IT Procurement & B2B Laptop Rental Glossary

Definitions of terminology used in laptop rental contracts, corporate procurement documents, and IT vendor discussions. Curated by the Arental editorial team to help procurement, IT, and finance teams speak the same language as their vendors.

Jump to section:

A – F G – M N – Z

A – F

DaaS(Device-as-a-Service): A B2B IT procurement model in which companies rent devices (laptops, desktops, peripherals) as a multi-year subscription service. Unlike daily or project rental, DaaS is a layered service that bundles four components in a single monthly contract: active hardware, lifecycle management (deploy → monitor → refresh), technical support (helpdesk + on-site unit swap with a written SLA), and a scheduled refresh cycle of typically 24–36 months. This contrasts with the traditional model where companies buy laptops as CapEx, then contract separately with third parties for repair, warranty extensions, and disposal — all coordinated by the in-house IT team, which inflates the true TCO far above the headline purchase price. Example: a 50-employee company that would normally spend IDR 750 million CapEx upfront (50 units × IDR 15M) and depreciate it across 5 years on the balance sheet can instead run a 36-month DaaS contract at ±IDR 22–27M/month OpEx, fully tax-deductible — plus automatic refresh to a newer generation at the end of contract with no separate disposal cost.
Read more:
Benefits of Device-as-a-Service for business →
View full detail →
CapEx(Capital Expenditure): Capital spending to acquire long-lived assets — buying laptops, machines, buildings. In financial accounting, CapEx hits the balance sheet as an asset and is depreciated over time (typically 4 years for laptops per Indonesian PPh Pasal 11). It is not immediately tax-deductible in the year of purchase. For growth-stage companies sensitive to cash flow, large upfront CapEx can limit other operational funding options.
Read more:
View full detail →
EOL / EOSL(End-of-Life / End-of-Service-Life): Two hardware lifecycle milestones often confused. EOL (End-of-Life) is the date the OEM vendor (Lenovo, HP, Dell, Apple) stops manufacturing a particular model — units already purchased can still be used and receive firmware updates. EOSL (End-of-Service-Life) is the date the vendor stops providing official support, firmware patches, and spare parts — more critical because damage after EOSL typically cannot be repaired with original parts. For DaaS contracts, the refresh schedule must complete before each generation's EOSL (usually 5-6 years after launch). Cross-check EOL/EOSL dates on the OEM support portal during multi-year contract negotiation to avoid stranded assets in the final year.
Read more:
DaaS →
TCO →
OEM →
View full detail →
Asset Tag(Asset Tagging / Asset Identification Label): A unique physical label (usually a barcode or QR code sticker with an internal code) applied to each unit for inventory tracking. A standard B2B asset tag scheme captures: vendor code, device category, sequence number, and procurement year (e.g., ARN-LT-2026-0123). Primary functions: BAST reconciliation at handover, periodic stock-take audits, mapping units to employees/departments in the ITAM system, and tracking units dispatched for repair. Arental provides custom asset tagging per client scheme (corporate color, client code prefix, QR format scannable into the internal CMDB) before delivery — more efficient than the client labeling units after they arrive on-site.
Read more:
ITAM →
BAST →
Pre-Imaging / Golden Image →
View full detail →
BitLocker: Microsoft Windows disk-encryption technology that protects data at-rest. Automatically active on Windows 11 Pro when a device is domain-joined, with the recovery key stored in Active Directory or Azure AD. For laptops rented to companies with strict compliance (finance, healthcare, government), BitLocker is a mandatory security baseline — Arental enables BitLocker in the custom image when clients request it.
Read more:
AD / Azure AD →
NIST 800-88 →
ISO 27001 →
View full detail →
AD / Azure AD(Active Directory / Azure Active Directory (Entra ID)): Microsoft directory services for centralized identity and access management. Active Directory (AD) is on-premise; Azure AD is cloud-based (now rebranded as Entra ID). For corporate laptops, domain join to AD/Azure AD enables: single sign-on, group policy enforcement, BitLocker recovery, and device compliance checks. Custom images for corporate laptop rentals typically include AD/Azure AD join prior to delivery.
Read more:
MDM →
SSO / SAML →
BitLocker →
View full detail →
BAST(Berita Acara Serah Terima (Indonesian Asset Handover Document)): Formal handover document between provider and recipient — mandatory in every Indonesian government procurement transaction (Permendagri 19/2016) and in B2B corporate deals. Arental's audit-grade BAST lists: serial number per unit, tech specs (CPU/RAM/SSD/OS license), physical condition (before/after photos), handover date, and signatures from both parties. BPK/Itjen auditors must be able to reconcile BAST against BMN inventory.
Read more:
Asset Tag →
SPM →
Laptop rental for SOE & government →
View full detail →
e-Katalog(National e-Catalog (LKPP)): Indonesia's government e-procurement catalog (accessed at e-katalog.lkpp.go.id) of LKPP-verified products and services for central government, regional government, SOEs, BUMD, and working units. Three tiers of e-Catalog: (1) National e-Catalog — managed by LKPP for nationally demanded products; (2) Sectoral e-Catalog — managed by ministries/agencies (e.g., Kemenkes for medical devices); (3) Local e-Catalog — managed by regional government for local products. Working units can check out directly via mini-competition or direct appointment for packages under threshold without open tender — far faster than conventional tender (1-2 weeks vs 6-12 weeks). Vendor registration on e-Catalog requires active NIB, NPWP, PKP, SIUP, and technical qualification documents — LKPP review typically takes 30-60 business days. Non-e-Catalog vendors can still be selected via direct appointment or open tender per Perpres 12/2021 jo 16/2018, but the process is longer.
Read more:
LKPP →
BAST →
Laptop rental for SOE & government →
View full detail →
EULA(End User License Agreement): A software license agreement between a software publisher and the end user that governs the rights and restrictions on use. In the B2B laptop rental context, EULAs are most relevant for software pre-installed on units: Windows OEM license, Microsoft 365 Apps for Business/Enterprise, and corporate antivirus. Critical EULA points for procurement: (1) OEM Windows license is tied to the hardware and cannot be transferred to another unit — if a unit is returned and replaced, the license does not migrate; (2) Microsoft 365 Apps requires a separate per-user license independent of hardware; (3) certain software (Adobe Creative Cloud, AutoCAD) may prohibit use on rented hardware — confirmation with the software vendor is required. A professional laptop rental vendor must ensure all software installed in the golden image has licenses valid for a rental deployment mode, not just a purchase mode.
Read more:
Pre-Imaging / Golden Image →
MDM →
Corporate laptop rental →
View full detail →
EDR(Endpoint Detection and Response): A next-generation endpoint security platform that not only detects threats (like traditional antivirus) but also responds, investigates, and remediates — either automatically or assisted by a SOC team. EDR continuously records and analyzes endpoint activity in real time: running processes, network connections, files created/modified, and registry changes. EDR tools most frequently appearing as requirements in Indonesian enterprise RFPs: CrowdStrike Falcon (cloud-native SaaS, most popular in MNCs), Microsoft Defender for Endpoint (bundled in Microsoft 365 E3/E5, most cost-efficient if already on M365), and SentinelOne (strong autonomous response). For corporate laptop rentals serving clients with a SOC team, the vendor must be able to pre-install the EDR agent to client specs and ensure the agent is enrolled into the client's tenant — not the vendor's tenant.
Read more:
ISO 27001 →
MDM →
MNC multinational laptop rental →
View full detail →
CMDB(Configuration Management Database): A centralized database within the ITSM framework that stores information about all Configuration Items (CIs) in the IT infrastructure — including hardware (laptops, servers, switches), software, services, and the relationships between components. The CMDB serves as the single source of truth for: change and incident impact analysis, capacity planning, compliance audits, and license management. Enterprise CMDB platforms most commonly encountered: ServiceNow CMDB (dominant in large MNCs and SOEs), BMC Helix CMDB, and Freshservice (mid-market). Relevance to laptop rental: Arental can provide unit inventory data in a format compatible with import into the client's CMDB (standard CSV, or via API integration to ServiceNow). Each rental unit should be registered as a CI in the client's CMDB with attributes: serial number, spec, deploy date, assigned user, location, and contract number — simplifying reconciliation during audits and SLA claims.
Read more:
ITAM →
ITSM →
Asset Tag →
View full detail →
DPO(Data Protection Officer): DPO (Data Protection Officer) is a role mandated by UU PDP Articles 53–54 (Law 27/2022) for Personal Data Controllers that: (a) process personal data at large scale, (b) process Specific Personal Data regularly and systematically (health, biometric, financial), or (c) are public institutions. The DPO acts as the single point of contact between the organization and the supervisory authority (the newly-formed Lembaga PDP) and with Data Subjects (employees, customers). Specific DPO duties per UU PDP: (1) advise the Data Controller on PDP obligations, (2) monitor compliance with internal privacy policies, (3) consult on DPIA (Data Protection Impact Assessment), (4) coordinate with the supervisory authority during a breach (3×24 hours notification to the authority + 14×24 hours to subjects), (5) act as the point of contact for PII complaints. The DPO must remain independent — no dual roles that create conflict (e.g., Head of Marketing). For corporate laptop rentals, the client's DPO often reviews the vendor's pre-imaging policy and sanitization SOP before signing the contract. Relevant certifications: CIPP/E (IAPP), CDPO Indonesia (APPDI).
Read more:
UU PDP →
PII →
GDPR →
NIST 800-88 →
View full detail →

G – M

ITAM(IT Asset Management): The discipline of managing IT assets — tracking device inventory, software licenses, lifecycle, vendor contracts, and total cost. Mature ITAM typically requires dedicated tooling (ServiceNow Asset, Snipe-IT, Lansweeper) plus clear processes. When companies rent laptops from a vendor like Arental, ITAM becomes lighter because the vendor already supplies an inventory dashboard that maps units to departments and employees — the internal IT team only has to integrate it into the existing ITSM/CMDB.
Read more:
View full detail →
MSA(Master Service Agreement): A parent contract that governs the long-term vendor-client relationship framework. Contains general terms that apply across all projects: payment terms, IP, confidentiality, liability, dispute resolution. Project-specific scope is handled via a Statement of Work (SOW) that references the parent MSA. For multi-year vendor relationships, MSA + multiple SOW is more efficient than negotiating a fresh contract per project — generic clauses are agreed once, and negotiation can focus on scope and price.
Read more:
View full detail →
ISO 27001(ISO/IEC 27001:2022 Information Security Management Systems): The international ISO standard for Information Security Management Systems (ISMS), defining requirements to establish, operate, monitor, and continuously improve an information security management system. Latest version: ISO/IEC 27001:2022 with 93 controls in Annex A across 4 themes (organisational, people, physical, technological). ISO 27001 certification = independent external audit evidence that the organization has mature security processes. For RFPs from fintech, healthcare, MNCs, and sensitive SOE/government clients, ISO 27001 frequently appears as a baseline compliance requirement — vendors must provide an active certificate (usually valid for 3 years with annual surveillance audits). This standard is often paired with ISO 27002 (code of practice) and ISO 27017/27018 (cloud-specific extensions) for vendors also providing cloud services.
Read more:
NIST 800-88 →
BitLocker →
SSO / SAML →
View full detail →
MDM(Mobile Device Management): A centralized management platform for a fleet of devices (laptops, smartphones, tablets) in a company — despite the name "Mobile", the scope includes laptops. Major MDM tools seen in enterprise RFPs: Microsoft Intune (integrated with Azure AD/Entra ID), Jamf Pro (Apple/macOS specialist), Kandji (modern Apple MDM), VMware Workspace ONE, and Cisco Meraki. MDM enables IT admins to perform: remote configuration (push policy, app deployment), compliance enforcement (require BitLocker, screen lock timeout, antivirus active), conditional access (block login from non-compliant devices), and remote wipe when a unit is lost or an employee resigns. For B2B enterprise laptop rentals, the vendor must be able to pre-enroll units in the client's MDM before delivery — faster onboarding and immediate compliance. Without MDM, the client's IT team must physically visit each unit to configure it.
Read more:
AD / Azure AD →
Pre-Imaging / Golden Image →
SSO / SAML →
View full detail →
LKPP(Lembaga Kebijakan Pengadaan Barang/Jasa Pemerintah): Indonesia's non-ministerial agency that drafts policies and regulations on government procurement of goods and services under Perpres 12/2021 jo 16/2018. LKPP runs three core systems every B2B vendor entering the government market must know: (1) the National e-Catalog — official storefront for verified products/services; (2) SIKaP (Sistem Informasi Kinerja Penyedia) — government vendor registry with performance ratings; (3) SPSE (Sistem Pengadaan Secara Elektronik) — the open tender platform. Vendors listed in the e-Catalog can be selected via direct appointment without open tender for packages under threshold (per Perlem LKPP 9/2021: ≤IDR 200 million for other goods/services). LKPP also publishes Harga Perkiraan Sendiri (HPS) reference pricing that caps maximum vendor offers. LKPP accreditation = the most efficient entry path for laptop rental vendors targeting SOEs and central/regional government.
Read more:
e-Katalog →
BAST →
Laptop rental for SOE & government →
View full detail →
KPPN(Kantor Pelayanan Perbendaharaan Negara (Indonesian Treasury Service Office)): Vertical office of Indonesia's Directorate General of Treasury (Ministry of Finance) that processes SPMs and issues SP2D (fund disbursement order). KPPN releases state budget funds to vendor accounts after document validation. For PKP vendors, KPPN auto-withholds PPh 23 and remits to the state treasury — vendor receives a withholding slip creditable in the annual tax return.
Read more:
SPM →
PKP →
Laptop rental for SOE & government →
View full detail →
GRN(Goods Receipt Note): An internal company document serving as proof that ordered goods/units were physically received by the receiving team — distinct from BAST, which is the formal two-party handover document. The GRN is created by the client's procurement/warehouse team, not jointly with the vendor. GRN role in the procurement flow: GRN is issued → linked to the matching PO number → triggers finance to approve the vendor invoice (3-way matching: PO ↔ GRN ↔ invoice). For corporate laptop rental, the GRN records: serial number of each received unit, physical condition upon unboxing, and date of receipt. Discrepancies between GRN and BAST (e.g., a unit listed in the vendor's BAST but missing from the client's GRN) must be reconciled before the invoice can be processed. ERP systems such as SAP MM, Oracle Procurement, or Odoo typically auto-generate the GRN when an operator scans the unit barcode on arrival.
Read more:
BAST →
PO →
Asset Tag →
View full detail →
MFA(Multi-Factor Authentication): An authentication mechanism requiring users to prove their identity with two or more independent factors: something they know (password), something they have (token/phone), and something they are (biometric). In the Indonesian B2B environment, MFA is mandatory for access to banking and financial systems under POJK 11/2022 on Consumer Protection and Financial Services Sector Supervision. Three MFA modes most common on enterprise laptops: TOTP (Time-based One-Time Password) via apps like Microsoft Authenticator or Google Authenticator; SMS OTP (easier to deploy but more vulnerable to SIM-swap attacks); and biometric (Windows Hello — fingerprint or face recognition via IR camera). For corporate laptop rentals, confirm the hardware includes an integrated biometric module (fingerprint reader or IR camera) if the client mandates Windows Hello MFA. Pre-imaging can include MFA baseline configuration aligned with Azure AD Conditional Access policy.
Read more:
AD / Azure AD →
SSO / SAML →
Banking & finance laptop rental →
View full detail →
Intune(Microsoft Intune): Microsoft's cloud MDM (Mobile Device Management) and MAM (Mobile Application Management) platform that forms the core of Microsoft Endpoint Manager. Natively integrated with Entra ID (Azure AD), Intune enables: Windows/macOS/iOS/Android device enrollment, application and configuration policy deployment, compliance enforcement (BitLocker, screen lock, antivirus), Conditional Access (block access from non-compliant devices), and remote wipe. Licensing: available in Microsoft 365 Business Premium, E3, and E5 — clients already subscribed to M365 E3/E5 effectively have Intune at no extra cost. For corporate laptop rentals, Intune Autopilot enables zero-touch provisioning: the vendor registers unit hardware IDs in the client's Intune tenant before delivery; when the employee logs in for the first time, the unit automatically configures itself to policy without physical IT support. This dramatically accelerates onboarding for large-scale deployments (100+ units).
Read more:
SCCM / MECM →
AD / Azure AD →
Pre-Imaging / Golden Image →
View full detail →
GDPR(General Data Protection Regulation): The European Union's personal data protection regulation (EU Regulation 2016/679), effective May 2018 — widely regarded as the world's strictest data protection standard and the model for many national regulations, including Indonesia's UU PDP. GDPR applies extraterritorially: Indonesian companies that process personal data of EU citizens (e.g., MNCs with European customers or employees) must comply. Two cross-border data transfer mechanisms relevant to IT operations: Standard Contractual Clauses (SCCs) issued by the European Commission, and adequacy decisions (Indonesia does not have one as of 2026). For corporate laptop rentals at MNCs with EU nexus: laptops used by employees handling EU customer/employee data fall within GDPR scope — mandatory encryption (BitLocker), access logging, and a data breach notification procedure within 72 hours to the supervisory authority are required. GDPR fines can reach €20 million or 4% of global annual revenue, whichever is higher.
Read more:
UU PDP →
BitLocker →
MNC multinational laptop rental →
View full detail →
ITSM(IT Service Management): A framework and set of best practices for planning, delivering, operating, and controlling IT services to business users. The industry de-facto standard: ITIL v4 (Information Technology Infrastructure Library version 4, published 2019), which organizes practices across four dimensions and a service value chain: Plan → Design → Transition → Operate → Improve. ITSM processes most relevant to corporate laptop rental: Incident Management (damage report/complaint → ticket → resolution, with MTTR/Mean Time To Repair targets per SLA), Request Fulfillment (requests for new units or replacements), Change Management (unit refresh, capacity additions), and Asset & Configuration Management (CMDB integration). Enterprise ITSM platforms: ServiceNow ITSM, Jira Service Management, Freshservice, BMC Remedy. Arental supports ticket routing integration via email-to-ticket or API into the client's ITSM platform — laptop incidents reported through the client's ServiceNow automatically open a vendor-side ticket for SLA-compliant resolution.
Read more:
CMDB →
SLA →
ITAM →
View full detail →
ITIL(Information Technology Infrastructure Library): ITIL (Information Technology Infrastructure Library) is a global best-practice framework for IT Service Management, originally developed by CCTA (now AXELOS, owned by PeopleCert) in the UK in 1989, with the current version ITIL 4 released in 2019. ITIL is not a certifiable standard like ISO 27001 — it is a guideline plus individual practitioner certification (ITIL 4 Foundation, Managing Professional, Strategic Leader). ITIL 4 organizes 34 management practices into a Service Value System with four dimensions: Organizations & People, Information & Technology, Partners & Suppliers, Value Streams & Processes. The ITIL practices most relevant to corporate laptop rental: Incident Management (MTTR targets per SLA), Service Request Management (requests for new/replacement units), Change Enablement (mass refresh at end-of-contract), Service Level Management (quarterly SLA reviews). Many Indonesian corporate procurement teams require IT services vendors to have ITIL 4 Foundation-certified staff as a tender prerequisite — this appears in the scoring matrix alongside ISO 27001 and track record. Arental maintains support SOPs aligned with ITIL 4 for enterprise clients.
Read more:
ITSM →
SLA →
ISO 27001 →
CMDB →
View full detail →

N – Z

TCO(Total Cost of Ownership): The total cost of owning an asset across its useful life — not just the upfront purchase price. For corporate laptops, a 3-year TCO includes purchase price + repair costs + IT support cost + refresh cycle + depreciation + disposal. A worked example for 50 laptops over 3 years: (a) buy path — 50 units × IDR 12M = IDR 600M CapEx + maintenance/parts IDR 60M/year × 3 = IDR 180M + downtime cost (avg 2 days/unit/year × IDR 300K) ≈ IDR 90M, total ±IDR 870M before counting IT support payroll; (b) DaaS path — IDR 360M/year × 3 = IDR 1.08B but already includes support, unit replacement, end-of-contract refresh, and zero internal IT overhead. Comparing rental vs purchase TCO often changes the procurement decision — renting looks 5–15% more expensive on raw numbers, but carries 0% hidden cost. Many finance directors underestimate hidden costs when buying office laptops.
Read more:
Rent vs buy IT equipment →
View full detail →
SLA(Service Level Agreement): Written vendor commitment to specific service levels — usually uptime, response time, resolution time, and escalation. Standard B2B uptime tiers: 99.5% (=43.8 hours downtime/year), 99.7% (=26.3 hours/year), 99.9% (=8.76 hours/year). The higher the tier, the stricter the redundant spare-unit pool the vendor must hold. For B2B laptop rental, Arental's common SLA: 99.7% uptime, <30 minute business-hour response, <1 hour unit replacement in Jakarta, <2 hours in Jabodetabek. A solid SLA spells out specific penalty clauses — e.g., "If realized SLA falls below 99.7% in any calendar month, the vendor grants a 10% reduction on the monthly fee plus full unit replacement within 4 hours at no additional charge." Ask about specific SLA terms during contract negotiation — vague language like "we will try" is not an SLA and is not enforceable by finance.
Read more:
View full detail →
OpEx(Operating Expenditure): Operating expenses consumed within a single accounting period — rent, payroll, electricity, software subscriptions. Unlike CapEx, OpEx is 100% deductible from taxable income in the year incurred. Corporate laptop rental = OpEx — the monthly cost flows into the P&L as an operating expense rather than inflating the balance sheet as a depreciating asset. For finance teams, OpEx is more predictable and impacts cash flow more smoothly.
Read more:
View full detail →
OEM(Original Equipment Manufacturer): The original hardware manufacturer with its own brand — for B2B laptops, examples include Lenovo, HP, Dell, Apple, MSI, Asus. OEM-grade units come with official factory warranty, vendor firmware update access, original spare parts, and guaranteed technical support. Contrast with refurbished (OEM units that have been used and reconditioned) and aftermarket (non-original spare parts installed by third parties). Arental sources 100% of units from official OEM channels, giving clients: active original warranty, automatic BIOS/firmware updates, and eligibility for OEM extended care (HP CarePack, Dell ProSupport, Lenovo Premier Support) that can be added to multi-year DaaS contracts per the client's compliance requirements.
Read more:
EOL / EOSL →
DaaS →
Pre-Imaging / Golden Image →
View full detail →
Trade-In / Buyout(Trade-In Credit / Buyout Clause): Exit-strategy clauses in a multi-year DaaS contract that give the client end-of-contract options. Trade-In: the client returns old units and receives credit toward refresh to the next-generation contract — common in 36-month DaaS schemes that continue into a second 36-month with newer specs. Buyout: the client has an option to purchase the rented unit at end-of-contract for a residual value agreed upfront (usually 10-25% of original market value, depending on 36-month depreciation and unit condition). Buyout is useful for units already custom-fit to the client environment (purchased special software licenses, integrated peripheral hardware) where buying is more efficient than migrating to a new unit. This clause must be agreed at the start of the MSA so the formula is transparent — not negotiated last-minute at end-of-contract.
Read more:
DaaS →
MSA →
EOL / EOSL →
View full detail →
SOW(Statement of Work): A project-specific document detailing scope, deliverables, timeline, pricing, and acceptance criteria. SOW always references the parent MSA for generic terms. In the laptop rental context, a per-project SOW can describe unit counts, specs, duration, delivery locations, and image customization. Separating MSA (generic) from SOW (specific) keeps procurement agile when new contracts are needed.
Read more:
MSA →
PO →
RFP →
View full detail →
PO(Purchase Order): A formal company document used to order goods/services from a vendor, issued after terms and pricing are negotiated. A PO contains: vendor name, item code, quantity, unit price, total, payment terms, delivery date, and PIC. Vendors use the PO as the basis for invoicing and delivery. For corporate laptop rental, POs can be issued per contract or per delivery batch — depending on company structure. Procurement teams typically require a formal PO before a vendor begins work.
Read more:
SOW →
MSA →
SPS →
View full detail →
SPS(Surat Perjanjian Sewa (Rental Agreement Letter)): A concise Indonesian-language rental contract that governs both parties' obligations: the vendor provides units to agreed specs and SLA, and the client pays rental fees on schedule and maintains the units. Arental's standard SPS includes duration, price, unit count, specs, delivery location, payment terms, SLA, unit replacement procedure, return procedure, and dispute resolution. Shorter than a corporate MSA — well-suited for small-to-medium contracts that don't require extensive clause negotiation.
Read more:
MSA →
PO →
BAST →
View full detail →
PPN(Pajak Pertambahan Nilai (Indonesian Value-Added Tax)): Indonesia's indirect tax on the delivery of taxable goods/services. Standard rate: 12% (effective 1 January 2025 per UU HPP). PKP-status vendors must issue an e-faktur PPN invoice for every transaction. For corporate clients, an e-faktur PPN from a laptop rental vendor = proof of input PPN credit that offsets the company's output PPN — net effect: effective rental cost is lower after the tax credit.
Read more:
PKP →
NPWP →
SPM →
View full detail →
NPWP(Nomor Pokok Wajib Pajak (Indonesian Taxpayer ID)): Indonesia's unique taxpayer identification number, one per individual or entity, issued by the Directorate General of Taxes. For companies, the 15-digit NPWP (format XX.XXX.XXX.X-XXX.XXX) is the basis for issuing e-faktur PPN invoices, filing annual PPh Badan corporate tax returns, applying for NIB at OSS, and qualifying for vendor pre-qualification. From 2024 onward, the migration to 16-digit NIK for individuals coexists with corporate NPWP which remains 15-digit. Professional corporate laptop rental vendors always hold NPWP and PKP status — the minimum prerequisites for legitimate B2B transactions that the client's finance team can properly administer (e-faktur PPN can be credited, PPh 23 withholding slips can be administered). Clients must request a copy of the vendor's NPWP as part of standard vendor onboarding.
Read more:
PPN →
PKP →
NIB →
View full detail →
NIB(Nomor Induk Berusaha (Business Identification Number)): A 13-digit business identification number issued by Indonesia's Online Single Submission (OSS) system, replacing the legacy SIUP, TDP, and API. Required for companies that want to register as vendors on e-Katalog LKPP, BUMN procurement portals, and MNC vendor management systems. Arental's NIB enables RFP responses and deliveries to BUMN/government clients with proper administrative documentation.
Read more:
NPWP →
PKP →
LKPP →
View full detail →
RFP(Request for Proposal): A formal document a company issues to invite vendors to submit written proposals based on a defined scope of needs. A standard B2B Indonesian RFP has 8 main sections: (1) company background and project context; (2) detailed technical scope; (3) functional & non-functional requirements; (4) evaluation criteria with scoring weights (typically: price 30%, technical 40%, vendor track record 20%, SLA 10%); (5) submission timeline with a clarification meeting; (6) standard response template; (7) expected commercial terms; (8) NDA attachment. Typical issuance-to-award timeline: 4-8 weeks for MNC corporate RFPs, 6-12 weeks for SOE/government RFPs going through the tender path. Vendor tier that typically responds to RFPs of 50+ units: tier-1 multinational (HP/Dell/Lenovo direct) or mature tier-2 local vendors like Arental with MNC track record. Professional RFP response capability = a strong signal the vendor is mature and has enterprise-grade administration capacity.
Read more:
PO →
SOW →
MSA →
View full detail →
NIST 800-88(Special Publication 800-88 Rev. 1: Guidelines for Media Sanitization): The NIST (US National Institute of Standards and Technology) standard for media sanitization. Defines three data-removal levels: Clear (logical overwrite), Purge (cryptographic erase or degauss), Destroy (physical destruction). When laptop units are returned at the end of a rental contract, data sanitization is minimum Clear or Purge — with a written certificate per unit for audit-trail compliance.
Read more:
BitLocker →
ISO 27001 →
AD / Azure AD →
View full detail →
Pre-Imaging / Golden Image(Custom OS Image Deployment): The vendor practice of preparing units with a custom OS image that already contains the client's standard configuration — before delivery, not after arriving at the client office. A typical client Golden Image contains: Windows 11 Pro/Enterprise OS with latest security patch, AD/Azure AD domain join configuration, BitLocker with recovery key escrow, MDM enrollment to Intune/Jamf, standard licensed software (Microsoft 365 Apps, Adobe Reader, corporate antivirus), browser with bookmarks + group policy, and asset tags pre-registered in ITAM. Arental ships Pre-Imaging as a standard deliverable for enterprise clients: the client team simply logs in with their employee account, and the unit is immediately productive without individual setup. Massive efficiency: 50 units with pre-imaging finish onboarding in 1 day; without pre-imaging it takes 3-5 IT-support days per dispatch batch.
Read more:
MDM →
AD / Azure AD →
Asset Tag →
View full detail →
SSO / SAML(Single Sign-On / Security Assertion Markup Language): SSO (Single Sign-On) is an architecture where a user signs in once to an identity provider (IdP) to access all corporate applications without needing a different password per app. SAML (Security Assertion Markup Language 2.0) is an XML-based protocol standard for exchanging authentication data between IdP and Service Provider — the most common protocol in legacy enterprise B2B, alongside the more modern OIDC/OAuth 2.0. For fintech, MNC, and sensitive (SOE, healthcare) RFPs, SSO/SAML support frequently appears as a mandatory technical requirement — the vendor dashboard must integrate via SAML to the client's Okta, Azure AD, Google Workspace, or OneLogin. Without SSO, the client's IT cannot enforce a centralized password policy and cannot instantly deprovision when an employee resigns — a major security gap in compliance audits.
Read more:
AD / Azure AD →
MDM →
ISO 27001 →
View full detail →
PKP(Pengusaha Kena Pajak (Indonesian VAT-Registered Business)): The legal status of a company required to collect, deposit, and report PPN (Indonesian VAT) per VAT Law 8/1983 as last amended by HPP Law 7/2021. PKP confirmation threshold as of 2026: annual revenue > IDR 4.8 billion — entities below threshold may opt for voluntary PKP registration to gain input PPN credit benefits. PKP entities must issue e-faktur PPN invoices in DJP format (PMK 03/PJ/2022) for every BKP/JKP transaction, with an active Faktur Pajak Serial Number (NSFP). For corporate clients, transacting with a PKP vendor = the e-faktur PPN from the vendor can be credited as input PPN to offset output PPN (effect: cash-flow neutral on PPN while the client is also PKP); non-PKP vendors mean PPN does not apply and the client receives no tax credit, so the effective cost can actually be higher because the tax-credit upside disappears.
Read more:
PPN →
NPWP →
NIB →
View full detail →
SPM(Surat Perintah Membayar (Indonesian Payment Order)): Document issued by a government working-unit treasurer ordering KPPN to disburse funds. The SPM must match supporting documents: vendor invoice, PPN e-faktur (if vendor is PKP), PPh 23 withholding slip (for rental services), and BAST. Invalid tax invoice → SPM stalls at KPPN. DJP e-Faktur format (PMK 03/PJ/2022) with an active NSFP is the requirement.
Read more:
KPPN →
BAST →
PPN →
Laptop rental for SOE & government →
View full detail →
NDA(Non-Disclosure Agreement): A confidentiality agreement that obligates parties to not disclose sensitive information received during a business relationship. Two main formats: mutual NDA (both parties protect each other's information — common in early-stage negotiation or PoC) and one-way NDA (only the receiving party is bound — common when a vendor gains access to client-sensitive data). Validity periods typically run 2–5 years from signing; some MNC clients require 5 years plus 2 post-termination years to cover residual data. In the laptop rental context, NDAs are relevant when the vendor performs: pre-imaging using the client's internal configuration data, access to the client's CMDB/ITAM, or on-site visits to data center areas. A well-drafted NDA explicitly defines "confidential information" and lists standard carve-outs (publicly available information, legally obtained from a third party).
Read more:
MSA →
RFP →
Corporate laptop rental →
View full detail →
RFQ(Request for Quotation): A formal price request sent to one or more vendors for items or services with clearly defined and fixed specifications. RFQ differs from RFP: an RFQ is used when scope is fixed and the decision is made almost entirely on price, while an RFP is used when scope is still open and vendors are invited to propose solutions. In corporate laptop procurement, RFQs are common for: repeat orders with previously agreed specs, small-volume procurement (<20 units) with standard configurations, or unit refresh with identical models. A typical RFQ document contains: item code, minimum technical specifications (CPU generation, RAM, SSD, OS), unit count, delivery location, rental duration, and submission deadline. Vendor response time for an RFQ: typically 1–3 business days, much faster than an RFP (1–2 weeks).
Read more:
RFP →
RFI →
PO →
View full detail →
RFI(Request for Information): An exploratory document sent to prospective vendors before a formal RFP is issued — the goal is to gather information about vendor capabilities, track record, capacity, and indicative pricing to help procurement draft a realistic RFP scope. An RFI is not a purchase commitment and does not produce a contract directly. Typical RFI questions for laptop rental: maximum unit count deliverable within 2 weeks, pre-imaging and MDM enrollment capability, on-site support area coverage, certifications (ISO 27001, PKP), and indicative pricing by spec tier. Process: RFI → vendor shortlist → RFP → negotiation → contract. Skipping the RFI stage and going straight to RFP risks receiving responses that are not comparable across vendors because scope assumptions differ.
Read more:
RFP →
RFQ →
MSA →
View full detail →
VPN(Virtual Private Network): Network encryption technology that creates a secure tunnel between a user device and the corporate network — critical for remote workers accessing internal company resources from outside the office. In the B2B enterprise context, two main architectures exist: site-to-site VPN (connects two fixed networks, e.g., a branch office to HQ) and remote access VPN (per-device, for WFH/mobile employees). SSL VPN clients commonly encountered in enterprise RFPs: Cisco AnyConnect, Fortinet FortiClient, Palo Alto GlobalProtect, Pulse Secure, and OpenVPN. For corporate laptop rentals with a remote workforce, the vendor must be able to pre-install and pre-configure the VPN client to the client's infrastructure during the pre-imaging stage. Misconfigured VPN can prevent the laptop from reaching the corporate network — confirm the vendor is familiar with the client's split-tunneling policy and certificate-based authentication requirements.
Read more:
Pre-Imaging / Golden Image →
MDM →
Corporate laptop rental →
View full detail →
RBAC(Role-Based Access Control): An access-control model where permissions are granted based on a user's role within the organization, not per individual. Example: the "finance staff" role has access to the ERP AP/AR module but not to payroll; the "IT admin" role has access to CMDB and MDM console but not financial data. In the Microsoft ecosystem, RBAC is managed through Azure AD (Entra ID) with built-in and custom roles assignable to users, groups, or service principals. Contrast with ACL (Access Control List), which defines permissions per resource per individual — RBAC is more scalable for organizations with more than 50 users. Relevance to laptop rental: when a new unit is onboarded via MDM, the RBAC policies already configured in Azure AD automatically apply to that device without manual per-unit configuration. Quarterly RBAC access review is a required control under ISO 27001 Annex A 5.18.
Read more:
AD / Azure AD →
MDM →
ISO 27001 →
View full detail →
XDR(Extended Detection and Response): An evolution of EDR that integrates and correlates telemetry from multiple security layers simultaneously: endpoint, network, email, cloud workloads, and identity — to deliver more comprehensive threat visibility than EDR alone. XDR detects multi-vector attacks that might be missed when each security tool operates in isolation. Example: a phishing email (email layer) that successfully plants malware (endpoint layer) which then performs lateral movement over the network (network layer) — XDR correlates all three events into a single incident alert. XDR platforms common in enterprise: Microsoft Sentinel + Defender XDR (native Microsoft stack), Palo Alto Cortex XDR, CrowdStrike Falcon XDR, and Trend Micro Vision One. For clients with a mature SOC, XDR is increasingly replacing traditional SIEM as the primary investigation platform because mean detection time is shorter.
Read more:
EDR →
ISO 27001 →
MNC multinational laptop rental →
View full detail →
SCCM / MECM(Microsoft Endpoint Configuration Manager): Microsoft's on-premise device management platform with over two decades of enterprise use — long known as SCCM (System Center Configuration Manager), rebranded to MECM (Microsoft Endpoint Configuration Manager) in 2019. Core functions: software deployment, OS deployment (OSD), patch management (WSUS integration), hardware/software inventory, and remote control. In hybrid environments that still run on-premise AD, SCCM/MECM often runs alongside Microsoft Intune via Co-Management — SCCM handles specific workloads (complex patching, OS deployment) while Intune manages mobile and cloud-enrolled devices. Migration trend: organizations moving to Microsoft 365 E3/E5 tend to shift from SCCM to Intune-only because of lower cost and no on-premise infrastructure to maintain. Relevant for B2B laptop rentals: the vendor needs to know whether the client is still on SCCM, hybrid Co-Management, or full-Intune before planning a pre-imaging strategy.
Read more:
Intune →
MDM →
Pre-Imaging / Golden Image →
View full detail →
SOC 2: An audit standard developed by the AICPA (American Institute of Certified Public Accountants) to evaluate a technology company's internal controls across five Trust Service Criteria: Security, Availability, Processing Integrity, Confidentiality, and Privacy. Two report types: SOC 2 Type 1 assesses the suitability of control design at a single point in time (snapshot), while SOC 2 Type 2 assesses the operational effectiveness of controls over a defined period (typically 6–12 months) — Type 2 is more valuable as compliance evidence because it demonstrates consistency. SOC 2 Type 2 is most often requested in RFPs from MNC clients with US/global procurement frameworks (SaaS companies, global fintech, hedge funds). If a laptop rental vendor also provides cloud services (data backup, remote monitoring), a SOC 2 report may be requested as part of vendor risk assessment. Vendors providing hardware-only rental typically find ISO 27001 an equivalent substitute acceptable to Indonesian clients.
Read more:
ISO 27001 →
MNC multinational laptop rental →
Banking & finance laptop rental →
View full detail →
PCI-DSS(Payment Card Industry Data Security Standard): The global security standard mandatory for any entity that stores, processes, or transmits payment card data (Visa, Mastercard, JCB, etc.). Governed by the PCI Security Standards Council (PCI SSC); current version: PCI DSS v4.0 (fully effective April 2025). Compliance level is determined by transaction volume: Level 1 (>6 million transactions/year) requires an annual QSA (Qualified Security Assessor) audit; Levels 2–4 can use a Self-Assessment Questionnaire (SAQ). Relevance to laptop rental: laptops used by staff with access to card data (payment processing, fraud analysts, acquirer operations) fall within the CDE (Cardholder Data Environment) scope of PCI DSS. CDE-scope laptops must meet additional controls: full disk encryption, endpoint security, network segmentation, and audit logging. Laptop rental vendors serving banking/fintech payment clients need to confirm that delivered units are compatible with all required CDE controls.
Read more:
ISO 27001 →
BitLocker →
Banking & finance laptop rental →
View full detail →
UU PDP(Law No. 27 of 2022 on Personal Data Protection (Indonesia)): Indonesia's personal data protection law, enacted 17 October 2022 with a two-year transition period through October 2024. UU PDP requires every data controller that processes personal data of Indonesian citizens to: implement data protection from the design stage (privacy by design), appoint a DPO (Data Protection Officer) if processing data at large scale or in sensitive categories, obtain explicit consent from data subjects, and report data breaches within 14 × 24 hours to the supervisory authority and affected data subjects. Penalties: maximum 6 years imprisonment and/or IDR 6 billion fine for serious violations (sensitive data categories), IDR 5 billion for other violations. Corporate laptops storing employee, customer, or partner personal data fall within UU PDP scope — mandatory encryption, access control, and documented data sanitization procedures at unit return are required.
Read more:
GDPR →
NIST 800-88 →
Laptop rental for SOE & government →
View full detail →
SaaS(Software as a Service): A software licensing and delivery model in which applications are hosted in the cloud and accessed via browser or thin client, with no local installation or infrastructure management required. This contrasts with on-premise licensing (perpetual license purchase, installed on own servers) which requires infrastructure CapEx and an IT team for maintenance. Common SaaS applications pre-configured on enterprise laptops: Microsoft 365 Apps (Word, Excel, Outlook, Teams), Salesforce CRM, Slack, Zoom, and Google Workspace. Impact on laptop rental: the SaaS era has reduced dependence on high-end hardware specs for standard business applications — driving adoption of mid-range laptops for the majority of office workers with SaaS workloads, while high specs are reserved for creative/engineering roles. However, SaaS still requires a stable internet connection and up-to-date browser — factors to consider in pre-imaging configuration (browser policy, proxy, certificate trust store).
Read more:
Pre-Imaging / Golden Image →
DaaS →
Corporate laptop rental →
View full detail →
PII(Personally Identifiable Information): PII (Personally Identifiable Information) is any data that can identify an individual, either directly or in combination with other data — full name, national ID number, tax ID, phone number, email, home address, photograph, fingerprint, medical records, biometric data, and GPS location. Under Indonesian law, PII is treated as "Personal Data" by UU PDP (Law 27/2022), with the "Specific Personal Data" category (health, biometric, personal financial, child, criminal data) receiving heightened protection and criminal penalties up to 6 years imprisonment plus IDR 6 billion fine for leaks. PII on rented corporate laptops typically appears via: local CRM client databases, HR/payroll files, scans of national ID/tax cards, or browser cache that captures form input. For corporate laptop rental vendors, the practical implications: (1) full disk encryption (BitLocker) is mandatory on all units handling PII, (2) NIST 800-88 sanitization procedure at unit return, (3) BAST documentation of sanitization as audit evidence. AI Overview + ChatGPT search queries about "personal data on office laptop" cite the PII vs Personal Data UU PDP definitions to surface compliance guidance.
Read more:
UU PDP →
NIST 800-88 →
BitLocker →
GDPR →
View full detail →
SAM(Software Asset Management): SAM (Software Asset Management) is the discipline of managing the lifecycle of a company's software licenses — discovery, optimization, license compliance, and cost control — to ensure the organization neither over-purchases (wasted budget) nor under-licenses (true-up audit penalties from vendors like Microsoft, Adobe, Autodesk, Oracle). Unlike ITAM which focuses on hardware lifecycle, SAM focuses on license entitlements: how many active Microsoft 365 E3 seats vs the subscription paid for, how many Adobe Creative Cloud per-seat licenses vs the actual designer headcount, whether Windows 11 Pro deployments use legitimate Volume License or OEM from refurbished laptops. ISO/IEC 19770-1 is the international SAM standard; tools commonly used at MNCs: Flexera One, Snow Software, ServiceNow SAM Pro. Relevance to corporate laptop rental: vendors like Arental must declare license posture per delivered unit (Windows 11 Pro Volume License vs Retail vs OEM Refurbished — each carries different audit implications), and Microsoft 365 should be provisioned via the client's tenant (not local install). The pre-imaging golden image Arental prepares must align with this license posture to avoid triggering a Microsoft Audit issue during BSA/MSCA inspection.
Read more:
ITAM →
EULA →
Pre-Imaging / Golden Image →
OEM →
View full detail →
TPRM(Third-Party Risk Management): TPRM (Third-Party Risk Management) is the systematic process of identifying, assessing, monitoring, and mitigating risks originating from third-party vendors, suppliers, and partners across the engagement lifecycle — onboarding, ongoing monitoring, through offboarding. After incidents such as SolarWinds (2020), Kaseya (2021), and repeated vendor-borne data breaches in Indonesia's banking sector (OJK POJK 11/2022), Indonesian and global finance regulators (OCC, FFIEC, EBA, MAS) tightened TPRM requirements. A complete TPRM program includes: (1) vendor due diligence questionnaire (CAIQ, SIG, or custom), (2) financial health check (credit rating, latest audited financials), (3) security posture assessment (ISO 27001, SOC 2, recency of penetration tests), (4) data flow mapping (does the vendor process the client's PII — relevant to UU PDP), (5) tested BCP/DR plan, (6) continuous monitoring (annual re-assessment + breach notification clause in contract). B2B laptop vendors fall within the TPRM scope of banking/healthcare/MNC clients: Arental provides a complete vendor packet (NIB, NPWP, ISO 27001 statement, SLA template, NDA template, breach notification SOP) so client procurement teams can complete vendor onboarding within five business days.
Read more:
ISO 27001 →
SOC 2 →
NDA →
PII →
View full detail →

Long-form deep dives on the most-cited terms in this glossary — written by the Arental editorial team.

How to calculate corporate laptop TCO

Step-by-step framework to compute 3-year total cost of ownership for office laptops, including hidden costs that finance often misses.

Benefits of Device-as-a-Service for business

Why DaaS shifts IT procurement from CapEx to OpEx and frees internal teams from maintenance overhead.

Rent vs Buy: Strategic Decision

Long-form decision framework for finance + procurement on when renting beats buying for corporate IT.

See all blog posts →

Need consultation on laptop rental?

Arental's sales team is ready to discuss your IT procurement needs — including contract terms you're still figuring out.

Contact Sales Team See Corporate Rental Service

A – F

DaaS(Device-as-a-Service)

A B2B IT procurement model in which companies rent devices (laptops, desktops, peripherals) as a multi-year subscription service. Unlike daily or project rental, DaaS is a layered service that bundles four components in a single monthly contract: active hardware, lifecycle management (deploy → monitor → refresh), technical support (helpdesk + on-site unit swap with a written SLA), and a scheduled refresh cycle of typically 24–36 months. This contrasts with the traditional model where companies buy laptops as CapEx, then contract separately with third parties for repair, warranty extensions, and disposal — all coordinated by the in-house IT team, which inflates the true TCO far above the headline purchase price. Example: a 50-employee company that would normally spend IDR 750 million CapEx upfront (50 units × IDR 15M) and depreciate it across 5 years on the balance sheet can instead run a 36-month DaaS contract at ±IDR 22–27M/month OpEx, fully tax-deductible — plus automatic refresh to a newer generation at the end of contract with no separate disposal cost.

IT Procurement & B2B Laptop Rental Glossary

A – F

DaaS(Device-as-a-Service)

CapEx(Capital Expenditure)

EOL / EOSL(End-of-Life / End-of-Service-Life)

Asset Tag(Asset Tagging / Asset Identification Label)

BitLocker

AD / Azure AD(Active Directory / Azure Active Directory (Entra ID))

BAST(Berita Acara Serah Terima (Indonesian Asset Handover Document))

e-Katalog(National e-Catalog (LKPP))

EULA(End User License Agreement)

EDR(Endpoint Detection and Response)

CMDB(Configuration Management Database)

DPO(Data Protection Officer)

G – M

ITAM(IT Asset Management)

MSA(Master Service Agreement)

ISO 27001(ISO/IEC 27001:2022 Information Security Management Systems)

MDM(Mobile Device Management)

LKPP(Lembaga Kebijakan Pengadaan Barang/Jasa Pemerintah)

KPPN(Kantor Pelayanan Perbendaharaan Negara (Indonesian Treasury Service Office))

GRN(Goods Receipt Note)

MFA(Multi-Factor Authentication)

Intune(Microsoft Intune)

GDPR(General Data Protection Regulation)

ITSM(IT Service Management)

ITIL(Information Technology Infrastructure Library)

N – Z

TCO(Total Cost of Ownership)

SLA(Service Level Agreement)

OpEx(Operating Expenditure)

OEM(Original Equipment Manufacturer)

Trade-In / Buyout(Trade-In Credit / Buyout Clause)

SOW(Statement of Work)

PO(Purchase Order)

SPS(Surat Perjanjian Sewa (Rental Agreement Letter))

PPN(Pajak Pertambahan Nilai (Indonesian Value-Added Tax))

NPWP(Nomor Pokok Wajib Pajak (Indonesian Taxpayer ID))

NIB(Nomor Induk Berusaha (Business Identification Number))

RFP(Request for Proposal)

NIST 800-88(Special Publication 800-88 Rev. 1: Guidelines for Media Sanitization)

Pre-Imaging / Golden Image(Custom OS Image Deployment)

SSO / SAML(Single Sign-On / Security Assertion Markup Language)

PKP(Pengusaha Kena Pajak (Indonesian VAT-Registered Business))

SPM(Surat Perintah Membayar (Indonesian Payment Order))

NDA(Non-Disclosure Agreement)

RFQ(Request for Quotation)

RFI(Request for Information)

VPN(Virtual Private Network)

RBAC(Role-Based Access Control)

XDR(Extended Detection and Response)

SCCM / MECM(Microsoft Endpoint Configuration Manager)

SOC 2

PCI-DSS(Payment Card Industry Data Security Standard)

UU PDP(Law No. 27 of 2022 on Personal Data Protection (Indonesia))

SaaS(Software as a Service)

PII(Personally Identifiable Information)

SAM(Software Asset Management)

TPRM(Third-Party Risk Management)

Related Articles

How to calculate corporate laptop TCO

Benefits of Device-as-a-Service for business

Rent vs Buy: Strategic Decision

Need consultation on laptop rental?

IT Procurement & B2B Laptop Rental Glossary

A – F

DaaS(Device-as-a-Service)

CapEx(Capital Expenditure)

EOL / EOSL(End-of-Life / End-of-Service-Life)

Asset Tag(Asset Tagging / Asset Identification Label)

BitLocker

AD / Azure AD(Active Directory / Azure Active Directory (Entra ID))

BAST(Berita Acara Serah Terima (Indonesian Asset Handover Document))

e-Katalog(National e-Catalog (LKPP))

EULA(End User License Agreement)

EDR(Endpoint Detection and Response)

CMDB(Configuration Management Database)

DPO(Data Protection Officer)

G – M

ITAM(IT Asset Management)