Does Malaysia have a post-quantum cryptography migration deadline?

No. A full read of MyKriptografi, Malaysia's National Cryptography Policy, found zero occurrences of "quantum-safe" and found the year 2030 only in references to unrelated national plans. CyberSecurity Malaysia's PQC Migration Framework cites 2030 and 2035 only as Gartner's and the NSA's own timelines, not Malaysian commitments. No primary Malaysian document sets a national PQC deadline, despite this being widely reported otherwise.

What is MyKriptografi?

Malaysia's National Cryptography Policy, approved by Cabinet on 28 November 2025, succeeding the 2013 version. It's organized into four pillars and twelve strategies, with real binding force limited to one narrow area: PKTN-certified cryptographic product use is mandatory for Official Secrets and classified NCII-entity data, and merely "encouraged" for everything else.

Malaysia's National Trusted Cryptographic Algorithm List, maintained by CyberSecurity Malaysia, and the country's most concrete post-quantum step. Its approved list (AKSA MySEAL 2.1) includes ML-KEM, ML-DSA, SLH-DSA, Classic McEliece, FrodoKEM, HQC, NTRU, and Falcon -- broader than NIST's own standardized set. MyKriptografi, the national policy, never mentions MySEAL by name.

Is Malaysia's PQC Migration Framework mandatory?

Unknown from the document itself -- the words "mandatory" and "voluntary" do not appear in it anywhere. It's served publicly without authentication from CyberSecurity Malaysia's own site, but every page is stamped "RESTRICTED" with a confidentiality notice, an unresolved contradiction between its access and its classification.

Does Malaysia's Cyber Security Act 2024 regulate cryptography?

Not directly. A full-text search of Act 854 found zero occurrences of "cryptography," "cryptographic," "quantum," "algorithm," "inventory," or "bill of materials." Its only encryption-related provision is a search-and-seizure power compelling decryption codes. The Act does provide an indirect route: NCII sector leads can write cryptographic requirements into mandatory sector codes of practice -- but no published sector code mandating PQC migration was found.

pqccbommalaysianacsamysealact-854

Malaysia Has Four Real PQC Documents. None of Them Talk to Each Other.

A national cryptography policy, an approved algorithm list broader than NIST's own, a migration framework stamped RESTRICTED, and a cybersecurity law with a real enforcement mechanism -- none naming the others, and none setting a deadline.

PQC Security EditorialOctober 18, 20265 min read

Malaysia has done more documented PQC groundwork than most countries on this tracker -- a national cryptography policy, a national algorithm list broader than NIST's own, a five-phase migration framework, and a cybersecurity law with real enforcement teeth. Read them together and the pattern that emerges isn't coordination. It's four separate institutional efforts that don't cite each other, leaving no single place where a Malaysian organization can find a binding deadline, because no one piece of the system was written to connect to the others.

The policy that doesn't mention the algorithm list

MyKriptografi, Malaysia's National Cryptography Policy, was approved by Cabinet on 28 November 2025, succeeding the 2013 version, with forewords from the Prime Minister and the Director General of National Security. It's organized into four pillars and twelve strategies, and its one real binding clause is narrow: Part 7 states that PKTN-certified cryptographic product use is mandatory for dealings involving Official Secrets and classified NCII-entity data, and merely encouraged everywhere else.

We read the full policy PDF directly. The year 2030 appears exactly three times -- none of them a post-quantum migration target, all of them references to unrelated national plans (the 13th Malaysia Plan, the Malaysia Cyber Security Strategy 2025-2030). The phrase "quantum-safe" never appears. This is worth stating plainly because it's often reported otherwise: Malaysia's national cryptography policy commits to a future post-quantum readiness plan, not to a post-quantum deadline.

More tellingly, MyKriptografi never mentions MySEAL -- Malaysia's own National Trusted Cryptographic Algorithm List -- by name, even though MySEAL is the single most concrete post-quantum artifact Malaysia has produced.

The algorithm list that's broader than NIST's

MySEAL, maintained by CyberSecurity Malaysia, is where Malaysia's actual technical PQC work lives. Its approved list (AKSA MySEAL 2.1) includes, as post-quantum key encapsulation mechanisms: ML-KEM (512, 768, 1024), Classic McEliece, FrodoKEM and eFrodoKEM, HQC, NTRU-HPS and NTRU-HRSS. As digital signature schemes: ML-DSA (44, 65, 87), SLH-DSA in both variants, and Falcon, plus stateful hash-based signatures LMS, XMSS, and XMSS-MT listed separately.

That's a genuinely more expansive list than NIST's own three standardized algorithms -- Malaysia has evaluated and approved alternatives NIST hasn't standardized, giving organizations more options than most countries' guidance provides. It's a real technical achievement, sitting entirely outside the national policy document that's supposed to set cryptography strategy.

The framework stamped RESTRICTED and served to anyone

CyberSecurity Malaysia separately publishes a Post-Quantum Cryptography Migration Framework, addressed to government agencies, critical infrastructure operators, and private organizations, with a genuinely useful five-phase structure: Preparation, Algorithm Selection and Standardisation, Validation and Pilot, Implementation, Monitoring and Resilience. Its first phase is where Malaysia's cryptographic inventory requirement actually lives:

"Create a detailed inventory of all cryptographic assets, including encryption protocols, key management systems, and sensitive data... a full inventory ensures that no vulnerable cryptographic systems are overlooked."

That's real, specific, and useful -- and the document's own legal status is unresolved. The words "mandatory" and "voluntary" appear nowhere in it. It's served publicly, with no authentication wall, directly from CyberSecurity Malaysia's own site -- and every page carries a "RESTRICTED" stamp and a confidentiality notice. Those two facts contradict each other, and the document doesn't explain which one governs.

The law with teeth that doesn't mention cryptography

Malaysia's Cyber Security Act 2024 (Act 854) gets cited as the legal backing for MyKriptografi. We searched the Act's full text as published by the Attorney General's Chambers. It contains zero occurrences of "cryptography," "cryptographic," "quantum," "algorithm," "inventory," or "bill of materials." Its only encryption-adjacent provision is a search-and-seizure power compelling disclosure of decryption codes -- unrelated to migration policy.

What Act 854 does provide is a real mechanism, just not yet used for this purpose: under section 25(1), each of the Act's eleven National Critical Information Infrastructure (NCII) sector leads must prepare a code of practice specifying cybersecurity measures and standards for that sector, and under section 21(1)-(2), NCII entities must implement what their sector code specifies, with alternatives permitted only if proven equivalent or stronger. Cryptographic requirements can become binding in Malaysia through this route -- but no published sector code mandating post-quantum migration currently exists.

What to do with this

If you operate in Malaysia, don't wait for a single document to tell you what's required -- none of the four currently does, together or separately. Use MySEAL's approved algorithm list as your technical reference (it's genuinely more complete than most countries' guidance), treat the Migration Framework's five-phase structure and inventory requirement as the practical methodology worth following regardless of its unresolved legal status, and watch for an NCII sector code of practice under Act 854 as the most likely vehicle for an actual binding deadline to eventually arrive.

The inventory work the Migration Framework asks for in Phase 1 is the same foundational step worth starting now, independent of which document eventually becomes the one with legal force.

The Malaysia country page tracks all four documents with their primary sources.

Frequently asked questions

Does Malaysia have a post-quantum cryptography migration deadline?: No. A full read of MyKriptografi, Malaysia's National Cryptography Policy, found zero occurrences of "quantum-safe" and found the year 2030 only in references to unrelated national plans. CyberSecurity Malaysia's PQC Migration Framework cites 2030 and 2035 only as Gartner's and the NSA's own timelines, not Malaysian commitments. No primary Malaysian document sets a national PQC deadline, despite this being widely reported otherwise.
What is MyKriptografi?: Malaysia's National Cryptography Policy, approved by Cabinet on 28 November 2025, succeeding the 2013 version. It's organized into four pillars and twelve strategies, with real binding force limited to one narrow area: PKTN-certified cryptographic product use is mandatory for Official Secrets and classified NCII-entity data, and merely "encouraged" for everything else.
What is MySEAL?: Malaysia's National Trusted Cryptographic Algorithm List, maintained by CyberSecurity Malaysia, and the country's most concrete post-quantum step. Its approved list (AKSA MySEAL 2.1) includes ML-KEM, ML-DSA, SLH-DSA, Classic McEliece, FrodoKEM, HQC, NTRU, and Falcon -- broader than NIST's own standardized set. MyKriptografi, the national policy, never mentions MySEAL by name.
Is Malaysia's PQC Migration Framework mandatory?: Unknown from the document itself -- the words "mandatory" and "voluntary" do not appear in it anywhere. It's served publicly without authentication from CyberSecurity Malaysia's own site, but every page is stamped "RESTRICTED" with a confidentiality notice, an unresolved contradiction between its access and its classification.
Does Malaysia's Cyber Security Act 2024 regulate cryptography?: Not directly. A full-text search of Act 854 found zero occurrences of "cryptography," "cryptographic," "quantum," "algorithm," "inventory," or "bill of materials." Its only encryption-related provision is a search-and-seizure power compelling decryption codes. The Act does provide an indirect route: NCII sector leads can write cryptographic requirements into mandatory sector codes of practice -- but no published sector code mandating PQC migration was found.
Does Malaysia require a cryptographic inventory?: The PQC Migration Framework's first phase calls for organizations to "create a detailed inventory of all cryptographic assets, including encryption protocols, key management systems, and sensitive data" -- a real, specific requirement, but inside a document whose mandatory-or-voluntary status is itself unstated.