Technology Standards

Intentionally open: standards known only to the examiner cannot be complied with by the party being examined.

Why is it necessary to standardize?

Each regional government agency has the right to implement applications according to its needs. However, all these applications ultimately run on the same infrastructure and are maintained by the same team. This standard is not intended to limit choices, but rather to ensure that applications paid for with local funds can still be maintained after the vendor disappears.

Dependence on a single vendor

The application using unconventional technology can only be repaired by its maker, causing the region to lose its bargaining position.

Unsupported Technology

Software that stops receiving security updates continues to run, but the vulnerability will never be closed.

Unseen maintenance costs

The largest cost of an application is not on its construction, but on its maintenance for many years afterward.

Business Process Categories K1–K8

Standards are organised by the category of business process an application serves, not by the size of its budget. Obligations are cumulative: K5 meets every K4 obligation plus its own, and so on.

One-Page Campaign Page

Characteristics: A single page contains information about activities or programs, does not store data, has no user accounts, and is short-lived.

Examples: Event anniversary warning page, program assistance information page, event announcement page.

Prescribed technologyStatic pages (HTML and CSS) or static page generators such as Hugo or Astro, using official Regional Government templates. Content management systems are only permitted if they use an official theme.

Hosting locationShared hosting owned by Diskominfo

Data storageDoes not use a database

User sign-inNone; all content is open to the public

Security testingAutomated scanning before publishing

BackupsWeekly

Recovery time2 business days

Vendor workYes, or independently with a template

ApprovalHead of Telematics Division

Standard stackHugo or Astro static page result · regional identity template · without database · shared hosting · automatic certificate

Specific prohibitions

Loading forms that collect population identification numbers or other personal data; if necessary, the category rises to K3 or K5.

Standard Category Profile and News Portal

Characteristics: Contains profiles, news, agendas, galleries, and public documents; its content is regularly updated; does not serve transactions.

Examples: Official agency website, regional government news portal, public information disclosure page.

Prescribed technologyPrimary choice for a centralized agency portal managed by Diskominfo. If independent: WordPress version still supported, with themes and plugins from the approved list.

Hosting locationCentralized portal or shared hosting

Data storageMySQL 8.4 LTS or MariaDB 11.4 LTS on the Diskominfo database group

User sign-inOnly content managers; mandatory agency account and two-factor authentication

Security testingAutomated scanning before publishing and annual retesting

BackupsDaily, stored for fourteen days

Recovery time1 business day

Vendor workYes, for display only

ApprovalHead of Telematics Division

Standard stackLatest WordPress version · official regional theme · MariaDB 11.4 LTS on the database group · PHP 8.4 · Nginx · daily backup

Specific prohibitions

Installing themes or plugins from unofficial sources or without licenses
Modifying core system content management parts
Disabling security updates

Light Forms and Services

Characteristics: Collects one-way submissions without user accounts, data is not sensitive, and has a limited lifespan.

Examples: Activity participant registration, satisfaction surveys, proposal intake, activity file collection.

Prescribed technologyGovernment Regional Managed Service. If needs exceed the service capacity, it is built as a lightweight application following all K4 regulations.

Hosting locationManaged Service or Hosted Environment

Data storageDiskominfo Database Group, not files within the application server

User sign-inNone, or limited links

Security testingAutomated scanning; if personal data is loaded, it becomes K5.

BackupsDaily during activity operation

Recovery time1 business day

Vendor workYes

ApprovalHead of Telematics Division

Standard stackRegional Managed Form Service; if built independently, it follows K4 structure with the smallest resource package.

Specific prohibitions

Using third-party online form services outside of Diskominfo supervision for personal data.

Internal Information System for Regional Government Agencies

Characteristics: Used by employees for internal tasks, has user accounts, does not store personal citizen data, and does not directly serve the public.

Examples: Inventory recording, letter management, event scheduling, program achievement monitoring.

Prescribed technologyPHP Route: PHP 8.3 or newer with Laravel 12. JavaScript Route: Node.js 22 LTS with TypeScript. React 19 View with Vite 6 or built-in framework template.

Hosting locationSeparate server provided by Diskominfo, running in a managed container

Data storagePostgreSQL 17 as the primary choice, or MySQL 8.4 LTS, on database groups; not within the application server

User sign-inMandatory integrated agency account; user lists created only with dispensation

Security testingTesting before release and annual re-testing

BackupsDaily, stored for fourteen days, copied outside of the application server

Recovery time8 working hours

Vendor workYes, delivery through repository

ApprovalHead of Telematics Division

Standard stackPHP Route: PHP 8.4 + Laravel 12 + PostgreSQL 17 + Redis + Nginx in Docker container. JavaScript Route: Node.js 22 LTS + TypeScript + NestJS + PostgreSQL 17 + Redis. React 19 View + Vite · access through the integrated agency account

Specific prohibitions

Passwords and keys written in code
Database placed within the application server
Development environment merged with the service environment

Public and Transactional Services System

Characteristics: Accessed by the public, contains personal data such as population number and copies of documents, and generates official outputs in the form of letters, permits, or payment receipts. All K4 regulations apply.

Examples: Permitting service registration, community complaints, student enrollment, and trade fee payments.

Prescribed technologyK4 framework, plus three separate environments, data encryption, object storage for files, and electronic signatures on output documents.

Hosting locationSeparate server with three environments: development, testing, and production

Data storagePostgreSQL 17 with personal data encrypted when stored and transmitted

User sign-inIntegrated agency account for internal use and citizen accounts for the public

Security testingFull penetration testing before deployment, every major change, and annually

BackupsDaily with a six-month recovery test

Recovery time4 hours; data loss no more than 24 hours

Vendor workYes, with restricted data access

ApprovalHead of Telematics Division together with Head of Security and Communication Division

Standard stackK4 Framework · three separate environments · data encryption · file object storage · electronic signatures on output documents · 24/7 monitoring

Specific prohibitions

Vendors holding copies of service data
Citizen data stored on private cloud services
Notifications sent via individual personal email accounts
Citizen data copied to the development environment

Cross-Agency Strategic System

Characteristics: Used by more than one agency, serving as a foundation for services or decision-making, or storing master data used by other systems. All K5 regulations apply.

Examples: Regional personnel system, planning and finance system, population and territory master data, shared use system between agencies.

Prescribed technologyK5 architecture, plus two load-balanced service servers, replicated database, and program interface gateways for data exchange between systems.

Hosting locationMore than one server with load balancing

Data storageReplicated PostgreSQL 17

User sign-inIntegrated agency account plus system-specific inter-system keys

Security testingSame as K5, plus program interface testing against user systems

BackupsDaily plus offsite backup

Recovery time2 hours, with notification to all using agencies

Vendor workYes, with business continuity plan

ApprovalHead of Office

Standard stackK5 Architecture · two load-balanced service servers · replicated database · program interface gateways for data exchange between systems

Specific prohibitions

Data exchange via direct connections to the database
Major changes without fourteen days prior notice

Dashboard and Data Presentation

Characteristics: Presents data for leadership or the public, does not generate new data.

Examples: Development achievement dashboard, open data portal, monitoring display on a control room.

Prescribed technologyRegional data portal or dashboard application that complies with K4 regulations. Graph presentation using libraries included in the list are permitted.

Hosting locationData portal or separate server

Data storageSource from designated validators, not repeated manual copies

User sign-inOpen to public data; data is limited only after logging in with a department account

Security testingOnce a year, plus verification that restricted data cannot be accessed without permission

BackupsFollows the source

Recovery time1 business day

Vendor workYes

ApprovalHead of Statistics Division together with Head of Telematics Division

Standard stackK4 structure with emphasis on read-only · source data from validators · permitted graph libraries

Specific prohibitions

Displaying individual data that can identify individuals on public dashboards.

Mobile Companion Application

Characteristics: Supplementary to existing systems, built only when truly necessary with camera, location, or direct notification on the phone.

Examples: Field monitoring application, attendance scanning application, citizen reporting application.

Prescribed technologyFirst choice is a web application that can be installed on the main screen of the phone. If native development is required: Supported Flutter version, one code for two platforms.

Hosting locationOfficial app store owned by the Regional Government

Data storageDoes not have its own database; all data is taken from the master system through the program interface.

User sign-inFollowing the master system

Security testingFollowing the master system

BackupsNot applicable

Recovery timeFollowing the master system

Vendor workYes, publication by Diskominfo

ApprovalFollowing the master system

Standard stackInstallable web application; if native, latest stable Flutter release that calls the master system program interface

Specific prohibitions

Publishing applications under a vendor or individual account
Storing signing keys outside of Diskominfo
Sharing installation files outside official channels without approval.

Technologies and Versions

This list is a living appendix, reviewed at least once a year, because almost every security problem comes from versions that are no longer supported — not from the choice of software itself.

Mobile applications

Component	Minimum version	Standard version	Status	Notes
Flutter	rilis stabil ≤12 bulan	rilis stabil terbaru	Permitted	Mandatory to follow the target application store version requirements so that the application is not stopped from being updated.

mobile applications

Component	Minimum version	Standard version	Status	Notes
Aplikasi yang diterbitkan atas nama akun vendor	—	—	Prohibited for new systems	Publication is required to use a regional government-owned app store account.

Language and Frameworks

Component	Minimum version	Standard version	Status	Notes
PHP	8.3	8.4	Permitted	Used together with Laravel. Versions 8.2 or below are not permitted for new systems due to the end of their security support.
Laravel	11	12	Permitted	Major version increases are scheduled during maintenance windows, not as additional work outside the contract.
Node.js	22 LTS	22 LTS	Permitted	Only even-numbered versions with long-term support status. Node.js 20 has ended its support.
TypeScript	5.4	versi stabil terbaru	Permitted	Required for all Node.js code. Plain JavaScript without type checking is not accepted for K4 and above.
Kerangka Node.js	Express 4	NestJS 10+	Permitted	Module structure, centralized error handling, and mandatory input validation should be present regardless of the framework.
Python	3.11	3.12	Permitted	Specifically for data processing and statistics, not for building general public service applications.
Java (Spring Boot) / Go	Java 21 LTS · Go 1.22	—	Conditional	Only if clear maintenance expertise is available within the Regional Government environment.”, // Note: Added quotation marks to match formatting requirements. “ ” was used as per instructions. The trailing period was kept. The English translation of “Hanya bila” was added for clarity. The original text contained a question/request, which was translated like any other sentence. The word
PHP 8.2 ke bawah dan Node.js 20 ke bawah	—	—	Prohibited for new systems	Security support has ended; prohibited for new systems.

Database

Component	Minimum version	Standard version	Status	Notes
PostgreSQL	16	17	Permitted	Primary choice for K4 and above. Placed in the database group, not within the application server.
MySQL / MariaDB	MySQL 8.4 LTS · MariaDB 10.11 LTS	MySQL 8.4 LTS · MariaDB 11.4 LTS	Permitted	For K2 and K3, or existing applications. MySQL 8.0 support has ended.
Redis / Valkey	7.2	versi stabil terbaru	Permitted	Only for hops, sessions, and job queues. Not allowed to be the main data storage.”
Basis data dokumen atau berkas tunggal	—	—	Conditional	For specific purposes or small applications that are not public services.
Basis data di dalam server aplikasi	—	—	Prohibited for new systems	Prohibited from category K5 and K6; office databases are prohibited as the primary storage.

Artificial Intelligence

Component	Minimum version	Standard version	Status	Notes
Pemanfaatan tanpa mengirim data pribadi	—	—	Permitted	Do not send personal or confidential data outside.
Pemanfaatan yang mengirim data terbatas	—	—	Conditional	Requires review by the Security and Communication Field.
Mengirim data pribadi warga ke layanan luar	—	—	Prohibited for new systems	Prohibited without agreement and study, including confidential documents.

Content Manager

Component	Minimum version	Standard version	Status	Notes
WordPress	versi stabil terbaru	versi stabil terbaru	Permitted	Automatic security updates must be enabled; theme and plugins from the Diskominfo list.
Pengelola konten lain yang sudah berjalan	—	—	Conditional	Received until the adjustment period ends.

Content Managers

Component	Minimum version	Standard version	Status	Notes
Perangkat lunak, tema, atau pengaya tanpa lisensi	—	—	Prohibited for new systems	Includes pirated results; prohibited in any circumstances.”

Storage and email

Component	Minimum version	Standard version	Status	Notes
Penyimpanan objek Diskominfo	—	—	Permitted	For all uploaded files; files are not stored within the application container or in the root of the web.
Layanan surat dinas Diskominfo	—	—	Permitted	Third-party delivery providers subject to conditional approval and recording.
Awan pribadi pegawai atau vendor	—	—	Prohibited for new systems	Includes individual or free email accounts for official use.

Operating systems and servers

Component	Minimum version	Standard version	Status	Notes
Ubuntu Server	22.04 LTS	24.04 LTS	Permitted	Debian stable accepted as equivalent. Version 22.04 only for running systems until its support period ends.
Nginx	1.24	rilis stabil terbaru	Permitted	As an introduction to requests and encrypted disconnection. Apache accepted equivalent.
Docker Engine	26	versi stabil terbaru	Permitted	With Compose v2. Component files are stored in a repository, not typed directly on the server.
Windows Server	—	—	Conditional	Only if the software requires it.
Pemasangan manual pada server layanan	—	—	Prohibited for new systems	Includes file copying through private channels and configuration without a secure connection.

Display

Component	Minimum version	Standard version	Status	Notes
React	18	19	Permitted	With Vite as the builder; minimum Vite 5, default Vite 6 and above.
Vue	3	3	Permitted	Equivalent to React as a display option.
Kerangka kerja dengan penyajian di sisi server	—	—	Conditional	Requires greater resources; requires readiness assessment.
Pustaka tampilan lama	—	—	Prohibited for new systems	Prohibited as the backbone of new applications, including discontinued browser technologies.

Compliance Audit Instrument

Used for the annual self-assessment as well as compliance audits. Items marked as heavily weighted concern security and personal data: failing even one of them makes the result non-compliant.

1RegistrationApplication registered on the asset list with up-to-date owner, category, and responsible party.
2Business ProcessStored business process description and still in accordance with the current operation
3AddressUsing the official address, active encrypted connection, and a valid certificate
4Versionheavily weightedAll software is still in the security support period
5Source codeLocated in the regional repository, running version with release tag, files must be complete
6Confidentialheavily weightedThere are no passwords, keys, or tokens within the application code or images
7databasePlaced in the database group, inaccessible from the internet, users are entitled as needed
8MigrationAll structural changes through migration files; no direct changes on the service server
9Loginheavily weightedUsing a unified agency account; two-factor authentication is active for administrators; no shared accounts
10Access GroupReviewed in the last semester; accounts of transferring employees have been revoked
11Third-party accountsheavily weightedNo active provider accounts have exceeded the contract and maintenance period.
12Personal Dataheavily weightedData processing basis is recorded; notification to the data subject is available; impact assessment exists for K5/K6
13Translationheavily weightedPersonal data is encrypted when stored and transmitted; identity numbers are masked in displays and records
14Incident RecordsFormatted uniformly, stored according to retention period, does not contain passwords or complete personal data
15Backupheavily weightedProceeds according to the category and its recovery has been tested during the established period
16Security Testheavily weightedThe validity of the operational letter is still valid; the findings of the last test have been closed and verified
17InstallationThe version in use is the same as the version that passed through the automatic process and recorded on the release request.
18MonitoringRegistered for availability monitoring; health check address functioning
19DocumentationUser guide, administrator guide, and up-to-date interface documentation
20Ease of AccessContrast, font size, keyboard operations, and display on phones meet the requirements
21IdentityThe regional emblem, the name of the regional government agency, official contact information, and privacy policies are listed
22AuthorizationAll deviations are recorded as ongoing dispensations
23LicensesAll libraries and software with valid and registered licenses
24SustainabilityTwo active technical responsible parties; there must be a replacement who has truly worked on it before