New Arrangements for Physical Protection Systems of Nuclear Installations under Nuclear Energy Regulatory Agency Regulation Number 1 of 2026

Introduction

On January 19, 2026, the Nuclear Energy Regulatory Agency (Badan Pengawas Tenaga Nuklir, “BAPETEN”) issued Nuclear Energy Regulatory Agency Regulation Number 1 of 2026 on Physical Protection Systems for Nuclear Installations and Nuclear Materials (“Bapeten Regulation 1/2026”). Bapeten Regulation 1/2026 governs the implementation of Physical Protection Systems that must be applied by businesses or other entities utilizing nuclear energy in nuclear installations and in the transport of nuclear materials.

Bapeten Regulation 1/2026 was drafted to replace the previous regulation, which was deemed no longer in line with legal developments and international standards. Accordingly, Bapeten Regulation 1/2026 re-regulates the implementation of Physical Protection Systems, including aspects of human resources, cyber security, and security for the transport of nuclear materials.

Comparison

Bapeten Regulation 1/2026 revokes and repeals Nuclear Energy Regulatory Agency Regulation Number 1 of 2009 on Provisions for Physical Protection Systems of Nuclear Installations and Materials (“Bapeten Regulation 1/2009”). The following table sets out a comparison between Bapeten Regulation 1/2026 and Bapeten Regulation 1/2009:

Key Provisions

Obligation to Compile Vulnerability Assessment Documents (Pre-Operational)

Before commencing construction or operational activities, the License Holder must compile a Vulnerability Assessment document. Article 7 and Annex II to Bapeten Regulation 1/2026 regulate this document as part of the Physical Protection System planning.

1. The License Holder must commence the compilation of the Vulnerability Assessment from the site monitoring stage prior to construction. 

2. The Vulnerability Assessment document contains a Target and Threat Analysis identifying nuclear materials and equipment requiring protection.

3. The document also contains Threat Scenarios describing potential attack scenarios based on threat analysis, including insider threats, cyber threats, aerial threats, and attacks originating from outside the installation.

Standardization of Organizational Structure and Human Resources Qualifications

Bapeten Regulation 1/2026 stipulates that the implementation of the Physical Protection System must be designed and applied in alignment with safety systems and other nuclear security systems. This arrangement ensures that the implementation of the Physical Protection System does not interfere with the safety functions of the installation and is considered from the design stage through to operation. Article 8 and Article 11, as well as Annex I Chapter III, regulate the organizational structure and qualifications of personnel involved in the implementation of the Physical Protection System as follows:

1. Responsible Officer: An official appointed by the License Holder who possesses resource authority and is responsible for the site or Nuclear Installation, including compiling mechanisms for the protection of confidential information.

2. Security Manager: The Security Manager must hold at least a Diploma Three degree, possess experience in nuclear security, hold a physical protection design training certificate, and hold a Gada Utama certificate or security management certificate.

3. Security Guard: Guards must hold a Gada Pratama certificate and pass an examination established by the Head of the Agency, while officers serving as squad commanders must hold a Gada Madya certificate.

4. Assessor (Operator): Assessors must pass the established certification examination and possess the ability to operate the Central Alarm Station.

5. Technical Team: The Technical Team is tasked with performing installation, maintenance, function tests, and repairs of Physical Protection System equipment.

Personnel Background Check Mechanism (Vetting)

Article 17 and Article 18 require the License Holder to perform trustworthiness assessments of employees and officers involved in the implementation of the Physical Protection System on a periodic basis. This trustworthiness assessment is performed to ensure personnel suitability with applicable security requirements.

1. Document Verification: The License Holder performs verification of identity and administrative documents, including ID Cards (KTP) or Passports, Family Cards, Birth Certificates, Police Record Certificates (SKCK), and previous employment references.

2. Interview: The License Holder conducts interviews to obtain information regarding personal background, financial condition, family environment, and involvement in organizations.

3. Psychology and Social Media: The License Holder carries out psychological tests through authorized institutions and conducts behavioral monitoring via social media as part of the personnel trustworthiness assessment.

Obligation to Implement Security Culture

Article 36 requires the License Holder to build and maintain a security culture in the implementation of the Physical Protection System.

1. The License Holder disseminates security policies to all personnel involved in nuclear energy utilization activities.

2. The License Holder carries out self-evaluations of security culture to assess the level of personnel understanding and compliance with applicable security provisions.

Cyber Security Management and Information Protection

The License Holder must establish and implement a cyber security system as part of the implementation of the Physical Protection System, as stipulated in Article 54.

1. The License Holder must limit the use of hardware and software for data transfer, and compile secure data transfer procedures to prevent cyber threats.

2. The License Holder performs cyber security incident detection and prepares system recovery mechanisms following cyber security incidents.

3. In accordance with Annex I Chapter XI, the License Holder compiles information confidentiality classifications and applies security measures to sensitive information and documents, including documents containing installation floor plans.

Security Zoning and Physical Infrastructure Specifications

The division of nuclear installation areas into several security zones is regulated in Article 19 and Article 43 to Article 49. These arrangements establish the physical infrastructure requirements that must be met in each zone.

1. Inner Area (Group I Nuclear Material): This zone must have physical barriers designed to withstand physical disturbances, limit the number of access points, and be equipped with personnel detection and recognition systems. The two-person rule applies in this zone at certain times.

2. Protected Area (Group II Nuclear Material): The Protected Area is located within the Limited Access Area; therefore, the Limited Access Area facility requirements (including perimeter physical barriers, clear zones, and lighting to support assessment/detection) apply. The Protected Area must also meet additional requirements such as intrusion detection systems, access point restrictions, and personnel access control.

Obligation for Investment in Supporting Infrastructure (Power Supply)

The License Holder must provide supporting infrastructure in the form of an emergency power supply to support the implementation of the Physical Protection System, as stipulated in Article 34 and Annex I Chapter VIII.

1. The License Holder provides a Generator Set (Genset) and/or Uninterruptible Power Supply (UPS) to ensure the operational continuity of the Physical Protection System.

2. The License Holder ensures that cameras, sensors, and alarm systems remain operational during power outages and protects the power supply system from disturbances or actions that may impede its function.

Maintenance Management and Equipment Function Tests

The License Holder carries out maintenance and function tests of Physical Protection System equipment, as stipulated in Article 35 and Annex I Chapter IX.

1. The License Holder compiles periodic equipment maintenance and repair plans.

2. The License Holder performs equipment function tests before nuclear material arrives at the site and periodically during operational activities.

3. The License Holder documents all maintenance and function test activities in reports that are traceable and auditable.

Nuclear Material Transport Physical Protection Plan

Arrangements regarding the transport of nuclear materials are contained in Chapter V and Annex VI to Bapeten Regulation 1/2026. Under these arrangements, the License Holder or the shipper must compile a Transport Physical Protection Plan document. The Transport Physical Protection Plan document contains the following provisions:

1. Transport Control Center: The License Holder provides a Transport Control Center to continuously monitor the position and status of transport vehicles using tracking equipment, as well as automatic data transmission tracking systems (GPS) for certain categories of nuclear materials.

2. Vehicle Specifications: The License Holder uses transport vehicles equipped with locking systems and vehicle immobilization systems operable by the driver.

3. Escort Personnel: The License Holder assigns escort personnel to nuclear material transport activities, consisting of guards, radiation protection officers, and the Nuclear Security Response Unit in accordance with applicable provisions.

Contingency Preparedness and Drills

The License Holder compiles a Contingency Plan to face emergency conditions in the implementation of the Physical Protection System, as stipulated in Article 29 and Annex IV.

1. The Contingency Plan contains scenarios for handling security disturbances, including bomb threats, cyber security disturbances, and theft of nuclear materials.

2. The License Holder organizes contingency training and drills at least once in a year involving the Nuclear Security Response Unit, as stipulated in Article 32.

3. The License Holder submits a report on the results of the contingency drill implementation to the Head of the Agency no later than 2 (two) working days after implementation, specifically for nuclear material transport activities.

Obligation for Incident Reporting and Administration

The License Holder carries out security incident reporting in accordance with the mechanism regulated in Article 30 and Annex V.

1. The License Holder submits a verbal report no later than 1 (one) hour after the occurrence of an incident. 

2. The License Holder submits a written report no later than 2 × 24 hours using the established reporting form, containing information regarding the event, parties involved, impact, and handling actions.

3. In accordance with Article 95 and Annex I Chapter XIII, the License Holder documents access records, testing activities, and security events as part of the Physical Protection System administration.

Classification of Nuclear Materials as the Basis for Determining Obligations

The determination of the physical security level is performed based on the category of nuclear material possessed or managed by the License Holder. Annex VII to Bapeten Regulation 1/2026 regulates the calculation method for nuclear material categories using certain technical formulas.

1. The License Holder performs isotope ratio calculations, including plutonium (Pu), uranium-233 (U-233), and uranium-235 (U-235), to determine the classification of nuclear materials.

2. The results of the nuclear material classification are used as the basis for applying the physical security provisions applicable to each group.
   

Transitional Provisions

The License Holder shall adjust the Physical Protection System to the provisions of Bapeten Regulation 1/2026 no later than 1 (one) year after this regulation comes into force, as stipulated in Article 96, including the fulfillment of obligations related to physical infrastructure, personnel qualifications and certifications, and the implementation of cyber security systems, which must be implemented no later than January 2027.

Closing

Bapeten Regulation 1/2026 regulates the obligations of the License Holder regarding the Physical Protection System across pre-operational, operational, and supervisory stages, including the compilation of Vulnerability Assessment documents, establishment of organizational structures and fulfillment of personnel qualifications, implementation of cyber security and information protection, security zoning and physical infrastructure arrangements, security for the transport of nuclear materials, as well as the execution of maintenance, function tests, contingency drills, and security incident reporting. In accordance with the transitional provisions, the License Holder must adjust the Physical Protection System to the provisions of Bapeten Regulation 1/2026 no later than 1 (one) year after the regulation comes into force; therefore, all such obligations must be fulfilled no later than January 2027 as part of the fulfillment of nuclear energy utilization licensing requirements.