Is Indonesia’s Maritime Cybersecurity Framework Aligned with IMO Standards?

Originally published in ACTIO E-Magazine Edition 30 (September 2026). Law as of September 2026.

In Brief

• Short answer: Indonesia has the legal building blocks to align with the IMO’s cybersecurity expectations, but alignment is not yet complete, and the gaps sit in implementation, not in the textbook.
• Key takeaways: Indonesia’s Shipping Law and related regulations require vessels and companies to manage both safety and security, but do not expressly mention cyber risk — industry practice, read together with the ISM Code and Resolution MSC.428(98), fills that gap; two newer instruments, the PDP Law and the ITE Law as amended, add data protection and electronic-system duties that reach maritime systems; further alignment depends on integrating cyber risk into the Safety Management System and its audit, and on standards and certification that do not yet exist for most domestic operators.
• Practical check: A ship operator’s Safety Management System should record cyber risk in its risk register, name a person responsible for IT and OT security, and obtain the evidence a Port State Control or flag inspection can test, because a generic permission to use digital systems will not satisfy an auditor.

Regulation

Under the International Convention for the Safety of Life at Sea, SOLAS Chapter IX, every company operating a ship must comply with the International Safety Management (ISM) Code. The ISM Code requires a Safety Management System that identifies hazards and manages risks, and the system must be certified by the flag state. In 2017, the IMO adopted Resolution MSC.428(98), Maritime Cyber Risk Management in Safety Management Systems. It confirms that cyber risk must be treated as part of the same management system and asks flag states to require cyber risk management, with the Maritime Safety Committee’s guidance in MSC-FAL.1/Circ.3/Rev.2 and the industry guidelines of BIMCO and others, before the first annual verification of the company’s Document of Compliance after 1 January 2021.

Indonesia has ratified SOLAS and enacted Law No. 17 of 2008 on Shipping (the Shipping Law), implemented through implementing regulations, including Government Regulation No. 51 of 2002 on Shipping (as amended), and ministerial regulations on vessel safety and the SMS. From the Shipping Law’s definition of shipping safety — safe operations, safe vessels, and the safety of those on board — the obligation to manage maritime risk follows, although no Indonesian provision names cyber risk expressly. The Shipping Law’s Article 12 states that a ship’s safety certificate depends on vessel safety and compliance with safety, management, and security requirements. Articles 17 and 18 of the Shipping Law impose shipowner and operator liability for safety, and the liability includes a duty of seaworthiness, which is now read to include compliance with the ISM Code.

For cyber risk specifically, Indonesia does not yet have a maritime-specific cyber regulation. Instead, three horizontal laws supply the framework. Law No. 27 of 2022 on Personal Data Protection (the PDP Law) imposes protection, breach-notification, and accountability duties for personal data, which includes crew and passenger data handled on board and ashore — and a data breach involving crew or passenger personal data can also trigger notification duties to the data subjects and to the regulator. Law No. 11 of 2008 on Electronic Information and Transactions (the ITE Law), as amended, imposes duties on Electronic System Operators to maintain reliable and secure electronic systems. The ITE Law’s electronic system provisions apply to most systems used in shipping, including those on board, and the Government Regulation No. 71 of 2019 on Electronic Systems and Transactions (GR 71/2019) applies to Electronic System Operators, including private operators, and sets out security obligations and a functional duty to maintain electronic systems.

Are We Aligned with the IMO?

Indonesia’s approach is to transpose international rules into national law and to require the ISM Code’s Safety Management System. Because SOLAS, the ISM Code, and Resolution MSC.428(98) form a single structure in Indonesia — shipping standards for maritime safety and security under the Shipping Law, and the ITE Law — the obligation to manage maritime cyber risk is already present in Indonesian law, even though no provision uses the term “cyber risk”. Practice in the Indonesian industry, in particular by operators engaged in international trade, already applies this interpretation by incorporating cyber risk into Safety Management Systems, often through classification society rules such as those of Lloyd’s Register or Bureau Veritas, which set out cyber security requirements for ships and systems.

However, alignment is incomplete. Three gaps stand out.

First, Indonesian regulation provides no certification standard for cyber risk management in maritime operations. The general requirements set out in the laws and regulations are transposed within the Safety Management System, but the implementing regulations do not yet offer the level of detail that the IMO circulars do. A maritime operator can comply by adopting industry or classification society standards, but the audit standard is set by the company and the auditor. Indonesia has not yet adopted a nationally uniform cyber security standard for shipping, and there is no direct implementing regulation or approved standard for cyber security.

Second, Indonesia’s maritime infrastructure is accessed across a mix of public and private networks and systems. Ports, terminals, and ships interact with many bodies and networks, and Indonesia has not designated maritime cyber infrastructure as critical information infrastructure (CII). The National Cyber and Crypto Agency (BSSN) and the Maritime IT Department are responsible for sectoral governance, but there is no single regulator with comprehensive authority to set and enforce cyber risk standards for maritime operators, and no standardised maintenance and patching requirements exist beyond those required by the ISM Code and the class rules.

Third, Indonesian law on data protection and electronic transactions does not include a direct cyber risk management obligation for maritime operators. The PDP Law and the ITE Law apply to companies, ships, and shore-based operations, but they do not have a maritime-specific audit process or require a formal audit certificate.

Where Indonesia does have an opportunity to close the gap is in the way the IMO’s cyber risk management model is operationalised. The Maritime Safety Committee’s approval of industry guidelines and the normative requirement set out in MSC-FAL.1/Circ.3/Rev.2, together with the IMO’s requirement to incorporate cyber risk management into the Safety Management System, creates a framework that Indonesia can apply through the audit system that already exists for other types of regulation. The objective is to bring the Maritime Safety and the Maritime IT Department of the Indonesian shipping companies into the community, so that the operational procedures for cyber risk management are incorporated into the audit process as part of that system.

What This Means for Operators

For a ship operator, the practical consequence is that cyber risk cannot be treated as a separate IT issue. The IMO treats it as part of the Safety Management System, and Indonesia’s Shipping Law effectively requires the same of a ship operator. Three practical consequences follow.

• The Safety Management System should expressly set out how cyber risk is managed: a risk identification, identification by a named responsible person, and a process to review and update procedures and to apply and measure the Safety Management System’s effectiveness.
• A cyber incident involving Indonesian waters or vessels operating under the Indonesian flag that affects a Indonesian port may also trigger notification obligations under the PDP Law’s breach notification regime, and under the ITE Law and GR 71/2019, which applies to Electronic System Operators generally.
• A company that treats cyber risk as part of the business rather than as part of the operation’s risk management will find that a cyber audit under the Safety Management System will not produce a certificate of compliance.

Conclusion

The IMO’s framework treats cyber risk as one more hazard to be managed within the Safety Management System, and Indonesian law accepts that translation. The framework is built and the regulations are in place, but it is the evidence that matters. The gaps in Indonesia’s implementation — certification standards, the mix of port and terminal systems, the regulatory framework for maritime security, the lack of a designated critical information infrastructure regime, the absence of a dedicated regulator, and the lack of a uniform cyber standard for shipping — will show up at audit, in port state control, and in the loss record. The question, for most operators, is not whether the law applies — it does — but whether the evidence of compliance exists. Cyber risk is now a matter of operational safety, and the assessment of that risk is part of the safety management system, not an IT annex. The answer to the question of how aligned Indonesia is with the IMO is that the law is mostly there, but the implementation is not complete: it will take an operational solution to close the gap and raise the resilience of Indonesia’s maritime economy.

Back to ACTIO Edition 30 hub