Beyond the Checklist: Why Indonesia’s Cybersecurity Must Shift from Compliance to Proactive Resilience

In the modern digital landscape, checking all the boxes on a cybersecurity audit doesn't mean you are safe. In fact, a government agency can follow every security protocol to the letter and still wake up to a devastating ransomware attack the very next morning. This is the harsh reality of our AI-driven era, and it is why Indonesia is being urged to fundamentally rethink its approach to digital defense.

At a recent industry event in Jakarta, Pangarso Dadung Nugroho, the Head of the Centre for Data and Information Technology at the Indonesian Ministry of Foreign Affairs, delivered a clear message: public sector organizations must stop chasing a static "secure state" and start building a dynamic "state of readiness." This paradigm shift from mere compliance to proactive resilience is no longer optional—it is a matter of national continuity.

The Compliance Paradox

Many organizations fall into the trap of feeling safe once they achieve certifications like ISO 27001. While these standards are essential foundations, Nugroho pointed out that they are not the finish line. Many high-profile ransomware victims globally were technically "compliant" organizations.

To illustrate this, Nugroho used a relatable traffic analogy. Compliance is like following the rules of the road and using a GPS so you don't get lost. It is necessary, but it isn’t enough. Resilience, on the other hand, is the driver’s ability to maintain control of the vehicle when the brakes suddenly fail or a tire bursts at high speed. It is about what you do when things go wrong, not just how you try to prevent them from failing in the first place.

Fighting Fire with Fire in the Age of AI

The emergence of artificial intelligence has rewritten the cyber warfare playbook. Attackers are now using AI to scan for vulnerabilities with unprecedented speed and launch sophisticated, automated strikes. In this context, staying stagnant is equivalent to moving backward.

Nugroho raised a poignant question to the public sector: "If attackers are already using AI, why aren’t we?" He emphasized that government organizations must integrate AI into their own detection and response mechanisms. This shift is even more critical given the current global geopolitical climate, where cyber warfare often mirrors physical conflicts, creating an increasingly volatile environment for digital infrastructure.

A Leadership Problem, Not Just a Technical One

One of the biggest hurdles to achieving true resilience is the perception that cybersecurity is purely a "tech person's problem." Nugroho argued that the most significant changes must happen at the leadership level. Cybersecurity is, at its core, a function of organizational risk management and the continuity of public services.

He challenged leaders to change the questions they ask their IT departments. Instead of asking, "Are we compliant with the latest regulations?" the focus should be on, "How quickly can our services be recovered if we are hit by an attack?" This shift in questioning forces a focus on recovery time objectives rather than just defensive walls.

Rebalancing the Security Budget

The recent disruption of Indonesia’s national data center served as a stark reminder of the consequences of poor preparation. Many institutions currently suffer from a budgeting imbalance. Nugroho noted that often 80 percent of the cybersecurity budget is funneled into protection technologies, leaving very little for detection, incident response, and system recovery.

Without a balanced investment strategy, recovery becomes a nightmare. A key technical recommendation shared was the implementation of "air-gapped" backups—backup systems that are physically or logically isolated from the main network. Without these, even your backups can be encrypted or destroyed during a ransomware event, making recovery nearly impossible.

Embracing the Old to Protect the New

In a surprising twist on modern strategy, Nugroho suggested that resilience might sometimes mean looking backward. As society becomes almost entirely dependent on the internet, a global disruption could paralyze critical services.

To counter this, his team at the Ministry is exploring the use of analog technologies, such as radio communications, as a fail-safe. Having alternative, non-digital communication channels ensures that coordination can continue even if the digital world goes dark. It is a pragmatic approach to worst-case scenario planning.

The Power of Collective Defense

Finally, the path to resilience is not a journey to be taken alone. Nugroho emphasized that no single organization can be resilient in a vacuum. He proposed the creation of regular forums where government IT officials can exchange technical and operational experiences, much like existing forums for public relations.

There is also a desperate need to break the culture of silence. Organizations often hide cyber incidents out of fear for their reputation, but this only helps the attackers. By reporting incidents quickly to sectoral Computer Security Incident Response Teams (CSIRTs), agencies can build a collective defense. If one sector falls and remains silent, the infection can easily spread to others. Transparency and collaboration are the ultimate tools for national cyber resilience.