Does Malaysia have a post-quantum cryptography (PQC) law?

Partially. The rule is binding for a specific regulated subset, not the whole economy. The issuing body is National Cyber Security Agency (NACSA), Malaysia.

What is Malaysia's PQC migration deadline?

None. No migration deadline has been published for Malaysia by any regulator we checked, including National Cyber Security Agency (NACSA), Malaysia.

Does Malaysia require a Cryptographic Bill of Materials (CBOM)?

Not in national policy, but yes in national guidance. MyKriptografi contains no inventory requirement at all: the words "inventory" and "inventori" never appear in it, nor does CBOM. One level down, CyberSecurity Malaysia's PQC Migration Framework opens Phase 1 with a detailed inventory of all cryptographic assets. That framework never states its own legal status, so treat it as expected practice rather than an enforceable duty.

MYGuidance

Malaysia

Malaysia's Cabinet approved MyKriptografi, the National Cryptography Policy, on 28 November 2025. It carries a genuine mandatory tier — national trusted cryptographic products are mandatory for Official Secrets and for NCII entities' classified data — but it sets no post-quantum migration deadline and never asks for a cryptographic inventory. Separately, CyberSecurity Malaysia has published a five-phase PQC Migration Framework whose first phase requires a cryptographic asset inventory, and Malaysia's national trusted algorithm list already includes the NIST post-quantum standards.

Malaysia's post-quantum cryptography posture is classified as guidance, led by National Cyber Security Agency (NACSA), Malaysia. It scores 35/100 on this tracker's rubric, an early-stage or narrowly-scoped rule, and that is not a measure of how secure or advanced the country actually is.

What's verified

Malaysia's Cabinet approved MyKriptografi, the National Cryptography Policy, on 28 November 2025, succeeding the 2013 National Cryptography Policy (DKN 2013). The policy carries forewords from the Prime Minister and the Director General of National Security, and is published in full by NACSA in Bahasa Malaysia.

It is organised into four Teras (pillars), supported by twelve strategies:

Protecting the confidentiality, integrity, authenticity, and non-repudiation of Government, NCII entity, and individual data — through cryptography governance, strengthened legislation and guidelines, and agile research organisations.
Building capacity in organisations and human capital, through collaboration, talent development and retention, and market creation.
Increasing adoption of PKTN (Produk Kriptografi Terpercaya Negara, National Trusted Cryptographic Products) among NCII entities and industry. Its third strategy is the development of a post-quantum cryptography readiness plan.
Sustaining national cyber security through research, development, commercialisation, and innovation, including management of emerging cryptographic technologies.

What is actually mandatory

MyKriptografi is more than an aspirational document, but its binding force applies to product choice rather than to post-quantum migration.

Part 7 of the policy (Pemakaian Dasar) states that use of PKTN-certified cryptographic products is mandatory (Mandatori) in dealings involving Official Secrets (Rahsia Rasmi), and mandatory for dealings involving classified data of NCII entities. For everything else, it is encouraged (Digalakkan). The policy applies to Cryptography Technology Service Providers.

So an NCII entity handling classified data must use nationally certified cryptographic products. Nothing in the policy requires that entity to migrate to post-quantum algorithms by any date.

There is no Malaysian PQC deadline

This is worth stating plainly, because it is often reported otherwise.

We read the full MyKriptografi policy PDF. The year 2030 appears exactly three times, and not once as a post-quantum migration target: once referring to the 13th Malaysia Plan (2026–2030), and twice to the Malaysia Cyber Security Strategy 2025–2030, which MyKriptografi is described as supporting. The phrase "quantum-safe" does not appear in the document.

CyberSecurity Malaysia's PQC Migration Framework likewise sets no national deadline. Its only mention of 2030 cites Gartner's crypto-agility timeline, and its only mention of 2035 cites the NSA's CNSA 2.0 requirements. Both are references to foreign or commercial timelines, not Malaysian commitments.

Malaysia's post-quantum language across both documents is directional: readiness for future threats, and the development of a readiness plan. A plan to make a plan is not a deadline, and this tracker does not record one for Malaysia.

MySEAL already lists the NIST post-quantum standards

Malaysia's most concrete post-quantum step is not in the policy at all. It is in MySEAL, the National Trusted Cryptographic Algorithm List (Senarai Algoritma Kriptografi Terpercaya Negara), maintained by CyberSecurity Malaysia as Secretariat.

The AKSA MySEAL 2.1 approved list includes, as post-quantum key encapsulation mechanisms: ML-KEM (512, 768, 1024), Classic McEliece, FrodoKEM and eFrodoKEM, HQC, NTRU-HPS and NTRU-HRSS. As post-quantum digital signature schemes: ML-DSA (44, 65, 87), SLH-DSA in both SHA2 and SHAKE variants, and Falcon. Stateful hash-based signatures LMS, XMSS, and XMSS-MT are listed separately.

Malaysia's list is broader than NIST's standardised set, including FrodoKEM, Classic McEliece, and Falcon alongside the three FIPS standards. It names algorithms and parameter sets without citing FIPS 203, 204, or 205.

MySEAL has two categories: AKSA (Algoritma Kriptografi Sedia Ada) for algorithms already in recognised international standards, and AKBA (Algoritma Kriptografi Baharu) for new algorithms not yet standardised, intended to give Malaysian researchers a route in. AKSA entries carry one of three statuses: Approved, Neutral, or Monitored.

Notably, MyKriptografi never mentions MySEAL by name — the policy speaks in terms of PKTN certified products, while the algorithm list sits with CyberSecurity Malaysia.

The migration framework, and where the inventory requirement lives

CyberSecurity Malaysia publishes a Post-Quantum Cryptography Migration Framework, addressed to government agencies, critical infrastructure operators in finance, energy, transportation and healthcare, and private organisations. It defines five phases:

Preparation (Assess)
Algorithm Selection and Standardisation (Select)
Validation and Pilot (Validate)
Implementation (Deploy)
Monitoring and Resilience (Monitor)

Phase 1 is where Malaysia's cryptographic inventory requirement actually lives. It calls for organisations to "create a detailed inventory of all cryptographic assets, including encryption protocols, key management systems, and sensitive data," reasoning that "a full inventory ensures that no vulnerable cryptographic systems are overlooked." Phase 1 also covers identification of critical systems, risk assessment, and assessment of external dependencies on third-party vendors and partners.

The framework ties PQC solutions to Malaysia's certification schemes — PKTN, MyCC (Malaysian Common Criteria), and MyCV (Malaysian Cybersecurity Verification) — and references a MySEAL PQC Standardisation Initiative intended to establish a comprehensive list of PQC algorithms.

Two caveats matter for anyone relying on this document. It never states whether it is mandatory or voluntary: the words "mandatory" and "voluntary" do not appear in it. And although it is served publicly and without authentication from CyberSecurity Malaysia's own site, every page is stamped "RESTRICTED" and carries a confidentiality notice.

Act 854 does not regulate cryptography

MyKriptografi is often described as being backed by the Cyber Security Act 2024 [Act 854]. The relationship is more indirect than that.

We searched the full text of the Act as published by the Attorney General's Chambers. It contains no occurrence of "cryptography", "cryptographic", "quantum", "algorithm", "inventory", or "bill of materials". Its single reference to encryption is section 46(2), a search-and-seizure provision entitling an authorised officer to be given "the necessary password, encryption code, decryption code, software or hardware" needed to comprehend seized data.

What the Act does provide is a route. Under section 25(1), an NCII sector lead must prepare a code of practice, endorsed by the Chief Executive, specifying measures, standards, and processes for that sector's cyber security. Under section 21(1), an NCII entity must implement what its sector code specifies, and under section 21(2) may substitute alternatives only by satisfying the Chief Executive that they provide equal or higher protection.

Cryptographic requirements can therefore become binding in Malaysia — but only once a sector lead writes them into its code of practice. We found no published sector code that mandates post-quantum migration.

The Act's Schedule defines eleven NCII sectors: Government; Banking and finance; Transportation; Defence and national security; Information, communication and digital; Healthcare services; Water, sewerage and waste management; Energy; Agriculture and plantation; Trade, industry and economy; and Science, technology and innovation. Section 62 lets the Chief Executive amend that Schedule by order in the Gazette.

What we checked and did not find

MyKriptografi contains no cryptographic inventory requirement, and no mention of CBOM.
MyKriptografi states no post-quantum migration deadline, and does not use the phrase "quantum-safe".
MyKriptografi does not mention MySEAL by name.
The PQC Migration Framework does not state whether it is mandatory or voluntary, and mentions neither CBOM nor Act 854 nor the NCII construct.
Act 854 contains no cryptography, quantum, or algorithm provision.
No NCII sector code of practice mandating post-quantum migration was found published.
A companion technical guide, "Recommendations for the Adoption and Implementation of Post-Quantum Cryptographic Solutions", is named on CyberSecurity Malaysia's documents page but has no download link; we could not verify its contents.

Score rationale

Each axis is scored 0–20 against the primary sources listed on this page. See the methodology for what each axis measures and how scores are derived.

Axis	Score	Why
Mandate strength	10/20	MyKriptografi is a Cabinet-approved national policy, and its application section (Bahagian 7) sets a genuine mandatory tier: use of national trusted cryptographic products (PKTN) is 'Mandatori' for dealings involving Official Secrets and for NCII entities' classified data, and 'Digalakkan' (encouraged) otherwise. That is a real obligation, but it binds product choice rather than post-quantum migration, and the policy states no penalty for non-adoption.
Deadline concreteness	0/20	No Malaysian post-quantum migration deadline exists in either primary document. MyKriptografi mentions 2030 three times, and every occurrence refers to something else: the 13th Malaysia Plan (2026-2030) and the Malaysia Cyber Security Strategy 2025-2030. The PQC Migration Framework's only 2030 is a citation of Gartner's crypto-agility timeline, and its only 2035 cites the NSA's CNSA 2.0. Neither is a Malaysian target.
Scope of coverage	10/20	MyKriptografi is addressed to Government and NCII entities, including non-NCII entities and individuals, and is built around the eleven NCII sectors defined in the Schedule to Act 854. The mandatory tier reaches only Official Secrets and NCII classified data, a defined critical subset rather than economy-wide coverage.
Inventory/CBOM requirement	5/20	MyKriptografi itself contains no cryptographic inventory requirement: the words inventori and inventory do not appear in the policy, and neither does CBOM. The requirement exists one level down, in CyberSecurity Malaysia's PQC Migration Framework, whose Phase 1 calls for a detailed inventory of all cryptographic assets. That framework never states its own legal status, so this scores as an inventory requirement that exists in guidance but not in the national policy.
Regulatory activity	10/20	NACSA is the named lead authority and operates under the Cyber Security Act 2024 [Act 854]. But the Act itself never mentions cryptography, quantum, or algorithms; its only reference to encryption is a search-and-seizure power. Binding cryptographic requirements could only arrive through an NCII sector code of practice under sections 21 and 25, and we found no published code that mandates post-quantum migration.
Total	35/100	A blunt sum of the five columns to its left.

Related regulators

Sector bodies checked independently, not assumed from the primary source above.

CyberSecurity Malaysia
Has published guidance
CyberSecurity Malaysia's Cryptography Development Department published a five-phase Post-Quantum Cryptography Migration Framework (Assess, Select, Validate, Deploy, Monitor) addressed to government agencies, critical infrastructure operators, and private organisations. Phase 1 requires a detailed inventory of all cryptographic assets, including encryption protocols, key management systems, and third-party dependencies. It also acts as MySEAL Secretariat, maintaining Malaysia's national trusted cryptographic algorithm list, which now includes ML-KEM, ML-DSA, and SLH-DSA. The framework never states whether it is mandatory or voluntary.
Post-Quantum Cryptography Migration Framework (CD-4-RPT-2724-PQCMigration-V1, 2024) →
Bank Negara Malaysia (BNM)
Not yet addressed, a gap to watch
BNM's Risk Management in Technology (RMiT) policy contains zero mentions of post-quantum cryptography or cryptographic inventory. Banking and finance is one of the eleven NCII sectors under Act 854, so BNM as sector lead has the power to write cryptographic requirements into a sector code of practice, but we found no evidence it has done so.
Securities Commission Malaysia (SC)
Not yet addressed, a gap to watch
SC's Guidelines on Technology Risk Management address general cyber risk with no PQC-specific content.
MCMC (Malaysian Communications and Multimedia Commission)
Not yet addressed, a gap to watch
MCMC's Guidelines on Information and Network Security is a general, voluntary cybersecurity framework with no post-quantum or cryptographic-inventory content.

FAQ: Malaysia and PQC

Does Malaysia have a post-quantum cryptography (PQC) law?: Partially. The rule is binding for a specific regulated subset, not the whole economy. The issuing body is National Cyber Security Agency (NACSA), Malaysia.
What is Malaysia's PQC migration deadline?: None. No migration deadline has been published for Malaysia by any regulator we checked, including National Cyber Security Agency (NACSA), Malaysia.
Does Malaysia require a Cryptographic Bill of Materials (CBOM)?: Not in national policy, but yes in national guidance. MyKriptografi contains no inventory requirement at all: the words "inventory" and "inventori" never appear in it, nor does CBOM. One level down, CyberSecurity Malaysia's PQC Migration Framework opens Phase 1 with a detailed inventory of all cryptographic assets. That framework never states its own legal status, so treat it as expected practice rather than an enforceable duty.