For the examiner in the room, and the adversary who isn't.

Requires

Annual cyber security and resilience assessment for commercial banks: an inherent risk rating, plus maturity across two components — the quality of cyber risk management implementation, and the quality of cyber resilience process implementation. Filed within 15 business days of year end.

We do

Independent assessment against both components — governance, risk framework, risk process and control system on one side; identify, protect, detect, respond and recover on the other — with the remediation sequence that actually moves the rating.

Requires

IT governance, architecture, risk management, personal data protection, service provision, and internal audit and control for commercial banks.

We do

vCISO-led control design and third-party risk assessment, mapped clause by clause rather than to a generic framework.

Requires

The implementing regulation under POJK 11, effective 1 March 2026: IT governance and architecture, IT risk management, third-party IT providers, offshore placement licensing, data management and personal data protection, internal control, audit and reporting. It repeals SEOJK 21/2017; SEOJK 29 remains in force alongside it.

We do

Re-baseline against the new instrument rather than the one it replaced — most banks' control documentation still references the 2017 circular.

Requires

Information system security and cyber resilience for payment system operators, money market and foreign exchange participants, and other parties regulated and supervised by Bank Indonesia.

We do

Threat-led testing of the payment rails themselves, plus 24/7 detection tuned to payment-specific abuse rather than generic malware signatures.

Requires

Restructured, risk-based obligations across payment service providers, infrastructure operators and supporting providers. In force 31 March 2026.

We do

Readiness assessment against your new category, before a supervisor tells you which one you are in.

Requires

Lawful basis, data protection impact assessment, and notification of a personal data breach within 72 hours.

We do

Data governance implementation and incident runbooks built against the clock — 72 hours is not long enough to start deciding who signs.

Requires

Annual attestation against the mandatory control set, independently assessed.

We do

Independent assessment and remediation of failed controls, scheduled so attestation is not a fire drill.

Requires

Cardholder data environment controls, with segmentation validated by testing.

We do

Segmentation penetration testing and CDE scoping — most of the saving is in proving the scope is smaller than assumed.