The BSSN warnings nobody answered: form a CSIRT and start a post-quantum cryptography inventory

Imagine a warning arriving in an inbox that nobody reads. It says there is a potential incident in your system. This pattern is not just imagination. According to a statement by Indonesia's National Cyber and Crypto Agency (BSSN) on 2 September 2026, about 25 percent of the 2,855 potential cyber-incident notifications it sent throughout 2025 had not been adequately answered or followed up.

In the same keynote, BSSN gave data-centre operators and electronic-system providers two messages: form an incident response team (CSIRT), and begin preparing for post-quantum cryptography. This article explains both in operational terms, so leaders can decide who does what this quarter.

“This shows that detection alone is not enough. What matters most is how quickly the warning is acted on, so that a potential incident does not grow into a bigger disruption.” — Nur Achmadi Salmawan, BSSN, 2 September 2026, as quoted by Diksiber DKI (translated)

What BSSN said

The statement was made by Nur Achmadi Salmawan, BSSN's Director of Cybersecurity and Cryptography for Information and Communication Technology, Media, and Transportation, at the Indonesia Energy & Engineering (IEE) Series seminar at JIExpo Kemayoran, Jakarta, on 2 September 2026, as reported by Diksiber DKI and Gramediapost. This is an official's remarks at a public forum, not a new regulation. We say so to avoid any impression of a new legal obligation.

The figures BSSN cited from its Security Operations Center (SOC) monitoring across 2025:

• 5.51 million data-traffic anomalies were observed.
• 13.9 million ransomware activities were classed as high-attention incidents.
• 44.7 million records were exposed on the darknet, affecting 461 government agencies.
• 2,855 potential-incident notifications went to government agencies and private organisations; about 25 percent were not adequately answered.

These numbers come from BSSN's presentation as quoted by the media, not from a written report we opened. We use them to show direction, not as statistics comparable with other sources.

BSSN also tied its message to the incident at the Temporary National Data Centre (PDNS) in Surabaya and cited the principle of interdependent security: one facility's security helps determine the risk of the systems that depend on it. The official referred to Presidential Regulation No. 82 of 2022 to stress that data centres sit at the centre of national risk.

First message: form a CSIRT, and make sure it actually answers

A CSIRT (Computer Security Incident Response Team) is the official team that detects, handles, and responds to incidents, and acts as the coordination point with outside parties, including the government. BSSN named four things to prepare:

1. A clear structure and mandate. Who is on the team, who has authority to decide, and on what basis.
2. An official 24-hour contact channel. Not the personal email of a staff member who is on leave.
3. An incident escalation playbook or SOP. First step, second step, third step; who is called at minute 15.
4. Regular incident-handling drills. Exercises prove that the playbook can be executed.

Point 2 is easy to test and often a weak spot. A notification that lands at a generic address, with someone who has changed roles, or with a vendor who has no authority to decide, is as good as undelivered. Job rotation, or services bought separately from the team that runs the system, can quietly leave the contact channel out of date.

A simple measure: time from notification to action

You do not need a large SOC. Measure one thing: how long from receiving a notification to having a ticket, an owner, and a written decision. Log every notification, including those that turn out to be irrelevant. Within a month you have data to see whether the channel is alive.

Second message: post-quantum cryptography starts with an inventory

BSSN warned of the Harvest Now, Decrypt Later scenario: attackers collect encrypted data now to open it later, once quantum computers are capable enough. According to BSSN, the early phase of an operational quantum threat is projected for 2026–2030. The suggested first steps: inventory systems and cryptographic assets, map dependencies on algorithms such as RSA and ECC, and build crypto-agility, the ability to swap algorithms quickly without tearing the system apart.

As a technical reference, NIST finalised its first three post-quantum encryption standards on 13 August 2024 (FIPS 203, 204, and 205), and encouraged system administrators to begin transitioning because full integration takes time. Note that this is a US NIST reference; we found no specific migration mandate from BSSN in the sources we opened.

The key point: you do not need to buy anything to start. Inventory first.

What this means for organisations in Indonesia

This section is our interpretation of BSSN's remarks.

• Local governments and regional enterprises running public services on someone else's data centre or cloud should confirm who receives security notifications along that chain, on your side and the provider's. Also use the security-by-design steps for SPBE as a starting checklist.
• Hospitals, regional banks, and local financial institutions hold data whose sensitivity lasts a long time. That is the data most relevant to the harvest-now-decrypt-later concern, so a cryptographic inventory deserves a place in next year's work plan.
• Logistics and manufacturing firms that rely on data-centre or third-party providers should ask for the 24-hour incident contact and when the provider last ran a drill.
• Every organisation should make sure the CSIRT mandate does not stop at a decree. A team that never rehearses is a team that does not yet exist.

A 30–60–90 day plan

Days 1–30

• Set one 24-hour security contact channel and one named owner.
• Log every external notification received since the start of the year and its status.

Days 31–60

• Write a one-page escalation playbook: who contacts whom, within how many minutes.
• Run one tabletop exercise, then fix what jammed.

Days 61–90

• Build a cryptographic asset inventory: protocols, libraries, certificates, and systems that depend on RSA or ECC.
• Flag long-lived systems that hold sensitive data and decide the migration order.

The first and last items belong to the Diagnose phase, because they produce written findings on condition, risk, and options. Keeping the channel and drills alive is Operate work. For servers and environments still managed by hand, our server and environment service is usually the most realistic first step.

Limits

This article is not legal advice and not a summary of regulations. All BSSN statements are quoted from media coverage of one keynote; we did not open an official BSSN document containing those figures. We do not assess the readiness of any specific organisation, including PDNS, and we make no claims about any particular security product.

Start with one question

The cheapest question you can ask today: if BSSN sends a notification tonight, who reads it and what happens tomorrow morning? If the answer is unclear, we can help map it. Request a Diagnose via the contact page.

Sources

• Diksiber DKI—BSSN urges data centre operators to strengthen cybersecurity (2 September 2026): https://dki.diksiber.id/pemerintah/bssn-desak-pengelola-data-center-perkuat-keamanan-siber-ancaman-kini-sasar-fondasi-infrastruktur-digital-nasional/
• Gramediapost—Cyber threats grow more complex, BSSN urges data-centre operators (2 September 2026): https://www.gramediapost.com/2026/09/direktur-keamanan-siber-dan-sandi-teknologi-informasi-komunikasi-media-dan-transportasi-bssn-nur-achmadi-salmawan-ancaman-siber-kian-kompleks-bssn-desak-pengelola-pusat-data-memperkuat-infrastruk/
• NIST—NIST Releases First 3 Finalized Post-Quantum Encryption Standards (13 August 2024): https://www.nist.gov/news-events/news/2024/08/nist-releases-first-3-finalized-post-quantum-encryption-standards