Cybersecurity Policies Differences in Indonesia: A Systematic Literature Review of Public and Private Sector

Abstract

Abstract: Rapid digital transformation has increased the reliance of various sectors on information technology, while simultaneously giving rise to increasingly complex cybersecurity risks. Threats such as malware, ransomware, and attacks on critical infrastructure not only result in economic losses but can also disrupt national stability and undermine public trust. In this context, both the public and private sectors play crucial roles through their implemented cybersecurity policies. The public sector, represented by institutions such as the National Cyber and Crypto Agency (BSSN), has a primary mandate to safeguard public interests and national resilience through a top-down approach based on formal regulations. Meanwhile, the private sector is more driven by market demands, the need for innovation, and efforts to maintain customer trust. Therefore, its cybersecurity policies tend to be adaptive, adopting international standards such as ISO/IEC 27001 or the NIST Cybersecurity Framework. This study uses a descriptive-qualitative method with a Systematic Literature Review (SLR) approach to identify, evaluate, and synthesize findings from scientific journals, national policy documents, and recent cybersecurity reports. The results reveal fundamental differences in motivation, governance, and risk mitigation strategies between the public and private sectors in Indonesia. The public sector places greater emphasis on legal compliance and protecting vital infrastructure, while the private sector focuses more on speed of response and protecting business reputation. However, both sectors face similar challenges, such as limited cybersecurity expertise, technology adoption gaps, and weak cross-institutional coordination. This study recommends strengthening public-private collaboration through strategic partnerships to comprehensively and sustainably enhance national cybersecurity resilience.

Abstrak: Percepatan transformasi digital meningkatkan ketergantungan berbagai sektor pada teknologi informasi sekaligus memperluas kompleksitas risiko siber. Ancaman seperti malware, ransomware, dan serangan terhadap infrastruktur kritis tidak hanya menimbulkan kerugian ekonomi, tetapi juga mengancam stabilitas negara serta kepercayaan publik. Dalam situasi ini, sektor publik dan swasta berperan penting melalui kebijakan keamanan siber. Sektor publik, melalui lembaga seperti Badan Siber dan Sandi Negara, bertugas melindungi kepentingan masyarakat dan ketahanan nasional dengan pendekatan top-down berbasis regulasi. Sebaliknya, sektor swasta didorong oleh kebutuhan pasar, inovasi, dan kepercayaan pelanggan sehingga kebijakannya lebih adaptif dengan standar internasional seperti ISO/IEC 27001 dan NIST Framework. Penelitian ini menggunakan metode deskriptif kualitatif dengan pendekatan SLR untuk menelaah dan mensintesis temuan dari jurnal, dokumen kebijakan, dan laporan terbaru. Hasil menunjukkan perbedaan mendasar pada motivasi, tata kelola, dan mitigasi risiko di Indonesia: sektor publik menitikberatkan kepatuhan hukum serta perlindungan infrastruktur vital, sedangkan sektor swasta pada respons cepat dan reputasi bisnis. Meski demikian, keduanya menghadapi kendala serupa berupa keterbatasan ahli, kesenjangan teknologi, dan lemahnya koordinasi. Studi ini merekomendasikan penguatan kemitraan publik-swasta guna memperkuat ketahanan siber nasional secara berkelanjutan.