Advisory on Quantum-Safe Migration for Organisations

Introduction

Quantum computers are becoming more powerful. Once advanced enough, they could break the cryptography that protects digital information today. This is the “quantum threat”. While it is not clear when this threat will arrive, attackers are already expected to be stealing encrypted data today, with the intent to decrypt it later when quantum computers mature.

Today's encryption rely on mathematical problems that are extremely hard for normal computers to solve – like factoring very large numbers, a task that would take conventional computers thousands of years. Quantum computers work differently. Using specialised algorithms, they can solve these specific types of problems exponentially faster, which means they could break widely used cryptographic algorithms such as RSA, Elliptic Curve Digital Signature Algorithm (ECDSA), and Digital Signature Algorithm (DSA).

Experts estimate that a quantum computer powerful enough to do this, known as a Cryptographically Relevant Quantum Computer (CRQC), could arrive within 5 – 10 years, though the exact timeline remains uncertain. Such computers could arrive earlier than anticipated due to technological advances.

Getting Ahead of the Threat

Organisations can get ahead of this threat with early, phased migration to quantum-safe cryptography, before quantum computers become powerful enough to break today's systems. Migration does not mean overhauling everything overnight. Starting to plan early now means you will not need to scramble later. There are practical and low-risk steps that organisations can take today. Start planning now, prioritise what matters most, and build in flexibility to adapt as the field evolves.

Singapore’s Quantum-Safe Migration Milestones

Governments around the world are setting timelines for quantum-safe migration. Common timelines have emerged, for critical and all other affected systems to complete migration by 2031 and 2035 respectively. Singapore is aligned with these international timelines.

CSA has recently issued quantum-safe migration guidance for Critical Information Infrastructure (CII) Owners, setting a 2031 target for migration of CII systems. Other organisations exposed to quantum risks are encouraged to complete migration by 2035. This timeline provides organisations with a realistic planning horizon for what will be a multi-year transition.

2035 can seem far off, but migration is a multi-year effort, and early groundwork pays off. In the immediate term, organisations should aim to have a migration plan in place by end 2027. Doing so will put you in good stead well ahead of the deadline. The steps below can help shape that plan.

Who this Advisory is for

This advisory applies broadly to organisations reliant on digital systems, data, or communications for their operations. Not all organisations and systems will be equally exposed to the quantum threat, but all should understand it and assess their own exposure before deciding whether to act. CIIOs should continue to refer to the Jun 2026 guidance from CSA.

What You Can Do

To help you get started, here are some practical and low-risk steps drawn from CSA’s Quantum-Safe Migration Handbook. These are a starting point – adapt them to your organisation’s specific needs and risk profile.

1.      Understand your risk and identify your most important systems

You do not need to audit everything at once. Start with what’s most exposed:

·       Sensitive data that must remain confidential for years (e.g. commercial secrets, medical records, legal documents).

·       Internet-facing systems (websites, cloud-hosted services, VPNs and email systems that communicate over public networks).

·       Long lifespan equipment (building management systems, industrial control systems or manufacturing equipment) that may be difficult to update quickly.

2.      Establish clear ownership

Identify the person in your organisation that is responsible and accountable for quantum-safe migration. Larger organisations can use a RACI (Responsible, Accountable, Consulted, Informed) model to assign roles across senior management, cybersecurity teams, IT and technology strategy teams, and business units.

3.      Identify, evaluate and test quantum-safe solutions

For your priority systems, identify which quantum-safe algorithms can replace the vulnerable ones currently in use. CSA’s Quantum-Safe Handbook lists recommended algorithms. Recommended algorithms will evolve as new options emerge.

Test before full rollout as some quantum-safe algorithms could affect performance, given their large key sizes and increased computational needs.

4.      Engage your vendors and partners

Your organisation’s readiness depends on those of your vendors. Ask key vendors and partners:

·       Do their products support quantum-safe cryptography?

·       What is their quantum-safe upgrade roadmap?

·       Do their migration timelines align with yours?

·       Will they manage the full migration (e.g. automatically or manually by them) or is your involvement required for certain processes?

·       Will they incur additional costs in supporting your migration?

When renewing contracts or choosing new software and services, favour vendors that are actively preparing for the quantum-safe transition.

5.      Build awareness across your organisation

Your leadership team needs to understand the quantum threat before they can approve the time, budget and resources required. Frame your briefs on business risk and not just technical details, such as regulatory obligations, customer trust, data breaches and competitive disadvantages.

Make sure that the teams handling your IT and migration, whether internal or outsourced providers, have a basic understanding of the quantum threat and what migration involves.

6.      Build in long-term flexibility (cryptographic agility)

Today’s standards for quantum-safe algorithms may evolve. Choose and build systems that let you swap out algorithms with minimal disruption. Avoid locking into products that use hard-coded encryption with no upgrade path. Larger organisations can consider centralised and automated cryptographic management platforms, and clear governance policies to determine how cryptographic mechanisms are selected, updated and retired.

Additional Resources

For more information on CSA’s release of guidance to CIIOs, refer to CSA’s Guidance on Quantum-safe Requirements and Migration Plan Outline [PDF, 142.23 KB] ↗ (opens in new tab)

To support your organisation's quantum-safe migration journey, CSA has developed two key resources. The Quantum Readiness Index (QRI) is a self-assessment tool that helps organisations periodically evaluate their readiness across five key domains, identify capability gaps, and prioritise next steps. The Quantum-Safe Migration Handbook provides practical step-by-step guidance in organisations’ migration planning. For more information on CSA’s Quantum-Safe Handbook and Quantum Readiness Index, refer to CSA’s Resources.