← All articles
Post-quantum

BSSN's 2027–2035 cryptography roadmap: what it means for your organization

Binjesoft · 5 November 2026 · 4 min read

In short

  • BSSN, Indonesia's National Cyber and Crypto Agency, is preparing a 2027–2035 national cryptography roadmap against the quantum threat, in three phases.
  • First in line: ministries, agencies, state-owned enterprises and Critical Information Infrastructure. Their suppliers will very likely be affected too.
  • Phase one (2027–2029) is about readiness. The most useful step you can start now: know where your organization uses cryptography.

What was announced

Through the second half of 2026, Indonesia's preparation for the quantum era moved quickly:

  • 6 August 2026: the Coordinating Ministry for Political and Security Affairs, BSSN, Telkom, academics and industry held a coordination meeting on post-quantum policy. Priorities included a national post-quantum cryptography (PQC) migration roadmap, protection of strategic data, cross-sector coordination and a planned national quantum center. BSSN also formed a national task force for PQC migration.
  • 14 October 2026: BSSN Head Nugroho Sulistyo Budi said in Singapore that the migration will be phased, covering ministries, agencies, state-owned enterprises and strategic sectors, with priority for Critical Information Infrastructure. "Data that is secure today may not remain secure in the future," he said.
  • 20 October 2026: BSSN Deputy Head Albertus Rachmad Wibowo presented the 2027–2035 roadmap for national cryptographic self-reliance in Bali.
  • Late October 2026: Telkom, BSSN, Peruri and Danantara reportedly signed memorandums of understanding for a "Quantum-Safe Indonesia" initiative, covering cryptographic asset discovery, PQC readiness assessment and migration tooling.

The three phases

PeriodPhaseWhat it means for organizations
2027–2029Foundation and readinessMap cryptographic assets, assess risk and plan the migration.
2030–2032Implementation and integrationDeploy quantum-resistant algorithms in systems, networks and services.
2033–2035Cryptographic sovereigntySelf-reliant, quantum-resistant national cryptography.

According to the same reports, BSSN is developing a staged migration framework: preparation, cryptographic asset inventory, quantum risk assessment, migration planning, implementation and stronger crypto-agility. Technical details, standards and binding deadlines have not been announced yet.

The end year, 2035, lines up with NIST's transition plan in the United States, which deprecates RSA and elliptic-curve cryptography after 2030 and disallows them after 2035.

Who is affected?

  • Government, state-owned enterprises and Critical Information Infrastructure operators, such as finance, energy, telecommunications and health. These are named as the priority.
  • Their suppliers and technology partners. When a bank or state-owned company starts migrating, software vendors, cloud providers and system integrators will be asked: "Is your product ready for post-quantum cryptography?"
  • Any organization holding long-lived data: medical records, customer data, contracts or identity documents. Indonesia's Personal Data Protection Law already requires appropriate protection of personal data, and what counts as "appropriate" changes as the threat changes.

Why not wait until 2030?

Two reasons. First, "harvest now, decrypt later" attacks: encrypted data stolen today can be decrypted once quantum computers are capable. Second, migrating cryptography takes years, because it is spread across applications, APIs, VPNs, databases, certificates, devices and vendor systems.

When a quantum computer capable of breaking today's encryption will exist is uncertain. In his presentation, BSSN's Deputy Head cited expert estimates ranging from 2028 to 2030. Whatever the exact date, organizations that start in the readiness phase will be far calmer than those rushing during implementation.

Seven steps you can start now

  1. Name an owner. One person or a small team responsible for PQC readiness.
  2. Build a cryptography inventory. Record where and how cryptography is used: websites, APIs, VPNs, databases, backups, certificates, code signing and third-party services.
  3. Classify data by how long it must stay secret. Data that must stay confidential for 10 years or more comes first.
  4. Ask vendors about their PQC plans. Add post-quantum readiness questions to procurement and new contracts.
  5. Build crypto-agility. Avoid hard-coding algorithms. This matters because BSSN's roadmap emphasizes cryptographic self-reliance, so national standards may differ from international ones.
  6. Pilot hybrid TLS on non-critical systems to understand the effect on performance and compatibility.
  7. Follow official BSSN guidance. Don't rush to buy "quantum-safe" products before national standards and guidelines are clear.

Need help starting an inventory or building a migration roadmap? Book a PQC consultation with Binjesoft, or start with our introduction to post-quantum cryptography.

Sources: Bisnis.com · GovInsider · Indonesia Business Post · IndoTelko · Quantum Zeitgeist · Cloud Security Alliance (NIST IR 8547)

Pasca-kuantum

Peta jalan kriptografi BSSN 2027–2035: apa artinya bagi organisasi Anda?

Binjesoft · 5 November 2026 · 4 menit baca

Ringkasnya

  • BSSN sedang menyusun peta jalan kriptografi nasional 2027–2035 untuk menghadapi ancaman komputer kuantum, dalam tiga fase.
  • Prioritas awal: kementerian, lembaga, BUMN, dan Infrastruktur Informasi Vital (IIV). Pemasok mereka kemungkinan besar ikut terdampak.
  • Fase pertama (2027–2029) adalah soal kesiapan. Langkah paling penting yang bisa dimulai sekarang: tahu di mana saja organisasi Anda memakai kriptografi.

Apa yang diumumkan

Sepanjang paruh kedua 2026, persiapan Indonesia menghadapi era kuantum bergerak cepat:

  • 6 Agustus 2026: Kemenko Polkam, BSSN, Telkom, akademisi, dan industri menggelar rapat koordinasi tentang kebijakan menghadapi era pasca-kuantum. Prioritas yang dirumuskan antara lain peta jalan migrasi kriptografi pasca-kuantum (PQC) nasional, perlindungan data strategis, koordinasi lintas sektor, dan rencana pusat kuantum nasional. BSSN juga membentuk gugus tugas nasional untuk migrasi PQC.
  • 14 Oktober 2026: Kepala BSSN, Nugroho Sulistyo Budi, menyampaikan di Singapura bahwa migrasi akan dilakukan bertahap, mencakup kementerian, lembaga, BUMN, dan sektor strategis, dengan prioritas pada infrastruktur informasi vital. "Data yang aman hari ini belum tentu tetap aman di masa depan," ujarnya.
  • 20 Oktober 2026: Wakil Kepala BSSN, Albertus Rachmad Wibowo, memaparkan peta jalan kemandirian kriptografi nasional 2027–2035 di Bali.
  • Akhir Oktober 2026: Telkom, BSSN, Peruri, dan Danantara dilaporkan menandatangani nota kesepahaman inisiatif "Quantum-Safe Indonesia", yang mencakup inventarisasi aset kriptografi, penilaian kesiapan PQC, dan pengembangan alat bantu migrasi.

Tiga fase peta jalan

PeriodeFaseArtinya bagi organisasi
2027–2029Fondasi dan kesiapanMemetakan aset kriptografi, menilai risiko, dan menyusun rencana migrasi.
2030–2032Implementasi dan integrasiMenerapkan algoritma tahan kuantum di sistem, jaringan, dan layanan.
2033–2035Kedaulatan kriptografiKriptografi nasional yang mandiri dan tahan kuantum.

Menurut laporan yang sama, BSSN mengembangkan kerangka migrasi bertahap: persiapan, inventarisasi aset kriptografi, penilaian risiko kuantum, perencanaan migrasi, implementasi, dan peningkatan kelincahan kriptografi (crypto-agility). Detail teknis, standar, dan tenggat yang mengikat belum diumumkan.

Tahun akhirnya, 2035, sejalan dengan rencana transisi NIST di Amerika Serikat, yang menyatakan RSA dan kriptografi kurva eliptik usang setelah 2030 dan tidak lagi diizinkan setelah 2035.

Siapa yang terdampak?

  • Pemerintah, BUMN, dan pengelola IIV, seperti sektor keuangan, energi, telekomunikasi, dan kesehatan. Mereka disebut sebagai prioritas.
  • Pemasok dan mitra teknologi mereka. Ketika bank atau BUMN mulai bermigrasi, vendor perangkat lunak, penyedia cloud, dan integrator sistem akan ditanya: "Apakah produk Anda siap pasca-kuantum?"
  • Setiap organisasi yang menyimpan data berumur panjang: rekam medis, data nasabah, kontrak, atau dokumen identitas. UU Pelindungan Data Pribadi sudah mewajibkan perlindungan data pribadi yang memadai, dan "memadai" akan ikut berubah seiring ancamannya.

Mengapa tidak menunggu sampai 2030?

Ada dua alasan. Pertama, serangan "curi sekarang, buka nanti": data terenkripsi yang dicuri hari ini bisa dibuka ketika komputer kuantum sudah mampu. Kedua, migrasi kriptografi butuh waktu bertahun-tahun, karena kriptografi tersebar di aplikasi, API, VPN, basis data, sertifikat, perangkat, hingga sistem milik vendor.

Kapan komputer kuantum yang mampu membobol enkripsi akan tersedia belum bisa dipastikan. Dalam pemaparannya, Wakil Kepala BSSN menyebut ada perkiraan ahli di kisaran 2028 hingga 2030. Apa pun tanggal pastinya, organisasi yang mulai di fase kesiapan akan jauh lebih tenang daripada yang terburu-buru di fase implementasi.

Tujuh langkah yang bisa dimulai sekarang

  1. Tunjuk penanggung jawab. Satu orang atau tim kecil yang memegang urusan kesiapan PQC.
  2. Buat inventaris kriptografi. Catat di mana dan bagaimana kriptografi dipakai: situs web, API, VPN, basis data, cadangan data, sertifikat, penandatanganan kode, dan layanan pihak ketiga.
  3. Klasifikasikan data berdasarkan umur kerahasiaannya. Data yang harus rahasia 10 tahun lebih adalah prioritas pertama.
  4. Tanyakan rencana PQC vendor Anda. Masukkan pertanyaan kesiapan pasca-kuantum ke proses pengadaan dan kontrak baru.
  5. Bangun kelincahan kriptografi. Hindari algoritma yang ditanam langsung di kode. Ini penting karena peta jalan BSSN menekankan kemandirian kriptografi, sehingga standar nasional bisa saja berbeda dari standar internasional.
  6. Uji coba TLS hibrida di sistem yang tidak kritis, untuk memahami dampaknya pada kinerja dan kompatibilitas.
  7. Pantau panduan resmi BSSN. Jangan terburu-buru membeli produk "quantum-safe" sebelum standar dan pedoman nasional jelas.

Butuh bantuan memulai inventaris atau menyusun peta jalan migrasi? Jadwalkan konsultasi PQC dengan Binjesoft, atau baca dulu pengantar kriptografi pasca-kuantum kami.

Sumber: Bisnis.com · GovInsider · Indonesia Business Post · IndoTelko · Quantum Zeitgeist · Cloud Security Alliance (NIST IR 8547)

Have a project in mind?

Tell us about it — we usually reply within one business day.

hello@binjesoft.com