Managed SOC for Indonesian oil and gas operators

An oil and gas operator does not choose when it gets attacked. A refinery runs overnight, a pipeline moves product around the clock, an offshore platform stays on the network whether anyone is watching or not, and Perpres 82/2022 expects the operator to notice a major incident and report it. A security operations centre is the function that watches for those incidents continuously, across both the corporate IT estate and the OT that runs production. This page is about running that SOC for an oil and gas operator specifically. For how a SOC works in general terms, see our SOC-as-a-Service service page.

Why oil and gas operators need a managed SOC

A single incident can move between corporate IT and OT, and a SOC that only watches one side sees half the picture. The threat profile that reaches an operator shapes what the SOC has to watch for.

Perpres 82/2022 designates oil and gas infrastructure as critical national infrastructure for the energy sector, with BSSN as the oversight body, and requires operators and designated contractors to report major incidents. Continuous monitoring is one of the more direct ways an operator shows that protection is operating day to day rather than existing only as a policy document. The table below maps the monitoring-related obligations to what the SOC actually does. Governance, the asset register, and the regulatory relationship itself are separate responsibilities the operator keeps.

How we deliver it for operators

Monitoring an OT-heavy environment means collecting from sources an IT-only SOC would never see, and interpreting them with rules built for industrial protocols rather than corporate applications.

The service runs in continuous phases, and the constraint that shapes all of them is that OT telemetry is collected passively, with no disruption to control systems. Telemetry flows one way out of the OT network through a properly configured DMZ, so the SOC gains visibility without opening a new path into the control network. Analysts triage OT alerts against a playbook built with HSE coordination in mind, since a false positive escalated like a routine IT alert wastes response time an actual safety event cannot afford to lose.

The architecture and IEC 62443 alignment work that a SOC's detection logic depends on is a separate exercise, covered on our OT/ICS security assessment for Indonesian oil and gas operators page, since detection is only as good as the picture it has of what the OT estate is supposed to look like. When an incident escalates beyond containment, our incident response service takes over the deeper forensic investigation and recovery, coordinated with the operator's HSE and operations teams throughout.

Perpres 82/2022 puts oil and gas in the same critical-infrastructure category as the country's other strategic sectors, which is the clearest signal that continuous monitoring is treated as a baseline expectation rather than an optional upgrade. Sector-specific figures for detection time or incident frequency in Indonesian oil and gas OT are not backed by a primary source we could verify at the time of writing, so this page leads with what the SOC actually monitors and how, rather than a number that would not hold up to scrutiny.

If your OT estate has never had continuous monitoring at all, that gap is usually the more urgent one to close first, and our team can set out a concrete first step.