Outsourcing & IT Risk Management under OJK
How Indonesia's financial services regulator governs bank IT and outsourcing risk — and what it means for your vendor assessments.
TL;DR
- OJK requires Indonesian banks to manage risk in their use of information technology, including third-party (outsourcing) risk — notably under POJK 38/POJK.03/2016.
- Outsourcing arrangements need risk assessment, contractual safeguards, and ongoing oversight of the provider.
- External security ratings give banks objective evidence of a provider's security posture.
Summary
Indonesia's Financial Services Authority (OJK) requires banks to manage risk in their use of information technology, including risks brought by third parties (outsourcing) — notably under POJK 38/POJK.03/2016.
What is the framework?
The financial sector depends heavily on technology vendors: core banking, payments, cloud, and managed services. OJK therefore requires banks to remain fully accountable for outsourced IT risk, including performing due diligence and ongoing oversight of third parties.
The OJK regulation on applying risk management in the use of information technology by commercial banks is the primary reference: banks must ensure adequate risk management for every IT service, including those handed to third parties. OJK also issues circular letters on bank cooperation with third parties — check the OJK legal database (JDIH OJK) for the latest versions.
What does it require?
Banks cannot transfer risk accountability to vendors — active oversight remains the bank's obligation as the party using the service.
- Third-party security due diligence before engagement and on an ongoing basis
- Cooperation agreements covering information security obligations and audit rights
- Continuous oversight of vendor performance and risk
- Incident-handling readiness for incidents involving third parties
- IT risk reporting to management and regulators
What does it mean for vendor risk?
For a vendor risk assessment program, OJK rules mean vendor assessment is not a contractual formality: evidence of continuous security monitoring, findings history, and remediation must be documented. Security ratings and external monitoring are efficient ways to produce that evidence.
Vendors failing to meet security standards should be detected early — for example through rating declines — before an audit or regulator finds them.
How can CyberRank help?
CyberRank helps meet third-party oversight expectations with consistent, re-verifiable data.
- Security ratings to objectively compare and monitor vendors
- Continuous monitoring with trend evidence for audits and regulators
- Vendor assessments (TPRM) covering security and privacy
- Shareable reports for risk committees and authorities
References
Frequently asked questions
Related links
Get your free security rating
Run a free CyberRank security rating for any organisation and see the same vendor risk signals our customers use.
Get your free security rating