Singapore prioritizes critical infrastructure in quantum-safe push, funds cryptographic ...

The Cyber Security Agency of Singapore (CSA) issued quantum-safe migration guidance recommending that organizations exposed to quantum-related cybersecurity risks establish migration plans by 2027 and aim to complete the transition by 2035. The guidance calls for Critical Information Infrastructure (CII) systems to complete migration by 2031, reflecting Singapore’s risk-based approach to preparing for advances in quantum computing that could eventually undermine widely used cryptographic methods protecting digital communications, transactions and sensitive information.

The agency also advised organizations to assess their risk exposure, identify critical systems and engage technology vendors and partners to understand available quantum-safe solutions.

To support implementation, CSA has launched the Quantum-Safe Kickstarter Grant, which will provide time-limited seed funding for organizations to pilot quantum-safe solutions and address practical migration challenges. Open to all organizations, with priority given to CII owners, the grant will run from Nov. 1, 2026, to Oct. 31, 2027, with each funded pilot lasting up to six months. Priority use cases include end-to-end migration of applications or systems, cryptographic discovery and inventory, and migration of operational technology (OT), legacy and infrastructure-heavy systems. Pilot participants must report their findings and demonstrated impact.

Advances in quantum computing could eventually undermine widely used cryptographic methods that protect digital communications, transactions and sensitive information today. Although it remains uncertain when quantum computers will become capable of breaking these methods, organizations need to begin preparing for the transition.

CSA recognized that quantum-safe migration is a complex undertaking. Cryptography is embedded across applications, networks, infrastructure and interconnected systems, often involving multiple technology vendors. Organizations will need time to identify their cryptographic dependencies, assess risks, test suitable solutions and implement changes without disrupting their operations. This is particularly important for critical infrastructure and legacy systems, where technology changes must be carefully managed.

Singapore has started preparing early for quantum-safe migration, adopting a risk-based approach that prioritises CII systems. In June 2026, CSA issued quantum-safe migration guidance to CII owners with key milestones, including the completion of quantum-safe migration of CII systems by 2031. By preparing early, organizations can manage the transition in a planned and orderly manner, rather than waiting until quantum threats become imminent.

As part of Singapore’s efforts to strengthen quantum-safe readiness, CSA has taken two further steps to help organizations move from planning to action. The agency published a new advisory recommending that organizations exposed to quantum-related cybersecurity risks put in place a quantum-safe migration plan by 2027, and aim to complete migration by 2035, the latter being in line with international guidance. These include organizations that hold sensitive information requiring long-term confidentiality, as well as those providing important services such as communications and digital transactions, where maintaining the integrity and confidentiality of information is essential.

Additionally, the advisory sets out practical and low-risk steps organizations can take now, including assessing their risk exposure, identifying their most important systems, and engaging technology vendors and partners to understand available quantum-safe solutions.

Organizations can also refer to the updated Quantum Readiness Index and Quantum-Safe Handbook, which incorporate feedback from the public consultation and reflect the latest developments in quantum-safe cryptography standards. The resources will help organizations assess their readiness and plan their transition.

CSA’s Quantum-Safe Migration Handbook offers some practical, low-risk steps to help organizations get started. These are a starting point and should be adapted to each organization’s specific needs and risk profile.

The first step is to understand the risk and identify the most important systems. There is no need to audit everything at once, so it makes sense to start with what is most exposed. This includes sensitive data that must remain confidential for years, such as commercial secrets, medical records, and legal documents. It also includes internet-facing systems, such as websites, cloud-hosted services, VPNs, and email systems that communicate over public networks. Long-lifespan equipment, such as building management systems, industrial control systems, and manufacturing equipment, also belongs on the list, since it may be difficult to update quickly.

The second step is to establish clear ownership. Organizations should identify the person who is responsible and accountable for quantum-safe migration. Larger organizations can use a RACI (Responsible, Accountable, Consulted, Informed) model to assign roles across senior management, cybersecurity teams, IT and technology strategy teams, and business units.

The third step is to identify, evaluate, and test quantum-safe solutions. For priority systems, organizations should identify which quantum-safe algorithms can replace the vulnerable ones currently in use. CSA’s Quantum-Safe Handbook lists recommended algorithms, although these will evolve as new options emerge. Testing should take place before full rollout, because some quantum-safe algorithms could affect performance given their large key sizes and increased computational needs.

The fourth step is to engage vendors and partners, since an organization’s readiness depends on theirs. Key vendors and partners should be asked whether their products support quantum-safe cryptography, what their quantum-safe upgrade roadmap is, and whether their migration timelines align with the organization’s own. They should also be asked whether they will manage the full migration, either automatically or manually, or whether the organization’s involvement is required for certain processes, and whether they will incur additional costs in supporting the migration. When renewing contracts or choosing new software and services, organizations should favour vendors that are actively preparing for the quantum-safe transition.

The fifth step is to build awareness across the organization. The leadership team needs to understand the quantum threat before it can approve the time, budget, and resources required. Briefings should be framed around business risk, not just technical details, covering matters such as regulatory obligations, customer trust, data breaches, and competitive disadvantages. The teams handling IT and migration, whether internal or outsourced providers, should also have a basic understanding of the quantum threat and what migration involves.

The sixth step is to build in long-term flexibility, known as cryptographic agility. Today’s standards for quantum-safe algorithms may evolve, so organizations should choose and build systems that let them swap out algorithms with minimal disruption. They should avoid locking into products that use hard-coded encryption with no upgrade path. Larger organizations can consider centralised and automated cryptographic management platforms, along with clear governance policies that determine how cryptographic mechanisms are selected, updated, and retired.

To help organizations translate their migration plans into action, CSA has launched a Quantum-Safe Kickstarter Grant, which will provide time-bound seed funding for organizations to pilot quantum-safe solutions and address practical migration challenges. Organizations may undertake pilots in-house or work with suitable solution providers. Use cases that address common migration challenges will be prioritised, including end-to-end migration of an application/system; cryptographic discovery and inventory; and migration of OT, legacy and infrastructure-heavy systems.

Pilot participants will be required to submit a report of their learnings and demonstrated impact. Applications are now open and will be subject to CSA’s assessment of project eligibility, scope, alignment, and strategic value. CSA reserves the right to prioritise applications that demonstrate significant impact on Singapore’s cybersecurity ecosystem.

In May, research from ISACA’s global Quantum Computing Pulse Poll highlighted a growing concern that the rapid rise of quantum computing poses a serious risk to cybersecurity and business stability, yet most enterprises remain unprepared. While 62% of technology and cybersecurity professionals fear that quantum computing could break current internet encryption standards, only 5% consider it a high priority in the near term, while another 5% say their organizations have a defined strategy to address it.