Penetration Testing Requirements in Indonesia: OJK, Bank Indonesia and BSSN

POJK 11/POJK.03/2022 on the implementation of information technology by commercial banks replaced POJK 38/2016 and took effect on 7 October 2022. Its testing duties sit in Articles 23 to 26:

• Article 23. Banks must carry out cyber security testing based on (a) vulnerability analysis and (b) scenarios.
• Article 24. Vulnerability-analysis testing must be done periodically, and the results reported to OJK. The regulation does not set a number.
• Article 25. Scenario-based testing must be done at least once a year. It covers objectives, scope and scenarios, execution, evaluation, and an assessment of how effective mitigation, response and recovery were. The report, with a summary, lessons learned and remediation, goes to OJK within 10 working days of the end of the test.
• Article 26. Banks need a cyber resilience and security function independent of IT management.

SEOJK 29/SEOJK.03/2022 on cyber resilience and security for commercial banks (27 December 2022) adds the detail. As reported by Kontan and summarized by Assegaf Hamzah & Partners, vulnerability testing is periodic, based on the bank's own evaluation, and starts with vulnerability identification followed by a penetration test. Scenario testing can take the form of a table-top exercise, a cyber range exercise, a social engineering exercise or an adversarial attack simulation, carried out under close control. Both can be done in-house or by a third party.

In practice: OJK does not prescribe a pentest calendar, but it expects a documented, risk-based rhythm that you can defend, and a scenario exercise every year.

Bank Indonesia regulates payment service providers, payment infrastructure providers and money-market and FX participants through PBI 2/2024 on information system security and cyber resilience and its implementing rule PADG 24/2024 (in force 31 December 2024).

• Vulnerability scanning of applications, infrastructure and data, based on the cyber-risk profile, which the elucidation says includes penetration testing and vulnerability assessment. It may be done internally and/or by a third party, and is evaluated at least once a year.
• Security audit at least once a year. External auditors must be independent and registered with the industry self-regulatory body or another authority.
• Incident-response simulation at least once a year, which may involve third parties.
• Evidence. Penetration test reports are listed among the supporting documents for reporting to Bank Indonesia. The first annual report, for 2025, was due in January 2026.

• Sharia commercial banks fall under POJK 11/2022 and SEOJK 29/2022 like conventional banks.
• Rural banks (BPR and BPRS) get their own IT regulation, POJK 34/2025, which takes effect about one year after its promulgation in December 2025.
• Non-bank financial institutions (insurers, finance companies and others) remain under POJK 4/POJK.05/2021, which sets general information security duties and requires systems to be located in Indonesia unless OJK approves otherwise. It does not contain an explicit penetration testing clause.
• Peer-to-peer lending is now governed by POJK 40/2024, in force since 27 December 2024.

For these sectors, check the current implementing circulars with your compliance team: the testing detail usually sits there rather than in the regulation.

• Perpres 82/2022 on the protection of vital information infrastructure (critical information infrastructure, financial services among the sectors) requires operators to apply information security standards, manage cyber risk, run incident-response simulations, carry out a cyber security maturity self-assessment at least once a year, and report incidents within 24 hours. It does not name penetration testing.
• BSSN Regulation 8/2020 on electronic system security classifies systems as strategic, high or low and requires SNI ISO/IEC 27001 and/or BSSN standards.
• BSSN Regulation 8/2024 on e-government (SPBE) security audits requires audits at least once a year for national infrastructure and general applications, by auditors registered with BSSN.

Penetration testing is the practical way to show that controls required by these standards work, but for government systems the formal duty is the audit.

Law 27/2022 on personal data protection (UU PDP) requires controllers to protect and ensure the security of personal data through technical and operational measures matched to the risk (Article 35). The two-year transition ended on 17 October 2024. The implementing regulation, PP 33/2026, takes effect on 16 January 2027, and as of October 2026 the supervisory agency is not yet operating.

The law does not prescribe penetration tests, but testing is the usual evidence that the security measures exist and work.

POJK 11/2022 Article 35 requires banks to place their electronic systems in a data centre and a disaster recovery centre in Indonesia. Placement abroad is allowed only with OJK approval and only for listed purposes such as group analytics, group risk management or anti-money-laundering; OJK decides within three months. Non-bank institutions have a similar rule under POJK 4/2021, and public-scope electronic systems under PP 71/2019 must be managed, processed and stored in Indonesia unless the technology is not available domestically.

A penetration test produces credentials, network maps and evidence of how to break into the bank. A SaaS testing platform that processes or stores them abroad, or an AI model hosted overseas that reads them, deserves the same localization review as any other system. An appliance that runs inside the bank's own data centre, on its own models, avoids the question. See the sovereign AI red team guide.

1. 1Document a risk-based frequency for vulnerability analysis and penetration testing, and the triggers for extra tests (major changes, new internet-facing services).
2. 2Plan a scenario-based exercise every year and the 10-working-day report to OJK.
3. 3Keep the cyber resilience function independent of IT management, and decide which tests run in-house and which by a third party.
4. 4For Bank Indonesia scope: schedule the yearly security audit with a registered independent auditor and the yearly evaluation of vulnerability scanning; keep pentest reports as supporting evidence.
5. 5Check where every security tool processes and stores test data, and whether Article 35 approval would be needed.
6. 6Re-test fixes and keep the evidence: the supervisor asks for remediation, not only findings.

The requirements by regulation page compares Indonesia's approach with other jurisdictions.

Zero Hunt is an autonomous AI red team on an on-premise appliance: it runs black-box and gray-box penetration tests of networks and infrastructure from inside your data centre, on its own models, so findings and credentials do not leave Indonesia. Operators choose one of five autonomy levels that decide which actions wait for approval, and every finding is backed by Ed25519-signed, hash-chained evidence for the report to OJK or Bank Indonesia.

Zero Hunt maps findings to 34 frameworks, including ISO/IEC 27001 (the basis of BSSN Regulation 8/2020) and PCI DSS. It does not ship an OJK-, Bank Indonesia- or BSSN-specific report template; your team or partner maps the evidence to those rules.

Does OJK require an annual penetration test? Not in those words. POJK 11/2022 requires vulnerability-analysis testing periodically and scenario-based testing at least once a year. SEOJK 29/2022 says vulnerability testing starts with vulnerability identification followed by a penetration test, at a frequency based on the bank's own evaluation.

Must the penetration test be done by an external firm? For banks, no: SEOJK 29/2022 allows in-house or third-party testing. For Bank Indonesia's yearly security audit, external auditors must be independent and registered.

Do the results go to the regulator? Yes. Banks report vulnerability-testing results to OJK and scenario-test reports within 10 working days. Bank Indonesia lists pentest reports among supporting evidence.

Can a bank use a cloud or SaaS pentest platform hosted outside Indonesia? Check with compliance. Banks must keep electronic systems in Indonesia unless OJK approves placement abroad for listed purposes; a tool that stores test data overseas should be reviewed against that rule.

What about rural banks and insurers? Rural banks have POJK 34/2025, effective about December 2026. Insurers and other non-bank institutions remain under POJK 4/2021 and its circular.