Since 11 August 2026, Indonesia’s SPBE IT-asset and service-management guidance is in force. Central agencies and local governments have until 11 August 2027 to align. Six operational steps you can start now.
Tim MarkasDevTechnology Partner, Jakarta
On 7 August 2026 the Minister of Communication and Digital Affairs issued Ministerial Regulation (Permenkomdigi) Number 12 of 2026 on Guidelines for Managing Information and Communication Technology Assets of the Electronic-Based Government System (SPBE) and Guidelines for Managing SPBE Services. It was promulgated and took effect on 11 August 2026 (State Gazette of the Republic of Indonesia 2026 Number 556).
For many agencies this is not a distant policy paper. It is operational guidance that closes gaps often left in slide decks: who owns ICT assets, how services are catalogued, and how long an outage may run without a target.
Permenkomdigi 12/2026 implements Article 50(5) and Article 54(8) of Presidential Regulation Number 95 of 2018 on SPBE. It has two interdependent tracks.
SPBE ICT asset management covers hardware and software used in SPBE. The lifecycle has four stages: planning, procurement, operation/management, and disposal. The actors are named: the ICT work unit under the secretariat (or equivalent) in central agencies, and the regional communication and informatics office at province and regency/city level.
SPBE service management covers three processes: user support (complaints, incidents, requests, changes), service operations (running and maintaining SPBE infrastructure and applications), and application management (build and change guided by SPBE methodology). Roles are structured: service sponsor (pembina), accountable owner, service executor, and technical team.
Agencies that already had asset or service management before this regulation must align within one year of promulgation under Article 8. That countdown points to 11 August 2027.
Annex II requires every service to have a catalogue that at least includes name, description, provider, executor, technical team, access method, availability target, support contact, support hours, fulfilment target, and availability status. The catalogue must be easy for users to reach—not buried in a shared folder opened only before an audit.
Without a catalogue, the helpdesk answers “it depends” and users guess via WhatsApp. With a catalogue, targets become measurable commitments. The guidance even gives example fulfilment targets for common service groups: account services under three hours, application hosting under 14 days, licensed software support under one day. Those figures are examples, not a uniform mandate for every service, but the direction is clear: write the target before the next incident.
Services are classified as critical, essential, or normal.
Annex examples place national-scale government administration and public services in the critical class. Final classification rests with each central agency and local government based on urgency. What to avoid: labelling almost every application “critical” without RTO/RPO and without a recovery drill. Classification without a recovery plan only adds reporting burden.
Incident-handling targets are also tied to classification. For a major impact on a critical service, the tightest example response time is under 30 minutes with resolution under one hour. Those are priority examples, not SLAs that auto-apply everywhere. The mindset matches sound Operate practice: set priority before the alarm rings.
On the asset side, the guidance stresses a full lifecycle. Planning must consider service changes, increased use, and availability. Management includes configuration control through the electronic SPBE ICT Asset Management system. Disposal must not become “a dead server in a storeroom with no record.”
Self-monitoring and evaluation must run at least twice a year. Central agencies report results to the Ministry through the electronic system it provides. Regencies/cities report to the province; provinces forward a consolidated report to the Ministry. The Ministry may run an external evaluation at least once a year when needed. The guidance also refers, among others, to SNI ISO/IEC 19770-1 on IT asset management systems.
In short: an inventory that is not maintained is an availability promise you cannot prove.
Regional SOEs (BUMD), regional hospitals and partners that run public services often share assets and applications with the parent SPBE. Your Operate contracts should reflect service classification, availability targets and inventory duties. A vendor that only “fixes when it breaks” is not enough for critical services; we contrast that in Maintenance vs Operate.
If you are purely private sector, the guidance is still a useful checklist: service catalogues, critical classification, RTO/RPO and asset lifecycle are foundations of operational reliability anywhere.
MarkasDev is a Technology Partner for operational reliability, not a software house selling features.
If your SPBE asset inventory and service catalogue still live in separate spreadsheets, book a Diagnose session before the August 2027 countdown gets shorter.
Trellix Wise for Private Cloud GA 15 Oct 2026: AI for the SOC inside your boundary. Survey of 600 CISOs: 95% saw an AI-linked insider incident, average cost USD 2.4M. Five steps for business.
FIDO's Passkey Index 2026: passkey sign-ins succeed more often, are faster, and cut phishing and SMS OTP costs. But while passwords remain a fallback, the gap stays open. Six steps for businesses.
