BSA recommends that Indonesia limit the scope of covered entities and definition of a cybersecurity incident, keep requirements for vulnerability disclosures voluntary and confidential, align potential testing and certification requirements with internationally recognized standards, and coordinate regulation related to AI across the Government of Indonesia.