Has Canada's Treasury Board issued a binding post-quantum cryptography policy?

Yes, since 9 October 2025. It's a Security Policy Implementation Notice (SPIN), "Migrating the Government of Canada to Post-Quantum Cryptography," and it's binding on every Government of Canada information system -- departmental or enterprise -- that employs cryptography, up to and including systems handling Protected B information.

Why do so many summaries still describe this as forthcoming?

The Canadian Centre for Cyber Security's technical roadmap, ITSM.40.001, states that Treasury Board "will issue the necessary policy instruments" -- future tense. That sentence predates the SPIN's actual publication and was never updated in most places it gets quoted, so the forthcoming framing has outlived the thing it was describing by a year.

What are the Government of Canada's PQC deadlines?

Four dates: by 1 April 2026, departments need a high-level PQC migration plan and must begin annual progress reporting, and new contracts with a digital component must include a PQC procurement clause. By 1 April 2028, departments update their IT system records with cryptographic details and begin migrating identified high-priority systems. By end of 2031, high-priority systems must be fully migrated. By end of 2035, everything else must be.

Does the SPIN require a cryptographic inventory?

In substance, yes, though not by that name. By 1 April 2028, departments must update records in Treasury Board's Application Portfolio Management tool with architecture, cryptographic algorithms, vendor information, contract expiry dates, and migration status, for every in-scope system. That's a cryptographic bill of materials under a different label.

What happens if a department misses a deadline?

Treasury Board monitors departmental progress directly and can escalate through its Framework for the Management of Compliance. No specific monetary penalty is named in the SPIN itself, but non-compliance with a Treasury Board policy instrument is a real administrative matter for a federal department, distinct from a voluntary roadmap being ignored.

Is OSFI's financial-sector guidance the same thing?

No -- it's a parallel, separately binding track. OSFI's March 2026 Technology Risk Bulletin requires federally regulated banks and insurers to maintain a centralized cryptographic-asset inventory and reach quantum readiness by 2035. It applies to supervised financial institutions, not government departments, and the two instruments run independently of each other.

pqccbomcanadatbscccsprocurement

Canada's 'Forthcoming' PQC Mandate Has Been in Force Since October 2025

Treasury Board's binding policy instrument for post-quantum migration -- the one everyone describes as still coming -- was issued a year ago. It already requires a PQC procurement clause in every new digital contract.

PQC Security EditorialOctober 18, 20264 min read

If you've read anything about Canada's post-quantum cryptography plans in the last year, there's a reasonable chance it told you Treasury Board "will issue" the policy instrument that makes migration mandatory. That sentence was true when the Canadian Centre for Cyber Security wrote it. It stopped being true on 9 October 2025.

The document everyone's still waiting for already exists

CCCS's ITSM.40.001, "Roadmap for the Migration to Post-Quantum Cryptography for the Government of Canada," is the technical document most coverage of Canada's PQC policy cites. It sets three dates -- departmental migration plans by April 2026, high-priority systems by end-2031, remaining systems by end-2035 -- and then adds a line that's done a lot of work in shaping how people describe Canada's position: Treasury Board of Canada Secretariat (TBS) "will issue the necessary policy instruments to require responsible officials to establish a departmental PQC migration plan."

Future tense. Something still to come.

Except TBS issued it on 9 October 2025: a Security Policy Implementation Notice (SPIN) titled "Migrating the Government of Canada to Post-Quantum Cryptography." Its scope statement is unambiguous:

"This SPIN is applicable to any GC information system (departmental or enterprise) that employs cryptography."

That covers systems up to and including Protected B; departments running Protected C or classified systems are routed to the Cyber Centre separately. ITSM.40.001's "will issue" sentence is a year out of date everywhere it still gets quoted without a correction, and most summaries haven't caught up.

Four dates, one of them closer than it sounds

The SPIN's timeline builds on ITSM.40.001's structure but makes each stage a binding checkpoint:

1 April 2026 -- departments need a high-level PQC migration plan in place and must start annual progress reporting to TBS. Separately and easy to miss: any new contract with a digital component has to include a PQC procurement clause from this date forward. That's not a future compliance exercise -- it's a clause that needs to be in contracts being negotiated right now.

1 April 2028 -- departments update their IT system records in TBS's Application Portfolio Management tool: architecture, cryptographic algorithms, vendor information, contract expiry, migration status. For every in-scope system. That's a cryptographic inventory, reframed as a records-management exercise, which is often how government mandates arrive -- not labeled "CBOM," but asking for exactly what a CBOM contains.

End of 2031 -- high-priority systems fully migrated.

End of 2035 -- everything else.

TBS states directly that it will monitor departmental progress and escalate missed deadlines through its Framework for the Management of Compliance -- a real accountability mechanism, distinct from ITSM.40.001 simply being good advice a department could set aside.

Why the distinction matters

ITSM.40.001 is still the right document to read for the technical roadmap -- risk categorization, algorithm guidance, migration sequencing. But it's guidance from Canada's technical cybersecurity authority, not a policy instrument with compliance teeth. The SPIN is what converts "recommends" into "applicable to any GC information system... that employs cryptography," with a named enforcement path.

If you're advising a federal department, a contractor selling into government, or just trying to get Canada's PQC posture right in a comparison with other countries, the difference between "CCCS recommends, TBS will eventually require" and "TBS already requires, here's the compliance framework" is the difference between a watch item and an active obligation.

The financial sector runs on a separate track

OSFI's March 2026 Technology Risk Bulletin asks federally regulated banks and insurers for the same underlying thing -- a centralized inventory of cryptographic assets, including algorithms, protocols, keys, certificates, secrets, and third-party dependencies -- with quantum readiness targeted across all systems by 2035. It's not derived from the TBS SPIN and doesn't apply to it; it's OSFI's own supervisory instrument for a different population. A bank reading only the government-systems story and assuming it doesn't apply to them would be right about scope and wrong about whether they have an obligation at all.

What to do with this

If you're a Government of Canada department, check whether your contracts since April 2026 actually carry the PQC procurement clause the SPIN requires -- this is the kind of requirement that's easy to miss if procurement and IT security aren't talking to each other. If you're a federal contractor, the SPIN reaches you through that clause before it reaches you any other way. If you're a federally regulated financial institution, OSFI's bulletin is your actual obligation, and it runs on its own clock.

In both cases, the practical first step is the same one the SPIN's 2028 milestone is really asking for: a real, current inventory of where cryptography actually lives in your systems and your vendors' systems, not a plan to go find out eventually.

The Canada country page tracks both instruments with their primary sources.

Frequently asked questions

Has Canada's Treasury Board issued a binding post-quantum cryptography policy?: Yes, since 9 October 2025. It's a Security Policy Implementation Notice (SPIN), "Migrating the Government of Canada to Post-Quantum Cryptography," and it's binding on every Government of Canada information system -- departmental or enterprise -- that employs cryptography, up to and including systems handling Protected B information.
Why do so many summaries still describe this as forthcoming?: The Canadian Centre for Cyber Security's technical roadmap, ITSM.40.001, states that Treasury Board "will issue the necessary policy instruments" -- future tense. That sentence predates the SPIN's actual publication and was never updated in most places it gets quoted, so the forthcoming framing has outlived the thing it was describing by a year.
What are the Government of Canada's PQC deadlines?: Four dates: by 1 April 2026, departments need a high-level PQC migration plan and must begin annual progress reporting, and new contracts with a digital component must include a PQC procurement clause. By 1 April 2028, departments update their IT system records with cryptographic details and begin migrating identified high-priority systems. By end of 2031, high-priority systems must be fully migrated. By end of 2035, everything else must be.
Does the SPIN require a cryptographic inventory?: In substance, yes, though not by that name. By 1 April 2028, departments must update records in Treasury Board's Application Portfolio Management tool with architecture, cryptographic algorithms, vendor information, contract expiry dates, and migration status, for every in-scope system. That's a cryptographic bill of materials under a different label.
What happens if a department misses a deadline?: Treasury Board monitors departmental progress directly and can escalate through its Framework for the Management of Compliance. No specific monetary penalty is named in the SPIN itself, but non-compliance with a Treasury Board policy instrument is a real administrative matter for a federal department, distinct from a voluntary roadmap being ignored.
Is OSFI's financial-sector guidance the same thing?: No -- it's a parallel, separately binding track. OSFI's March 2026 Technology Risk Bulletin requires federally regulated banks and insurers to maintain a centralized cryptographic-asset inventory and reach quantum readiness by 2035. It applies to supervised financial institutions, not government departments, and the two instruments run independently of each other.