PHGuidancePhilippines
DICT's National Cybersecurity Plan 2023-2028 names quantum computing as the reason it will eventually define an accepted cryptographic standard, but commits only to publishing technical papers, not an algorithm, timeline, or CBOM requirement. Separately, the same plan makes a software bill of materials mandatory for government software procurement -- a binding SBOM clause, not a PQC-specific one. No Philippine regulator has published anything more concrete, and a vendor claim that a 2025 central-bank circular sets a quantum-safe deadline is not supported by that circular's own text.
Philippines's post-quantum cryptography posture is classified as guidance, led by Department of Information and Communications Technology (DICT). It scores 15/100 on this tracker's rubric, guidance only, with little binding force yet, and that is not a measure of how secure or advanced the country actually is.
What's verified
The Philippines' National Cybersecurity Plan 2023-2028, published by DICT in February 2024, contains exactly one sentence naming quantum computing, inside a section on establishing "policies, guidelines and procedures for the use of trusted and secure crypto-primitives, elements and protocols":
"As an example, the DICT, may seek assistance in defining what would be the nationally acceptable crypto-primitive and protocol that can be used in asymmetric key encryption used in key exchanges given that quantum computers can now theoretically use Shore's Algorithm to solve the reverse factorization problem of very large prime numbers."
(The document's own spelling, "Shore's Algorithm," is quoted as written.) The surrounding paragraph commits DICT to work with DOST, DTI, academia, and the private sector on cybersecurity standards generally, and to publish "technical papers" on proper crypto-primitive use, but names no target algorithm, no NIST standard, and no date. Quantum computing appears here only as one illustrative example of why a future crypto-primitive standard might matter, not as a stated policy priority in its own right.
The same plan, a few paragraphs later under "Supply Chain Security," sets a genuinely binding requirement, just not a PQC one:
"For software products, government agencies shall require a software bill of materials to determine the security of software being procured."
That is an SBOM mandate for government procurement, using "shall require." It says nothing about cryptographic components specifically and is not a CBOM clause.
What we checked and did not find
- The full 3,115-line document contains exactly one occurrence of "quantum," zero of "CBOM," and zero of any NIST post-quantum algorithm name (ML-KEM, ML-DSA, SLH-DSA, or FIPS 203/204/205).
- BSP Circular 1213, s. 2025 -- read in full -- amends IT risk management rules to require phishing-resistant authentication (FIDO, biometrics, hardware tokens) under the Anti-Financial Account Scamming Act. It contains zero occurrences of "quantum" or "post-quantum." Vendor blog coverage describing this circular as establishing a "quantum-safe deadline" is not supported by the primary text and should not be repeated as fact.
- NTC has published no circular on post-quantum cryptography. The only documented connection between NTC and PQC is a June 2026 meeting with the Quantum Computing Society of the Philippines, an industry association, described by the Society itself as an exploratory discussion. No NTC document resulted.
- CERT-PH / NCERT's own website search for "quantum" returns no results.
No Philippine regulator has published a cryptographic inventory requirement, an approved PQC algorithm, or a migration deadline as of this page's last review.
Score rationale
Each axis is scored 0–20 against the primary sources listed on this page. See the methodology for what each axis measures and how scores are derived.
| Axis | Score | Why |
|---|---|---|
| Mandate strength | 0/20 | The NCSP's cryptography clause uses 'may seek assistance in defining,' the softest modal verb in the document, for the one sentence that mentions quantum computing. Everything binding in this plan (the SBOM clause, the classification rules) is prospective process, not a PQC mandate. |
| Deadline concreteness | 0/20 | No date attaches to any cryptography-related commitment. The plan covers 2023-2028 as a whole but names no year by which a crypto-primitive standard, let alone a PQC algorithm, will exist. |
| Scope of coverage | 5/20 | The plan's cryptography-standards work is framed for government agencies broadly (DICT working with DOST, DTI, academe, and the private sector), which is wider than a single sector, but no obligation actually attaches to anyone yet -- the score reflects an intended scope, not an enforced one. |
| Inventory/CBOM requirement | 5/20 | The plan mandates a software bill of materials for government software procurement ('government agencies shall require a software bill of materials'), a real binding SBOM clause. It is not a CBOM and does not require cryptographic-component-level detail, so this scores low rather than zero. |
| Regulatory activity | 5/20 | DICT is named and has a real national plan with EO backing, but the specific cryptography commitment is to produce future technical papers, not to enforce anything. BSP and NTC were checked directly and have published nothing PQC-specific. |
| Total | 15/100 | A blunt sum of the five columns to its left. |
Related regulators
Sector bodies checked independently, not assumed from the primary source above.
- Not yet addressed, a gap to watch
BSP (Bangko Sentral ng Pilipinas)
Circular 1213, s. 2025 amends the central bank's IT Risk Management framework, and vendor coverage has described it as a "quantum-safe deadline" -- that framing does not survive contact with the primary text. We read the full circular: it contains zero occurrences of "quantum" or "post-quantum," and its only cryptography-adjacent clause defines passwordless authentication (FIDO, biometrics, hardware tokens) as an anti-fraud measure under the Anti-Financial Account Scamming Act, unrelated to algorithm migration.
- Not yet addressed, a gap to watch
NTC (National Telecommunications Commission)
No NTC circular or memorandum addresses post-quantum cryptography. The only connection found is a June 2026 meeting between NTC's director and the Quantum Computing Society of the Philippines, described by the Society itself as exploratory stakeholder engagement, not regulatory action. No document resulted from it.
- Not yet addressed, a gap to watch
CERT-PH / NCERT
The national CERT's own site search for "quantum" returns no results -- a confirmed negative from the source itself, not an inference from absence.
FAQ: Philippines and PQC
- Does Philippines have a post-quantum cryptography (PQC) law?
- No. Nothing published for Philippines carries statutory force for post-quantum cryptography as of this page's last review. What exists is non-binding guidance, set out with its primary sources below. The lead body is Department of Information and Communications Technology (DICT).
- What is Philippines's PQC migration deadline?
- None. No migration deadline has been published for Philippines by any regulator we checked, including Department of Information and Communications Technology (DICT).
- Does Philippines require a Cryptographic Bill of Materials (CBOM)?
- No. No Philippine regulator has published a cryptographic inventory or CBOM requirement. The National Cybersecurity Plan 2023-2028 does set a binding software bill of materials clause for government procurement ("government agencies shall require a software bill of materials"), but an SBOM lists software components, not cryptographic ones, so it is not a CBOM obligation.