Vietnam's PQC Plan Isn't About Migration. It's About Not Depending on Anyone Else's Cryptography.

Every national PQC roadmap on this tracker answers the same question: by when, and with which algorithms, do our systems stop using cryptography that quantum computers will eventually break. Vietnam's answer includes that question, but it isn't really the point. The point, stated directly in the plan's own objectives, is that Vietnam doesn't want to depend on anyone else's cryptography to answer it.

A plan with an industrial-policy objective, not just a security one

Vietnam's Deputy Prime Minister Phan Văn Giang signed Decision No. 125/QĐ-TTg on 6 July 2026, approving a national plan titled "Developing quantum-resistant (post-quantum) cryptography systems for the period 2026-2035." The Authority of Information Security, under the Government Cipher Committee (Ban Cơ yếu Chính phủ), frames the plan's purpose as protecting national digital sovereignty and ensuring the safety of critical information systems.

Its stated objectives run wider than a migration timeline:

• Mastering core PQC and quantum-key-distribution (QKD) technologies
• Upgrading national cryptographic infrastructure
• Building technical standards and legal frameworks for safe migration
• Developing a "Make in Vietnam" cryptographic product ecosystem

That last objective is the one that separates Vietnam's plan from every comparable document on this tracker. The EU's roadmap, the UK's NCSC timeline, Germany's new guideline, Canada's TBS policy -- all of them tell organizations which algorithms to adopt and by when. None of them make building a domestic industry capable of producing that cryptography a stated national objective in its own right. Vietnam's does, explicitly, in the same decision that sets the migration period.

What that framing tells you about the real audience

Read as a security document, Decision 125 is thin on the specifics that matter to a compliance team -- no named algorithm standard, no cryptographic-inventory requirement, no stated penalty for non-compliance in the text available. Read as an industrial and sovereignty document, those gaps make more sense: the plan isn't primarily written for organizations that need a migration checklist. It's written to direct state resources toward building the technical and manufacturing capability to produce quantum-resistant cryptographic products domestically, with the migration itself as one output of that capability rather than the sole objective.

That's a meaningfully different strategic posture than "adopt NIST's algorithms by this date," and it's worth understanding on its own terms rather than scoring it only against a migration-deadline rubric built for other countries' roadmaps.

What the plan doesn't yet specify

The available text names no specific post-quantum algorithm standard -- no ML-KEM, no ML-DSA, nothing from NIST's family or an alternative national standard. It names no cryptographic-inventory or CBOM requirement for any organization. And while Decision 125 is a real, signed government instrument with a named administering authority, the evidence available describes no enforcement mechanism -- no fine, audit, or certification tied to any specific entity's compliance.

The 2026-2035 window is explicit and bounded, directly in the plan's own title, which gives it real deadline concreteness even without the enforcement detail. Whether that window attaches to binding obligations for specific sectors, or remains a strategic government commitment that sectoral regulators eventually build on -- the pattern Poland, India, and several other countries on this tracker have followed -- is the open question for Vietnam's next regulatory step.

What to do with this

If you operate critical information systems in Vietnam, or sell cryptographic products into the Vietnamese market, Decision 125 signals where state priority and likely future procurement preference are heading -- toward domestically capable quantum-resistant cryptography, not just imported compliance with international standards. That's a different planning consideration than a pure migration deadline: it suggests Vietnam's regulatory environment may eventually favor organizations that can demonstrate domestic cryptographic capability or partnership, alongside whatever migration timeline eventually gets attached to specific sectors.

The Vietnam country page tracks Decision 125 with its primary source.