Singapore

What's verified

CSA published the Quantum-Safe Migration Handbook v1.0 and the Quantum Readiness Index on 16 July 2026, developed with GovTech and IMDA. The Handbook introduces three dated milestones for Critical Information Infrastructure owners:

• By 31 March 2027 — submission of the CII owner's quantum-safe migration plan to CSA.
• From 1 January 2028 — newly procured and implemented CII computers and computer systems with a digital component "should" either support quantum-safe algorithms and technologies, or be quantum-safe ready.
• By 31 December 2031 — completion of quantum-safe migration across CII systems, with vulnerable cryptography no longer in use.

The Handbook lists RSA, Diffie-Hellman, and ECC at all key sizes as deprecated, along with AES below 128-bit and hash functions below 256-bit, and points to ML-KEM, ML-DSA, and SLH-DSA as replacements, with LMS and XMSS reserved for firmware signing.

How binding is this, actually?

This is the question that decides what Singapore's timeline is worth, and the answer is more qualified than the dates suggest.

The Handbook presents the milestones under the heading of "requirements." But its own scope statement, on page 3, says the document "is intended for informational purposes only and is not mandatory, prescriptive or exhaustive." The modal verbs are similarly soft: the 2028 and 2031 milestones say "should," and the 2027 plan-submission milestone is written as a bare noun phrase with no modal verb at all.

Singapore does have machinery to make this binding. Under section 35A of the Cybersecurity Act 2018, the Commissioner may issue a Code of Practice for CII owners. Section 35A(5) says such a code "has no legislative effect" — but section 35A(6) then says every person it applies to "must comply" with it, and section 12(1) lets the Commissioner issue a written direction where a CII owner falls short. A Code of Practice is therefore not subsidiary legislation, yet compliance with it is mandatory.

That machinery is in active use. CSA issued a new Cybersecurity Code of Practice for CII on 29 July 2026, thirteen days after the Handbook. We searched its full 72 pages: it contains no occurrence of "quantum," "PQC," "CBOM," "crypto-agility," or "cryptographic inventory." Its only cryptography provision, clause 5.17, requires CII owners to protect cryptographic keys from unauthorised access and to track key lifecycles with at least an annual review. It does not mention quantum-safe algorithms or set any migration expectation.

So Singapore's quantum milestones currently sit in a document that describes itself as not mandatory, and are absent from the instrument that would make them enforceable. CSA's press release of 22 July 2026 announcing a further Code update later in 2026 discusses advanced persistent threats and AI-enabled attacks, and does not mention quantum either. The gap is closable at any time — CSA need only add clauses to the Code — but as of this page's last review it has not been closed.

What the migration plan must contain

Not stated. The Handbook sets the 31 March 2027 submission date but does not specify the plan's required contents, format, or submission mechanism, noting only that CSA, GovTech, and IMDA "are developing detailed guidance to support CII owners in meeting these milestones." Organisations preparing for that date are, for now, working without a published specification.

Cryptographic inventory and CBOM

Both Singapore tracks require a cryptographic inventory in substance, though neither prescribes a format for an organisation's own systems.

The Handbook organises its guidance into five domains — Risk Assessment, Governance, Technology, Training and Capability, and External Engagements — and its staged guidance covers identifying existing inventory, setting a cryptographic discovery plan, and building and maintaining a live inventory. It also advises against boiling the ocean: "Do not attempt to inventory everything at once — scope down to where the risk is highest."

CBOM appears exactly once in the Handbook, and the placement matters. It sits in the External Engagements domain, as something to request from suppliers: "Request a cryptographic inventory (e.g. in the form of a Cryptographic Bill of Materials, CBOM): Obtain the inventory or cryptographic algorithms and components used in the products and services that you procure/acquire from the solution provider." It is a supply-chain artefact to collect from vendors, not a required output for the CII owner's own estate or for the 2027 plan. The Quantum Readiness Index does not mention CBOM at all.

MAS's circular is more specific about fields than CSA's Handbook. It asks FIs to identify and maintain an inventory of cryptographic solutions recording the algorithm and key length used, the ownership and parties responsible for maintaining each asset, and the specific system or application where the algorithm is embedded. That three-field schema is a cryptographic bill of materials in all but name, though MAS never uses the term.

The Quantum Readiness Index

The QRI is a self-assessment questionnaire covering the same five domains as the Handbook, aimed at CIOs, CISOs, CTOs, and risk officers. It measures organisational readiness — the processes and expertise needed to plan and execute a migration — rather than technical cryptographic posture. It is explicitly voluntary: "The QRI is intended as a guidance resource and not as a compliance framework. It does not prescribe specific solutions or minimum levels of readiness." Completing it returns a readiness level per objective with recommended next steps.

What we checked and did not find

• The Cybersecurity Code of Practice for CII (2026) contains no quantum, PQC, CBOM, crypto-agility, or cryptographic-inventory provision.
• The Handbook contains no reference to the Cybersecurity Act 2018, to a Code of Practice, or to the CCoP. It does not state a statutory basis for its milestones.
• The Handbook does not specify what the 31 March 2027 migration plan must contain.
• MAS's 2024 circular does not use "CBOM" or "bill of materials," and contains no "must" or "shall" in its operative text.
• The MAS supervisory expectations announced on 28 July 2026 have not yet been published, and we found no quantum consultation paper on the MAS site.
• We found no binding Singapore government PQC procurement rule — no GovTech or Ministry of Finance instruction requiring quantum-safe procurement across government.

Timing worth noting

MAS's stated aim is for financial institutions to achieve quantum resilience "before the end of this decade," which is earlier than CSA's 31 December 2031 CII deadline. A Singapore bank that is also a CII owner may find the financial regulator moving first.