Quantum Readiness for Indonesian Banks

Why does quantum readiness matter for banks?

Because bank data has a long confidentiality life, and much of it travels through vendors whose key exchange the bank does not control.

Account data, transaction histories and identity documents can be recorded today and decrypted later. NIST plans to deprecate quantum-vulnerable public-key algorithms after 2030 and disallow them after 2035, as explained in our article about quantum security and post-quantum cryptography deadlines. A bank that migrates its own systems but keeps classical-only vendors is still exposed.

What does OJK say about post-quantum cryptography?

When this article was written, no OJK rule specific to post-quantum cryptography had been found.

Banks still carry general duties to manage IT risk and the risk of outsourced providers, including how those providers protect data. Treat quantum readiness as part of that existing vendor oversight, as covered on our OJK outsourcing page, and confirm the current position with your compliance team.

Which bank vendors should you check first?

Start with vendors that carry long-life customer data over the internet.

• Payment processors, switches and card service providers.
• Core-banking, cloud and data-centre providers.
• Fintech partners and API providers with access to customer data.
• Identity verification, e-KYC and document-signing providers.
• Managed security and IT service providers with remote access.

How CyberRank helps

CyberRank's quantum-crypto exposure check (Beta) gives each vendor a not, partly or fully quantum-safe posture from its public TLS and SSH services, with key exchange and signatures checked separately. It sits in the same profile as the vendor's security rating and impact tier, so critical vendors with classical-only cryptography stand out. CyberRank cannot see a vendor's internal systems, HSMs or migration plan; use questionnaires and contracts for those.