Indonesia Formed a National PQC Task Force. The Roadmap It's Supposed to Produce Doesn't Exist Yet

Two senior, named Indonesian officials have confirmed on the record that a national post-quantum task force exists. What it's supposed to produce -- a national migration roadmap -- doesn't exist yet, and a regulation often cited alongside this story turns out to be about a different kind of cryptography sovereignty entirely.

What's actually confirmed

BSSN (Badan Siber dan Sandi Negara), Indonesia's national cyber and crypto agency, formed a "Gugus Tugas Nasional Penyiapan Migrasi Post-Quantum Cryptography" (National Task Force for Post-Quantum Cryptography Migration Preparation). This isn't a rumor or a single unnamed source: BSSN's Deputy for Cyber Security and Crypto Strategy and Policy, Marsda TNI R. Tjahjo Kurniawan, confirmed it directly to Koran Jakarta on 11 August 2026: "BSSN juga telah membentuk Gugus Tugas Nasional Penyiapan Migrasi Post-Quantum Cryptography."

A second official, Kemenko Polkam Deputy for Communication and Information Coordination Marsda TNI Eko Dono Indarto, added urgency to the same story: "Soal Post-Quantum Cryptography, dunia bergerak jauh lebih cepat dari yang kita bayangkan. Kita harus mengejar dan membuat lompatan." ("On Post-Quantum Cryptography, the world is moving much faster than we imagined. We must catch up and make a leap.") Two titled officials from two different institutions, both on the record, both describing the same cross-agency effort -- that's a genuinely higher bar of confirmation than most early-stage PQC activity gets.

What hasn't happened yet

The task force's mandate, per the same reporting, is to produce a national PQC migration roadmap. As of this review, no roadmap, charter document, or interim deliverable from the task force has been published anywhere. No target year attaches to the roadmap itself -- it's described as a forthcoming output, not a dated commitment. That makes this page's status "activity confirmed, product pending," which is a meaningfully different thing from either "nothing is happening" or "a roadmap exists."

The regulation that gets conflated with this story

A separate BSSN regulation, Peraturan BSSN No. 11 Tahun 2024, circulates in some coverage alongside the PQC task force story, as if it were related groundwork. It isn't. That regulation governs "Algoritma Kriptografi Indonesia" -- Indonesia's own sovereign national cryptographic algorithm standard, set out for critical electronic systems, covering algorithm drafting, review, use, and oversight. Every available summary of its text is classical cryptography sovereignty regulation, structurally similar to what China does with its SM-series algorithms or what Russia does with GOST. There is no post-quantum or quantum-resistance language in it. Citing BSSN 11/2024 as evidence of Indonesian PQC regulatory groundwork mismatches two separate cryptography sovereignty tracks that happen to share the same issuing agency.

What's still missing

No roadmap, charter, or published deliverable exists from the task force. No target year has been attached to anything. Neither Bank Indonesia nor OJK (Indonesia's financial services authority) has published anything PQC-specific -- OJK's general cyber-resilience rules for banks require an IT-asset inventory classified by criticality, which is a real requirement, but it's a general cybersecurity inventory rule predating and unrelated to quantum risk, not a cryptographic inventory and not CBOM-named.

What to do with this

If you operate in Indonesia, the task force's existence is a genuine early signal worth tracking directly through BSSN's own channels rather than relying on secondary reporting of expected timelines -- the two officials' public statements suggest real institutional momentum, even without a published product yet. Don't treat Peraturan BSSN 11/2024 as PQC compliance groundwork; it's a different cryptography sovereignty obligation that happens to sit under the same agency. The practical status for any organization today is the same as most early-stage jurisdictions on this tracker: nothing to comply with yet, but a named task force and two titled officials on the record is a stronger signal than most countries at this stage can show.

The Indonesia country page tracks the task force confirmation and the regulators checked with no PQC publication, each against primary and named-official sources.