QuantumReadyWhat has already happened, and what is coming
Every date below is drawn from a published source, and each one links to it. Where something is a proposal rather than a requirement, it says so.
-
February 2024MAS issues circular MAS/TCRS/2024/01, "Advisory on Addressing the Cybersecurity Risks Associated with Quantum", to the chief executives of all financial institutions. It asks for crypto-agility, an inventory of cryptographic assets, and a transition strategy.
-
August 2024NIST finalises the first three post-quantum standards: FIPS 203 for ML-KEM, FIPS 204 for ML-DSA, and FIPS 205 for SLH-DSA. These are the algorithms migration is being planned around.
-
October 2025CSA announces the Quantum-Safe Handbook and the Quantum Readiness Index at Singapore International Cyber Week, and opens a public consultation running from 23 October to 31 December 2025.
-
16 July 2026Version 1 of the Handbook and the QRI are published, jointly developed by CSA, GovTech and IMDA, after the consultation. The Handbook sets out the CII requirements below in full.
-
31 March 2027Submission of CII owner's quantum-safe migration plan to CSA. Quoted from the Handbook. This is the first hard date, and it arrives before most organisations will have done the discovery work, which is why the Handbook repeatedly pushes for discovery to start on the highest risk systems first.CSA Quantum-Safe Handbook V1, CII requirements
-
1 January 2028New CII computer systems with a digital component should either support quantum-safe algorithms and technologies, or be quantum-safe ready. Note the wording: this is about new procurement and implementation from that date, not about everything already running.CSA Quantum-Safe Handbook V1, CII requirements
-
31 December 2031Completion of quantum-safe migration across CII computer systems, meaning vulnerable cryptography is no longer in use. Roughly five years after the plan is due, which is what the Handbook means when it says migration should align with natural technology refresh cycles rather than run as a separate programme.CSA Quantum-Safe Handbook V1, CII requirements
-
OngoingThe QRI is a self-assessment that organisations are expected to repeat periodically, so readiness can be tracked rather than assessed once. The official instrument is a government form at go.gov.sg/qri.
What this timeline does not say
Nothing here is a prediction about when a cryptographically relevant quantum computer will exist. Nobody knows that, and any vendor who tells you a year is guessing. The dates above are compliance and standards dates, which is a different and much firmer kind of information. Our own scan output deliberately avoids predicting the threat timeline, and the workbench asks you to choose an assumption and states it.
We link to primary sources rather than reproducing them. The Handbook and the QRI are published by CSA; we do not administer them and we are not affiliated with CSA, GovTech, IMDA or MAS.