Since the Indonesian ISP Association was formed in 1996 and the country's first CERT was established two years later, Indonesia has been on a well documented pathway to embracing the benefits and risks of the internet age. This journey has accelerated in the last few years; the 2015 Indonesian Defence White Paper which identified cybercrime and cyber warfare as significant threats was a significant milestone. A new legal framework for dealing with cybercrime was established the following year and a year later the State Cyber & Crypto Agency (BSSN) was formed. The publication of the National Cyber Security Strategy in 2018 was another key milestone. The actions to date place Indonesia at Maturity Level 3 as a minimum. Sadly, there is no corresponding evidence of the financial sector regulators (the Central Bank and OJK) having the same zealous approach to dealing with cyber threats which would warrant Maturity level 4.