{"url_path":"/sec/tlk/10-k/2026/item-16k","section_key":"item-16k","section_title":"Item 16K CYB****ERSECURITY**","topic":"sec","document":{"doc_type":"20-F","doc_date":"2026-05-15","source_url":"https://www.sec.gov/Archives/edgar/data/1001807/0001104659-26-062051-index.html","accession_number":"0001104659-26-062051","cik":"0001001807","ticker":"TLK","issuer_name":"PERUSAHAAN PERSEROAN PERSERO PT TELEKOMUNIKASI INDONESIA TBK","edgar_url":"https://www.sec.gov/Archives/edgar/data/1001807/0001104659-26-062051-index.html","primary_entity_key":"0001001807","primary_entity_name":"PERUSAHAAN PERSEROAN PERSERO PT TELEKOMUNIKASI INDONESIA TBK"},"word_count":2738,"has_tables":true,"body_markdown":"**ITEM 16K. CYB****ERSECURITY**\n\n​\n\nWe endeavor to create a cybersecurity framework through continuous monitoring, regular assessments, a skilled workforce, and a dedicated governance structure for data protection and cybersecurity operations.\n\n​\n\n**Regular Monitoring and Audits**\n\nAt the Board of Directors level, the responsibility for cybersecurity falls to the Director of Network. Vice President (VP) of Network Strategy & Architecture is responsible for Group’s overall cybersecurity strategy and governance, while our Operational Vice President (OVP) of Cybersecurity is responsible for managing the day-to-day operation of Telkom’s Cybersecurity Operation. Both reports directly to the Director of Network.  Our Cybersecurity Operation Center operates 24/7 to address cybersecurity threats and collaborates with related units to protect sensitive data. Its responsibilities include monitoring and responding to security threats and incidents, analyzing and investigating security events, conducting forensics, performing security testing and vulnerability management, and managing security threat intelligence.\n\nSince 2022, the TelkomGroup Cybersecurity Squad was initiated to support cross-entity collaboration on cybersecurity. In 2024, this function was formalized as the TelkomGroup Cybersecurity Committee, which includes representatives from all Telkom Directorates and cybersecurity representatives from our subsidiaries. The Committee’s Management is led by the Director of Network & IT Solutions, with the VP of Network/IT Strategy, Technology & Architecture serving as Working Level Coordinator. The Committee oversees our Group’s cybersecurity governance, providing strategic direction, as well as cybersecurity-related risks.\n\nCybersecurity risks are incorporated into our overall risk profile and our risk management team is responsible for managing these risks. Our risk management team, together with the management of each unit throughout our Group, promotes that risk assessment is carried out, establishes and executes our Risk Treatment Plan, implements controls, monitors and reviews the effectiveness of our information security system operations, and documents the results.  We conduct risk assessments at least once a year, according to rules set out in our Risk Assessment Policy Standards. We also conduct internal and external audits periodically. Discrepancies between implementation and policy identified in the operational process and audit results are followed up with evaluations and necessary corrective steps, which are fully\n\n220\n\n[Table of Contents](#TOC)\n\ndocumented. For oversight purposes, our risk management team provides a quarterly report on our risk profile to the Planning and Risk Evaluation and Monitoring Committee, which is part of our Board of Commissioners.\n\n**Incident Management**\n\nOur Computer Security Incident Response Team (“**CSIRT**”) manages and responds to cybersecurity incidents. Our CSIRT is part of our Group’s Crisis Management Team (CMT), which is responsible for preparing for and responding to potential emergencies and crises that could impact our organization. The CSIRT is responsible for managing crises related to cybersecurity.\n\n·*Composition*: The CSIRT consists of designated personnel with specific roles and responsibilities related to cybersecurity incident management, such as the Coordinator and the Secretary, and multiple specific fields within it, such as Legal, Communications & Public Relations, IT & Infrastructure, among others. These designees each have designated tasks such as coordinating incident response activities, monitoring cybersecurity incident activities, supporting data management and reporting, undergoing post-incident evaluations, and ensuring all actions adhere to specific procedural and security response guidelines.\n\n·*Procedure and coordination*: The CSIRT coordinates with various departments and stakeholders within our Company to promote a comprehensive and timely response to cybersecurity incidents, such as by allowing coordinators and other key personnel to appoint appropriate deputies for daily operations or during incident handling. This enables inter-unit and even inter-subsidiary coordination for rapid incident response. If an incident suggests potential failures in data privacy, the cybersecurity team promptly coordinates with the Data Protection Team to promote appropriate actions that are taken. In such cases, our Data Privacy Policies are applied to address the incident, ensure compliance with data protection regulations, and mitigate related risks.\n\n·*Reporting*: The CSIRT is responsible for reporting cybersecurity incidents to the relevant authorities, our management, and affected parties, as per our incident response plan, to promote compliance with applicable regulatory requirements.\n\n**Policies and Procedures**\n\nWe implement several policies and procedures designed to protect confidential information and personal data, as part of a comprehensive approach to maintaining confidentiality and preventing unauthorized access or disclosure. These policies and procedures include:\n\n·*Encryption technology*: Such policies specify the design and implementation of adequate encryption technology to secure the transmission of information according to our needs, thus ensuring that sensitive data remains confidential during communication processes. With respect to encryption, we have implemented policies regarding the management of cryptography and security of physical environments that span both digital and physical domains of information security.\n\n·*Access control management*: We have established Access Control Management standards governing physical access management, remote access management, user access management, and controls over system and application access. These standards include obligations not to share user access information (including passwords) with others and to report unauthorized use of access credentials. We adopt a structured approach to restrict and monitor who has access to specific pieces of information, thereby limiting the risk of unauthorized disclosure. Furthermore, we conduct regular review and revision of our Access Control\n\n221\n\n[Table of Contents](#TOC)\n\nManagement standards. The purpose of these reviews is to assess the continued effectiveness of our access control mechanisms and their alignment with the evolving security landscape.\n\n·*Confidentiality agreements*: Generally, we require written permission from the relevant business unit before copying or distributing sensitive data. Additionally, our confidentiality measures extend to controlling how information is shared, both internally and externally, and ensuring that sensitive data is only used for legitimate business purposes.\n\n·*Monitoring and reporting*: Our information security policies include provisions for regular reviews of security procedures and control*,*as well as the effectiveness of information security control measures. These reviews are documented and evaluated to identify areas for improvement.\n\n·*Segregation of duties*: Our emphasis on ensuring segregation of duties to prevent misuse of excessive privilege**and* *information is also a critical measure for safeguarding the confidentiality and integrity of sensitive data. By requiring multiple checks or approvals for critical actions, we aim to reduce the risk of unauthorized *access or*disclosures.\n\n·*Incident response:* Our information security policies include requirements for regular reviews of information security incidents and the effectiveness of its response.  We also require immediate reporting in cases where sensitive data is damaged, lost, or stolen, so that we can quickly identify and mitigate any breaches of confidentiality.\n\nFurthermore, we implement and regularly update our cybersecurity policies to align with evolving needs and industry standards and regulations. These updates incorporate changes and improvements in information security management with an aim of ensuring that our practices remain effective and relevant. In order to keep our information security standards current and effective, we endeavor to adhere to international standards such as ISO/IEC 27001: 2022, which are globally recognized frameworks for information security. We attained these certifications on February 13, 2025. In addition, with respect to application development, we consider the OWASP Secure Coding Practices Checklist, which provides guidance on best practices in coding to enhance application security. This checklist specifically helps developers avoid common coding pitfalls that could lead to security vulnerabilities. We also conduct vulnerability and penetration tests on the applications to promote compliance with our cybersecurity standards.\n\n​\n\nOverall, our policies and procedures collectively form a framework aimed at preserving the confidentiality of sensitive information and preventing unauthorized disclosure through technical, administrative, and procedural safeguards.  \n\n**Employees and Third Parties**\n\nWe endeavor to establish clear guidelines for employee behavior and raise cybersecurity awareness among our workforce in the following ways. In addition to our own employees, we also extend our information security regulations to external parties and work partner employees. This means that individuals or organizations who collaborate with or provide services to us are required to adhere to our information security policies and standards.\n\nTo effectively address potential cybersecurity threats stemming from our engagement with third-party service providers, we carefully identify and assess cybersecurity risks inherent to such engagement on a case-by-case basis. Following such identification of risks and assessment, we may include specific agreements, covenants and representations in our contracts with such third-party service providers to require compliance with cybersecurity standards we deem appropriate.\n\nEmployee Behavioral Guidelines\n\n222\n\n[Table of Contents](#TOC)\n\nWe have established clear and detailed guidelines designed to safeguard confidential information and minimize the risk of information leakage or misuse by our employees. These guidelines encompass various aspects of data handling, confidentiality, and the acceptable use of company resources. Specifically, our guidelines cover the following:\n\n·*Employee obligations and prohibitions*: Employees are required to know, understand, and comply with our information security policies, sign an Integrity Pact annually, and responsibly manage and protect information from misuse by unauthorized parties. Our guidelines explicitly prohibit several actions to protect confidential information, including sharing passwords, accessing information unlawfully, misusing company information, storing important company documents without proper security measures, and leaving devices unsecured. Our employees are also responsible for ensuring their actions align with applicable standards.\n\n·*Social media and external communication*: Our guidelines prescribe restrictions on posting or forwarding information classified as Highly Confidential or Confidential on social media, except for specific company programs. Our guidelines also prohibit the posting or forwarding of hoax news, provocative materials, or content related to sensitive social issues, and the unauthorized sharing of company information with unauthorized parties.\n\n·*Use of cloud storage and external software*: Storing classified information in cloud storage or websites not managed by us is forbidden, as is the installation of software on information technology work equipment outside of established procedures or that infringes on intellectual property laws.\n\n·*Handling and transmission of sensitive data*: Our guidelines mandate that transactions of data and information classified as Confidential or Highly Confidential must be conducted through systems managed by us to prevent unauthorized access and promote data integrity.\n\nThese guidelines aim to promote responsibility among our employees with regard to the handling and distribution of confidential and sensitive information. The measures are designed to cultivate a security-conscious environment, thereby reducing the likelihood of inadvertent leaks or malicious misuse of company data and resources.  \n\nIncreasing Cybersecurity Awareness\n\nWe conduct programs aimed at improving the cybersecurity awareness of our employees. This includes continuous socialization of our Information Security Governance policies and competency enhancement related to cybersecurity awareness. We also periodically assess employee cybersecurity awareness, administer mandatory e-learning courses, and conduct phishing simulation exercises.\n\nWe also have a procedure in place for enforcing discipline regarding any violations of our information security regulations, which includes coordination among relevant units, such as the Human Capital Management Unit and Cybersecurity Unit.\n\nAs of the date hereof, we have 90 employees with various globally recognized professional certification of information security/cybersecurity and related certifications at the intermediate and expert levels, such as the following:**\n\n1.**Certified Information Systems Security Professional (CISSP)** - Offered by the International Information System Security Certification Consortium, CISSP validates an IT security professional's technical skills and experience in designing, engineering, and managing the overall security posture of an organization;\n\n2.**Offensive Security Certified Professional (OSCP)** - OSCP is a technical certification focused on practical penetration testing skills and methodologies. Provided by Offensive Security, it prepares professionals to conduct ethical hacking in a variety of scenarios and environments;\n\n223\n\n[Table of Contents](#TOC)\n\n3.**Certified Ethical Hacker (CEH)** - Offered by the International Council of Electronic Commerce Consultants (EC-Council), this certifies individuals in the field of ethical hacking by demonstrating expertise in identifying vulnerabilities from a cybersecurity perspective in a vendor neutral environment;\n\n4.**CompTIA Cybersecurity Analyst (CySA+) -** Offered by CompTIA, this is a certification that prepares IT security analysts to use behavioral analytics to detect, combat, and prevent cybersecurity threats through continuous monitoring and analysis;\n\n5.**Certified Information Security Manager (CISM) -** Offered by ISACA, this certification equips professionals with the knowledge to manage and oversee an organization’s information security program and align it with business objectives;\n\n6.**Certified Information Privacy Technologist (CIPT)**- Issued by the International Association of Privacy Professionals (IAPP), is a professional privacy credential that validates a practitioner’s understanding of privacy’s role in technology—particularly how to build privacy-friendly products, services, and systems and embed data protection practices into the technology lifecycle;\n\n7.**Certified Information Systems Auditor (CISA)** - Offered by ISACA, CISA validates an IT security professional's auditing, control, and assurance of information systems;\n\n8.**Computer Hacking Forensic Investigator (CHFI)** - Offered by EC Council, this certification validates the knowledge and skills to perform effective digital forensics investigations, particularly in the context of computer hacking incidents;\n\n9.**Certified Cloud Security Professional (CCSP)** - Offered by International Information System Security Certification Consortium, the certification validates the knowledge of cloud security architecture, governance, risk management, and compliance;\n\n10.**IMI Certified in Data Protection (CDP) -** Issued by **Identity Management Institute (IMI)**, a data protection certification covering privacy/data protection requirements and the administrative and technical controls used to protect data across its lifecycle;\n\n11.**ISACA Certified in the Governance of Enterprise IT (CGEIT)** - Issued by **ISACA**, a credential validating expertise in governing enterprise IT, including benefits/value delivery, risk optimization, and resource optimization;\n\n12.**Security Blue Team Level 1 (BTL1)** - Issued by **Security Blue Team**, an entry-level blue-team certification focused on practical SOC/defensive skills such as investigation workflows, threat intel, and incident response fundamentals;\n\n13.**Hack The Box Certified Defensive Security Analyst (HTB CDSA)** - Issued by **Hack The Box (HTB Academy)**, a hands-on defensive certification assessing SOC-relevant security analysis and incident-handling skills;\n\n14.**ISACA Certified Data Privacy Solutions Engineer (CDPSE) -** Issued by **ISACA**, a privacy engineering credential focused on designing and integrating privacy solutions across governance, architecture, and the data lifecycle;\n\n15.**PMI Project Management Professional (PMP) -** Issued by the **Project Management Institute (PMI)**, a globally recognized project management credential demonstrating capability to lead and deliver projects across predictive, hybrid, and agile approaches;\n\n224\n\n[Table of Contents](#TOC)\n\n16.**Certified in Risk and Information Systems Control (CRISC) -** Issued by **ISACA**, an IT risk management certification demonstrating expertise in identifying and managing IT risk and implementing information systems controls;\n\n17.**Certified CyberDefender (CCD)** - Issued by **CyberDefenders**, a hands-on blue-team/SOC certification validating real-world defensive and investigative skills (e.g., threat hunting and incident response) via a practical exam;\n\n18.**OpenGroup TOGAF Certified** - Issued by **The Open Group**, an enterprise architecture certification earned by passing TOGAF exams, demonstrating knowledge of the TOGAF Standard and its application;\n\n19.**Cisco Certified Network Associate (CCNA)** - Issued by **Cisco**, a foundational networking certification covering core networking concepts plus basics of security, automation, and troubleshooting;\n\n20.**PMI Certified Associate in Project Management (CAPM)** - Issued by the **Project Management Institute (PMI)**, an entry-level project management certification validating foundational project management knowledge and terminology; and\n\n21.**Cisco Certified Network Professional Enterprise (CCNP Enterprise)** - Issued by **Cisco**, a professional-level enterprise networking certification demonstrating skills to implement, operate, and troubleshoot enterprise networks, including security and automation topics.\n\nOur cybersecurity training programs aim to achieve the following:\n\n·*Raising awareness*: The training programs educate employees about potential cyber threats, suspicious activities (such as phishing attempts via suspicious links), and risky behaviors (such as sharing passwords). This heightened awareness helps employees identify and avoid actions that could lead to cyber-attacks;\n\n·*Developing skills*: The certification opportunities included in the training programs seek to equip the workforce with the necessary technical skills to effectively respond to and manage cybersecurity incidents when they occur;\n\n·*Strengthening the human firewall*: Employees are often the first line of defense against cyber intrusions. By training our employees in cybersecurity best practices, we strengthen our overall security posture and reduce the likelihood of successful attacks resulting from human error or lack of awareness; and\n\n·*Enabling proactive cyber-risk management*: We hope that the training will enable our employees to proactively identify potential vulnerabilities and threats, allowing us to address risks before they lead to full-blown security incidents. Essentially, the training programs seek to shift from a reactive incident response framework to proactive risk management.\n\nOverall, we take a comprehensive approach to cybersecurity, implementing various measures and policies to protect sensitive information and maintain the integrity of our systems and data.\n\nAs at the date hereof, no risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected us, including our business strategy, results of operations, or financial condition. However, we believe that we, as with other telecommunications companies worldwide, face increasing cybersecurity threats that may, if such risks materialize, materially affect our business strategy, results of operations, or financial condition. For a description of such threats, please see “*Item 3D—Risk Factors—Risks Related to Our Business—Our networks and equipment face potential physical and cybersecurity threats such as theft, vandalism and acts intended to disrupt our operations, which could materially and adversely affect our operating results*”\n\n225\n\n[Table of Contents](#TOC)\n\n**PART III**"}