Industries · Government & Public Sector

Scored on maturity. Judged on recovery.

Digital government performance is evaluated every year and the result is published and ranked. Nobody publishes whether your services could come back. In June 2024 the difference between those two questions took 282 institutions offline — and the cause was not a sophisticated adversary. Zentara works with ministries, agencies and pemda on the unglamorous half: restore that has been tested, capability your own people operate, and infrastructure that stays in jurisdiction.

Talk to a Government & Public Sector specialist

282: Institutions disrupted by the PDNS incident; 20 June 2024 — Brain Cipher, a LockBit 3.0 variant
239: Of those, with no usable backup; Recovery depended entirely on what had been copied elsewhere
645: Institutions in the 2026 evaluation; PermenPANRB 8/2026 — Evaluasi Kinerja Pemerintah Digital
72 hrs: To notify a personal data breach; UU PDP — state bodies are not exempt

What we are defending

What stops when the system stops.

Citizen-facing services

Immigration, licensing, civil registry, social assistance. The outage is not measured in systems; it is measured in people standing in a hall being told to come back tomorrow.

Shared hosting and PDN

Consolidation is sound policy and it concentrates risk. One tenant compromised in a shared estate is an incident; one platform compromised is a national event.

Backup and restore

The control that decides the outcome and the one nobody rehearses. A backup nobody has restored from is a belief, not a capability.

Legacy applications

Built by a vendor who has moved on, running on an OS past support, holding data that cannot be lost. Replacing it is a programme; defending it is this year.

Identity across agencies

Interoperability means an account issued by one institution now opens a door in another. The weakest issuer sets the standard for everyone.

The daerah estate

Provinsi, kabupaten and kota carry the same obligations as a ministry with a fraction of the staff. National posture is decided here, not in Jakarta.

Instrument · Obligation · Capability delivered

What you are measured on, and what you are actually exposed to.

SPBE evaluation, BSSN security standards and UU PDP each ask for something specific and evidenced. None of them asks whether you have restored from backup this year. Both halves are below.

Instrument	What it requires	What Zentara does	What the institution keeps
Perpres 95/2018 SPBE · evaluated under Pemdi	Electronic-based government for every institution. The evaluation itself changed in 2026: PermenPANRB 8/2026 replaced the old SPBE index with Evaluasi Kinerja Pemerintah Digital, running now across 645 institutions with external academic assessors and weighted toward service impact and citizen satisfaction rather than ICT maturity documentation.	Prepare against the instrument being applied this cycle rather than the one most institutions still hold evidence for — the emphasis moved, and documentation built for the old domains does not answer the new questions.	Evidence mapped to the current cycle
Perpres 47/2023 Presiden RI	National Cyber Security Strategy across eight pillars, including protection of vital information infrastructure, preparedness and resilience, and national cryptographic independence.	Build against the pillars your institution owns, with the resilience pillar treated as an operational exercise rather than a policy document.	Tested playbooks, trained responders
BSSN SPBE security BSSN	Security standards for SPBE, including audit of application and infrastructure security, and establishment of an institutional CSIRT.	Application and infrastructure assessment, and CSIRT stand-up that survives the person who set it up moving on.	Assessed estate, operating CSIRT
PP 71/2019 Republik Indonesia	Electronic system obligations for public-scope operators, including where systems and data may be placed.	Architecture and deployment where residency is documented as a data path rather than asserted in a clause.	Documented data path, residency evidence
UU PDP Republik Indonesia	Lawful processing, impact assessment and notification of a personal data breach within 72 hours. State bodies are within scope.	Governance and runbooks written for institutions where the notification decision crosses more than one authority and nobody wants to sign first.	DPIA records, notification runbook, RACI
Perpres 16/2018 as amended by Perpres 46/2025	Government procurement rules that determine what can be bought, on what schedule, and against which budget line.	Scope engagements to fit DIPA reality and procurement categories — a proposal that cannot be procured is not a proposal, however good the security in it.	Procurable scope, phased against budget

Perpres 95/2018

SPBE · evaluated under Pemdi

Requires

Electronic-based government for every institution. The evaluation itself changed in 2026: PermenPANRB 8/2026 replaced the old SPBE index with Evaluasi Kinerja Pemerintah Digital, running now across 645 institutions with external academic assessors and weighted toward service impact and citizen satisfaction rather than ICT maturity documentation.

We do

Prepare against the instrument being applied this cycle rather than the one most institutions still hold evidence for — the emphasis moved, and documentation built for the old domains does not answer the new questions.

What the institution keeps

Evidence mapped to the current cycle

Perpres 47/2023

Presiden RI

Requires

National Cyber Security Strategy across eight pillars, including protection of vital information infrastructure, preparedness and resilience, and national cryptographic independence.

We do

Build against the pillars your institution owns, with the resilience pillar treated as an operational exercise rather than a policy document.

What the institution keeps

Tested playbooks, trained responders

BSSN SPBE security

BSSN

Requires

Security standards for SPBE, including audit of application and infrastructure security, and establishment of an institutional CSIRT.

We do

Application and infrastructure assessment, and CSIRT stand-up that survives the person who set it up moving on.

What the institution keeps

Assessed estate, operating CSIRT

PP 71/2019

Republik Indonesia

Requires

Electronic system obligations for public-scope operators, including where systems and data may be placed.

We do

Architecture and deployment where residency is documented as a data path rather than asserted in a clause.

What the institution keeps

Documented data path, residency evidence

UU PDP

Republik Indonesia

Requires

Lawful processing, impact assessment and notification of a personal data breach within 72 hours. State bodies are within scope.

We do

Governance and runbooks written for institutions where the notification decision crosses more than one authority and nobody wants to sign first.

What the institution keeps

DPIA records, notification runbook, RACI

Perpres 16/2018

as amended by Perpres 46/2025

Requires

Government procurement rules that determine what can be bought, on what schedule, and against which budget line.

We do

Scope engagements to fit DIPA reality and procurement categories — a proposal that cannot be procured is not a proposal, however good the security in it.

What the institution keeps

Procurable scope, phased against budget

Restore · The control nobody scores

The question after an incident is not how it got in.

Post-incident reporting concentrates on the intrusion, because that is the interesting part. Institutions are judged on something duller: how long the service was down, and how much did not come back. The June 2024 analysis is uncomfortable reading precisely because nothing in it was advanced — outdated software, weak configuration, and no working backup regime. That combination is not rare and it is not a failure of sophistication. The ladder below is where an institution actually sits on the only control that decides the outcome once prevention has already failed.

Recovery capability

1
Assumed
Backups are configured. Nobody has confirmed they complete, and nobody has read the logs.
2
Verified
Backups complete and are monitored. No restore has been attempted.
3
Restored once
A restore has been performed, on one system, under calm conditions, by the person who built it.
4
Rehearsed
Whole-service recovery exercised to a time objective, by staff who will actually be on shift.
5
Adversarial
Recovery exercised assuming backups were also targeted — offline copies, tested, held apart.

Highlighted: where an institution has to be before it can honestly say services would return.

Framing derived from published analysis of the June 2024 PDNS incident

Sector threat model

Ransomware against shared hosting, where one intrusion becomes two hundred outages
Backups that exist on paper and have never been restored from
Legacy applications nobody owns, inherited across three changes of leadership
State-sponsored intrusion patient enough to wait out a budget cycle
Citizen data concentrated in systems designed before UU PDP existed
Capability collapse when the one competent administrator transfers to another posting

What this sector answers to

The regulatory landscape for government & public sector. Our own accreditations are listed on certifications.

Perpres 95/2018 — SPBEPermenPANRB 8/2026 — PemdiPerpres 47/2023BSSN SPBE securityPP 71/2019UU PDPPerpres 16/2018 jo. 46/2025ISO 27001

Track record

AVAS formally reviewed by BSSN. Managed government cloud scoped for the Ministry of Communications and Digital Affairs. Bug bounty design at national social-security scale.

For provincial and city government

The same obligations, a fraction of the staff.

A kabupaten Diskominfo carries the SPBE evaluation, the UU PDP duty and the CSIRT expectation with a team you could fit in one room. Treating that as a smaller version of a ministry is how the gap keeps widening, because the answer that works in Jakarta is unaffordable everywhere else.

Shared and regional delivery, so a monitoring capability no single kabupaten can fund becomes one several can.
Evaluation support built for the Pemdi cycle now in progress, where service impact carries weight that documentation alone will not answer.
Recovery first: for an institution with two administrators, a tested restore is worth more than a tool nobody has time to watch.
Training that leaves certified people behind, because the alternative is a dependency that ends with the contract.

Before you have to justify us internally

Bringing in a security vendor is itself a risk you have to evidence.

So here is the answer to the questions your risk committee will ask, before they ask them.

We will tell you the backups are the problem

If restore is untested we say so first, before proposing anything with a licence attached. Selling detection to an institution that cannot recover is selling a better view of the same outcome.

Scoped to how government actually buys

Engagements are structured against DIPA cycles and the procurement categories under Perpres 16/2018 as amended by Perpres 46/2025. A proposal that cannot be procured this financial year is a document, not a plan.

Your people operate it

Build-operate-transfer is the default. Institutional capability has to outlast a posting rotation, a change of leadership and the end of our contract.

In jurisdiction, under Indonesian law

PT Mars Bumi Indonesia. Systems, data and staff stay inside the country, which makes the PP 71/2019 placement question a document rather than an argument.

Findings go to you before anyone else

No disclosure to third parties, no case studies, no naming the institution. An assessment that becomes a reputational risk is one that will not be commissioned again.

Formally reviewed where it counts

AVAS has been through formal BSSN review. We would rather be examined by the national authority than describe ourselves as aligned with it.

Recommended

Solutions for Government & Public Sector

Turnkey SOC (Build-Operate-Transfer)

Managed Government Cloud

Data Center Build & AI Infrastructure

Secure Data Center Design

Critical Infrastructure & SCADA/OT Protection

vCISO — Virtual CISO

Data Governance (UU PDP)

VAPT

VAPT & Offensive Security

Penetration testing for Government & Public Sector

30 services in the catalog apply to Government & Public Sector — from point-in-time pentests to red team and continuous validation.

Explore all 30

Penetration Test

External Network Penetration Test

Black-box test of internet-facing assets, perimeter exposure, and exploitable services.

Penetration Test

Internal Network Penetration Test

Assumed-breach lateral movement, AD abuse, sensitive data discovery from inside.

Penetration Test

Active Directory / Entra ID Security Assessment

Kerberoasting, AS-REP, ACL abuse, BloodHound paths, hybrid identity review.

Assessment

Firewall, Router & Switch Configuration Review

Rule base hygiene, ACL drift, hardening against CIS Benchmarks.

Penetration Test

VPN Security Assessment

IKE/IPsec, SSL VPN, split tunneling, ZTNA migration readiness.

Assessment

Email & DNS Security Review

SPF/DKIM/DMARC, MTA-STS, DNSSEC, BIMI, phishing surface.

Penetration Test

Web Application Penetration Test

OWASP Top 10, business logic, authenticated/unauthenticated flows.

Assessment

Secure Code Review (Manual + SAST)

Manual review of critical flows + SAST tooling for OWASP/CWE coverage.

What we have written about it

Our own analysis, published.

All articles

OJK Cyber Resilience Rules for Digital Banks in Indonesia 2026

Indonesia now has 17 licensed digital banks, more than any other country in Southeast Asia. Digital banking penetration has grown alongside them, from 31% of the population in 2022 to a projected 39%, roughly 75 million people, by 2026. Operating a digital bank Indonesia service places an institutio

What Is a Cybersecurity Audit? Types, Process, and Checklist

Most breaches don’t announce themselves. They start quietly, in a system nobody checked: an open port left over from a migration, a contractor account that was never disabled, a backup that hasn’t been tested since it was set up. A cybersecurity audit is how you find these before someone

What Is Ransomware? How It Works and How to Prevent It

Most guides describe ransomware as software that locks your files until you pay. That description is a decade out of date, and believing it is exactly what gets businesses caught. Modern ransomware doesn’t just lock your data. It steals it first, then encrypts what’s left, then threatens

Securing government & public sector?

Start with a scored maturity baseline or go straight to a specialist conversation.

Talk to a Government & Public Sector specialist Take the 5-Minute Cyber Maturity Assessment