Does the Philippines require a cryptographic inventory or CBOM?

No. DICT's National Cybersecurity Plan 2023-2028 mandates a software bill of materials (SBOM) for government software procurement -- a real, binding clause -- but an SBOM lists software components, not cryptographic ones, so it does not satisfy a CBOM requirement.

Does BSP Circular No. 1213 set a quantum-safe deadline for Philippine banks?

No. That claim circulates in vendor and consultant coverage, but the circular's own text, read directly, contains zero occurrences of 'quantum' or 'post-quantum.' Its only cryptography-adjacent clause concerns passwordless authentication (FIDO, biometrics, hardware tokens) under the Anti-Financial Account Scamming Act, unrelated to algorithm migration.

What does the Philippines' National Cybersecurity Plan say about quantum computing?

One sentence, using the softest available language: DICT 'may seek assistance in defining' an acceptable cryptographic standard for asymmetric key encryption, given that quantum computers can theoretically use Shor's algorithm against current factorization-based schemes. That is a stated future intention to seek help defining a standard, not a standard, timeline, or mandate.

Has any Philippine regulator published a PQC migration deadline?

No. Neither DICT, BSP, the National Telecommunications Commission, nor CERT-PH has published a PQC-specific deadline, mandate, or inventory requirement. NTC's only connection is a June 2026 exploratory meeting between its director and the Quantum Computing Society of the Philippines, described by the Society itself as stakeholder engagement, not regulatory action.

Is the Philippines' SBOM requirement enforced?

It is a binding procurement clause -- 'government agencies shall require a software bill of materials' -- backed by the National Cybersecurity Plan's Executive Order authority, which makes it one of the more concrete software-supply-chain requirements in Southeast Asia. It simply isn't a cryptographic inventory.

Where should organizations in the Philippines look for PQC signals?

DICT's own future technical-paper output on cryptographic standards, since that's the only body with a stated (if vague) commitment. BSP, NTC, and CERT-PH have each been checked directly and have published nothing PQC-specific as of this review.

pqccbomsbomphilippinesdictbsp

The Philippines Mandated a Bill of Materials for Government Software -- Just Not the Cryptographic Kind

DICT's National Cybersecurity Plan requires an SBOM for government procurement and floats future crypto-standard work, but a widely-cited BSP circular said to set a quantum-safe deadline contains zero occurrences of the word 'quantum.'

PQC Security EditorialOctober 18, 20264 min read

A software bill of materials and a cryptographic bill of materials sound like they should be close cousins. In the Philippines' only binding bill-of-materials clause, they are not the same thing at all -- and a popular claim about the country's central bank conflates a different kind of mandate entirely.

What DICT actually mandated

The Department of Information and Communications Technology's National Cybersecurity Plan 2023-2028, published February 2024 under its own Executive Order authority, contains a real, binding clause: "government agencies shall require a software bill of materials" for software procurement. That's a genuine SBOM mandate -- a list of the software components (libraries, dependencies, versions) that make up a piece of software, which matters for tracking known vulnerabilities in those components.

It is not a cryptographic bill of materials. An SBOM doesn't tell you which algorithm a TLS handshake uses, which key sizes a certificate chain relies on, or which systems are still running RSA-2048 where a quantum-resistant algorithm would eventually be needed. Those are CBOM questions, and the Plan's SBOM clause doesn't answer them.

The one sentence on quantum computing

Buried in the same plan is a single sentence that actually names quantum computing as a reason for future action: DICT "may seek assistance in defining what would be the nationally acceptable crypto-primitive and protocol that can be used in asymmetric key encryption used in key exchanges given that quantum computers can now theoretically use Shor's Algorithm to solve the reverse factorization problem of very large prime numbers."

Every modal verb in that sentence is doing defensive work. "May seek assistance in defining" is about as far from a mandate as formal government prose gets -- it commits DICT to nothing beyond considering whether to ask for help picking a standard, at some unspecified point, with no year attached.

The circular that doesn't say what it's cited for

Separately, a claim circulates in vendor blog posts and some news coverage that BSP (Bangko Sentral ng Pilipinas) Circular No. 1213, Series of 2025, sets a "quantum-safe deadline" for Philippine banks. Reading the circular's actual text rules this out directly: it contains zero occurrences of "quantum" or "post-quantum," anywhere.

What Circular 1213 actually does is amend the central bank's IT Risk Management framework to implement Section 6 of the Anti-Financial Account Scamming Act (AFASA). Its cryptography-adjacent content is about passwordless authentication methods -- FIDO, biometrics, hardware security tokens -- as an anti-fraud measure against account takeover scams. That's a real, binding circular with a real deadline. It has nothing to do with post-quantum algorithm migration, and treating it as PQC guidance will leave an organization with exactly the wrong compliance checklist.

What's still missing

No Philippine regulator -- DICT, BSP, the National Telecommunications Commission, or CERT-PH -- has published a cryptographic inventory requirement, a PQC migration deadline, or a defined compliance scope. NTC's only documented connection to the topic is a June 2026 meeting between its director and the Quantum Computing Society of the Philippines, which the Society itself describes as exploratory stakeholder engagement rather than regulatory action. CERT-PH's own site search for "quantum" returns no results.

What to do with this

If you operate in the Philippines, the SBOM clause is real and worth complying with on its own terms for government procurement -- but don't let it stand in for cryptographic inventory work, and don't cite BSP 1213 as a reason to prioritize PQC migration internally, since it won't survive a compliance audit asking for the actual clause. The honest status is that DICT's own plan is the closest thing to a signal, and it's a soft one: watch for the technical papers it describes, since that's the only concretely promised deliverable on the table.

The Philippines country page tracks DICT's plan, BSP's circular, and the regulators checked with no publication, each against primary sources.

Frequently asked questions

Does the Philippines require a cryptographic inventory or CBOM?: No. DICT's National Cybersecurity Plan 2023-2028 mandates a software bill of materials (SBOM) for government software procurement -- a real, binding clause -- but an SBOM lists software components, not cryptographic ones, so it does not satisfy a CBOM requirement.
Does BSP Circular No. 1213 set a quantum-safe deadline for Philippine banks?: No. That claim circulates in vendor and consultant coverage, but the circular's own text, read directly, contains zero occurrences of 'quantum' or 'post-quantum.' Its only cryptography-adjacent clause concerns passwordless authentication (FIDO, biometrics, hardware tokens) under the Anti-Financial Account Scamming Act, unrelated to algorithm migration.
What does the Philippines' National Cybersecurity Plan say about quantum computing?: One sentence, using the softest available language: DICT 'may seek assistance in defining' an acceptable cryptographic standard for asymmetric key encryption, given that quantum computers can theoretically use Shor's algorithm against current factorization-based schemes. That is a stated future intention to seek help defining a standard, not a standard, timeline, or mandate.
Has any Philippine regulator published a PQC migration deadline?: No. Neither DICT, BSP, the National Telecommunications Commission, nor CERT-PH has published a PQC-specific deadline, mandate, or inventory requirement. NTC's only connection is a June 2026 exploratory meeting between its director and the Quantum Computing Society of the Philippines, described by the Society itself as stakeholder engagement, not regulatory action.
Is the Philippines' SBOM requirement enforced?: It is a binding procurement clause -- 'government agencies shall require a software bill of materials' -- backed by the National Cybersecurity Plan's Executive Order authority, which makes it one of the more concrete software-supply-chain requirements in Southeast Asia. It simply isn't a cryptographic inventory.
Where should organizations in the Philippines look for PQC signals?: DICT's own future technical-paper output on cryptographic standards, since that's the only body with a stated (if vague) commitment. BSP, NTC, and CERT-PH have each been checked directly and have published nothing PQC-specific as of this review.