Singapore recommends quantum-safe migration plans by 2027 for critical infrastructure

The Cyber Security Agency of Singapore (CSA) has issued guidance recommending that organizations exposed to quantum-related cybersecurity risks establish migration plans by 2027. According to Industrial Cyber, the agency advises these entities to aim for completing their transition to quantum-safe cryptography by 2035. This recommendation targets the potential threat that advanced quantum computing poses to current encryption standards.

Critical Information Infrastructure (CII) systems face stricter timelines under this risk-based approach. The CSA calls for CII owners to finish their migration efforts by 2031, rather than the standard 2035 deadline. This accelerated schedule reflects the heightened sensitivity of national infrastructure. The agency emphasizes that protecting digital communications, transactions, and sensitive information is paramount as quantum capabilities evolve.

Funding and Implementation Support

To assist with this complex transition, the CSA launched the Quantum-Safe Kickstarter Grant. This initiative offers time-limited seed funding for organizations to pilot quantum-safe solutions and tackle practical migration hurdles. According to Industrial Cyber, the grant is open to all organizations but prioritizes CII owners. Applications will be accepted from November 1, 2026, through October 31, 2027.

Each funded pilot project may last up to six months. Participants are required to report their findings and demonstrate the impact of their efforts. Priority use cases for the grant include end-to-end application migration, cryptographic discovery and inventory, and the migration of operational technology (OT). Legacy and infrastructure-heavy systems also receive special attention under this funding scheme.

Risk Assessment and Vendor Engagement

The CSA advised organizations to begin by assessing their risk exposure and identifying critical systems. Companies should engage technology vendors and partners to understand available quantum-safe solutions. Industrial Cyber reports that the agency recognizes cryptography is embedded across applications, networks, and interconnected systems. This widespread integration often involves multiple vendors, complicating the update process.

Organizations need sufficient time to identify cryptographic dependencies, assess risks, and test suitable solutions. Implementation must proceed without disrupting ongoing operations. This careful management is particularly vital for critical infrastructure and legacy systems, where technology changes carry significant operational risk. Singapore’s early preparation underscores the urgency of addressing these cryptographic vulnerabilities.

What should you do?

Security leaders should begin inventorying cryptographic assets to understand current dependencies. Review existing vendor contracts to identify quantum-safe roadmap commitments. Engage with the CSA or relevant national bodies to understand specific industry deadlines. Monitor the Quantum-Safe Kickstarter Grant application window for potential funding opportunities.

What to do and how to stay safe: Cyber Security Agency of Singapore

• Conduct a comprehensive inventory of all cryptographic algorithms and protocols currently in use across your network and applications.
• Engage with technology vendors to assess their roadmaps for quantum-resistant solutions and identify potential integration challenges.
• Develop a preliminary risk assessment that identifies critical systems and data requiring immediate protection against future quantum threats.
• Review national regulatory guidance, such as the CSA’s deadlines, to align your migration timeline with legal and compliance requirements.

Step-by-step guide: Mobile Device Security: How to Protect Data Beyond Passwords

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

When does the guidance recommend organizations establish quantum-safe migration plans?

The Cyber Security Agency of Singapore recommends that organizations exposed to quantum-related risks establish migration plans by 2027.

What is the target deadline for Critical Information Infrastructure systems to complete migration?

The guidance calls for CII systems to complete their transition to quantum-safe cryptography by 2031, which is earlier than the general 2035 target.

Does the Quantum-Safe Kickstarter Grant support legacy OT systems?

Yes, the grant prioritizes the migration of operational technology, legacy, and infrastructure-heavy systems, with pilots lasting up to six months.