Brunei's Five-Phase PQC Framework Is More Structured Than Most Binding Mandates

A five-phase structure with named stages, two dated targets, and three explicitly covered populations sounds like it should outscore most of the vague "organizations should begin planning" guidance that fills this tracker. Brunei's framework does, on structure. It doesn't, on the one axis that actually determines whether anyone has to comply.

A genuinely structured roadmap

Cyber Security Brunei (CSB) published a "Post-Quantum Cryptography Migration Framework," first previewed as a draft at the STACK 2026 technology event (8-10 June 2026) and released as a finalized public resource shortly after. Its structure is more methodical than most comparable national guidance: a named five-phase strategy -- Assess, Select, Validate, Deploy, and Monitor -- explicitly scoped to three populations: government agencies, Critical Information Infrastructure Owners (CIIOs), and private-sector organisations.

The framework sets two concrete dated targets: "begin migration without delay, deprecate vulnerable algorithms by 2030, and complete full migration by 2035." That's a real, specific, two-year-spaced timeline -- not the vague "within the next decade" phrasing some guidance uses -- even though neither date is broken down into intermediate phase-gates tied to the five named stages.

What the phase structure implies without stating

The framework's first phase, Assess, is where a cryptographic inventory lives in practice, the same pattern as most PQC guidance on this tracker: you can't move to Select, Validate, Deploy, or Monitor without first knowing what cryptography you're running. CSB's document doesn't name a formal inventory requirement or specify what an assessment must record -- no mandated fields, no CBOM reference, no format -- which leaves the most concrete, actionable part of the five phases the least precisely defined.

Real structure, no enforcement

Here's the gap that keeps this framework in guidance territory despite its unusually organized presentation: CSB's own text describes it as guidance that "guides" organisations through the migration process. No statute, regulation, or penalty clause appears anywhere in the document. There's no reporting obligation, no compliance check, no certification requirement.

That's a meaningfully different posture than Kuwait's CORF (binding "shall" language for CBK-regulated entities) or Nigeria's CRF-NCS (a hard February 2027 deadline for telecom providers), both of which are less structurally elegant than Brunei's five-phase framework but carry actual legal force within their scope. Brunei's framework reads like the clearest explanation of how to migrate on this entire tracker -- it just doesn't require anyone to.

Brunei's monetary authority, Autoriti Monetari Brunei Darussalam (AMBD), hasn't closed that gap either. No AMBD circular or guidance addresses post-quantum cryptography or cryptographic inventory specifically; banking-sector organizations in Brunei fall under CSB's general framework rather than a distinct, potentially more binding financial-regulator mandate, the pattern several other countries on this tracker eventually develop (Kuwait's CORF, Israel's Bank of Israel directive, Singapore's MAS track).

What to do with this

If you're a government agency, CIIO, or private-sector organization operating in Brunei, CSB's five-phase structure is worth following as a genuinely useful methodology regardless of its non-binding status -- Assess, Select, Validate, Deploy, Monitor is a clean, auditable sequence that maps well onto how a real migration project gets run internally, even without a regulator checking your work. The Assess phase is where to start, and it means the same thing here it means everywhere else on this tracker: a real, current account of where cryptography runs in your systems, not a plan to find out eventually.

The Brunei country page tracks the framework with its primary source.