Does Brunei have a post-quantum cryptography (PQC) law?

No. Nothing published for Brunei carries statutory force for post-quantum cryptography as of this page's last review. What exists is non-binding guidance, set out with its primary sources below. The lead body is Cyber Security Brunei (CSB).

What is Brunei's PQC migration deadline?

2035. See the sources below for what this deadline actually covers, since it may apply only to specific sectors or system types. The deadline came from Cyber Security Brunei (CSB).

Does Brunei require a Cryptographic Bill of Materials (CBOM)?

Not as a requirement. Cryptographic inventory work does appear in the sources listed on this page, but none of it creates an obligation to produce or report one. The score rationale below quotes exactly what each source says.

BNGuidance

Brunei

Cyber Security Brunei published a national Post-Quantum Cryptography Migration Framework in mid-2026, a risk-based five-phase roadmap for government, critical infrastructure, and the private sector, with 2030 and 2035 target years but no binding mandate or CBOM requirement.

Brunei's post-quantum cryptography posture is classified as guidance, led by Cyber Security Brunei (CSB), with a migration target of 2035. It scores 46/100 on this tracker's rubric, a moderately binding rule, with real gaps in scope or enforcement, and that is not a measure of how secure or advanced the country actually is.

What's verified

Cyber Security Brunei (CSB) published a "Post-Quantum Cryptography Migration Framework," first previewed as a draft at the STACK 2026 technology event (8-10 June 2026) and released as a finalized resource on CSB's website shortly after. The framework sets out "a structured, risk-based five-phase migration strategy (Assess, Select, Validate, Deploy, and Monitor)," aimed at Brunei's Government agencies, Critical Information Infrastructure Owners (CIIOs), and private-sector organizations. It directs organizations to "begin migration without delay, deprecate vulnerable algorithms by 2030, and complete full migration by 2035."

The document is guidance rather than binding law: it "guides" organizations through the migration process and carries no penalty clause, reporting mandate, or certification requirement in its published text. It is, however, a real, dated, national framework from Brunei's named cybersecurity authority, not a draft, an academic paper, or a vendor initiative, and it sits permanently in CSB's public resources alongside the country's National Cyber Security Strategy.

Score rationale

Each axis is scored 0–20 against the primary sources listed on this page. See the methodology for what each axis measures and how scores are derived.

Axis	Score	Why
Mandate strength	6/20	CSB's own framework describes itself as guidance that 'guides organisations' through a migration strategy, with no statute, regulation, or penalty clause referenced anywhere in the document; it earns a mid-range rather than a floor score only because it is a real, named national framework, not an academic paper or vendor whitepaper.
Deadline concreteness	14/20	The framework names two specific years directly: deprecate vulnerable algorithms by 2030 and complete full migration by 2035, meeting most of the bar for a specific published timeline, though it does not break either target into dated interim phase-gates within the five-phase strategy.
Scope of coverage	14/20	The framework explicitly covers three named groups: Government agencies, Critical Information Infrastructure Owners (CIIOs), and private-sector organisations, which is broad and economy-relevant coverage, though it is presented as a roadmap rather than a formal regulation with a defined regulated population.
Inventory/CBOM requirement	4/20	The framework's first phase, 'Assess,' implies organizations will need to inventory their cryptographic usage before selecting a migration path, but the document does not name a cryptographic inventory or CBOM requirement explicitly or specify what an assessment must record.
Regulatory activity	8/20	Cyber Security Brunei, the national cybersecurity authority, is clearly named as the issuing body and the framework sits alongside Brunei's National Cyber Security Strategy as a permanent published resource, but the document itself describes no enforcement mechanism, reporting obligation, or compliance check.
Total	46/100	A blunt sum of the five columns to its left.

Related regulators

Sector bodies checked independently, not assumed from the primary source above.

Autoriti Monetari Brunei Darussalam (AMBD)
Not yet addressed, a gap to watch
Not yet addressed with its own publication. No AMBD-issued circular or guidance specifically addressing post-quantum cryptography or cryptographic inventory was located; banking-sector organizations fall under CSB's general framework above rather than a distinct financial-regulator mandate.

FAQ: Brunei and PQC

Does Brunei have a post-quantum cryptography (PQC) law?: No. Nothing published for Brunei carries statutory force for post-quantum cryptography as of this page's last review. What exists is non-binding guidance, set out with its primary sources below. The lead body is Cyber Security Brunei (CSB).
What is Brunei's PQC migration deadline?: 2035. See the sources below for what this deadline actually covers, since it may apply only to specific sectors or system types. The deadline came from Cyber Security Brunei (CSB).
Does Brunei require a Cryptographic Bill of Materials (CBOM)?: Not as a requirement. Cryptographic inventory work does appear in the sources listed on this page, but none of it creates an obligation to produce or report one. The score rationale below quotes exactly what each source says.