RED is sent directly only to authorized recipients and is not published.
8. Escalation and Service Complaints
- Incidents beyond the capability or authority of KUTIM-CSIRT are coordinated with Gov-CSIRT Indonesia at the National Cyber and Crypto Agency (bssn.go.id), and with law enforcement when a criminal offense is involved.
- Complaints about KUTIM-CSIRT services can be sent to csirt@kutaitimurkab.go.id with the subject "Pengaduan Layanan" (Service Complaint). Reporters whose tickets have been closed are asked to fill in the satisfaction survey.