Australian guidance on post-quantum cryptography is converging, and aligns closely with allied governments. Each body expects organisations to know where cryptography is used, to hold a transition plan and to demonstrate progress.
Australia
ASD recommends a staged transition to post-quantum cryptography, and our method follows it. Each deliverable maps to the frameworks that apply to the client's sector, and supports evidence for boards, auditors and regulators.
ASD
Applies to Commonwealth entities; best practice for all organisations
ASD expects organisations to develop, implement and maintain a post-quantum transition plan against ASD's recommended milestones, shown in the global table below. New products are expected to support ASD-Approved Cryptographic Algorithms, including post-quantum algorithms.
APRA
Applies to APRA-regulated entities
CPS 234 sets the information security baseline, including the cryptographic controls that protect critical information assets. APRA expects boards to understand quantum risk and entities to map where cryptography is relied upon.
APRA
Applies to APRA-regulated entities
CPS 230 places responsibility for service-provider risk with the entity, including the cryptography that material service providers operate on its behalf.
PSPF
Applies to Non-corporate Commonwealth entities
The framework requires a post-quantum transition plan, and that approved post-quantum algorithms are supported on newly procured cryptographic products.
SOCI
Applies to Responsible entities
The required risk management programme does not name post-quantum cryptography; accounting for cryptography within it is nonetheless prudent.
Payments
Applies to Merchants, service providers and payment participants
PCI DSS requires an inventory of cipher suites and protocols with a plan for anticipated cryptographic change, and the payments industry is moving to stronger algorithms.
Global
Allied governments have set closely aligned timelines. Each asks for discovery and a plan first, priority systems next and full migration by the middle of the next decade.
| Jurisdiction | 2026 | 2028 | 2030 | 2031 | 2035 | Basis |
|---|---|---|---|---|---|---|
| Australia | Refined transition plan | Critical systems commenced | Transition complete | ASD recommended milestones | ||
| United States | Federal key establishment migrated | Federal signatures migrated | Quantum-vulnerable algorithms disallowed | Executive order for federal high-value systems; NIST standards | ||
| European Union | National roadmaps in place | High-risk use cases migrated | Migration complete as far as feasible | Coordinated roadmap adopted by Member States | ||
| United Kingdom | Discovery and initial plan | Highest-priority migration | Migration complete | NCSC migration timelines | ||
| Canada | Departmental plans in place | Transition begins | High-priority systems migrated | Remaining systems migrated | Federal government roadmap | |
| Singapore | No fixed milestones. Financial institutions are advised to inventory cryptographic assets, prioritise critical systems and build crypto-agility; a national quantum-safe migration handbook is published. | MAS advisory; CSA quantum-safe handbook | ||||
The NIST post-quantum standards, ML-KEM, ML-DSA and SLH-DSA, are the common foundation across these jurisdictions.
Australia, the United States, the United Kingdom, Canada and Singapore each run a national quantum strategy or initiative, investing in research, industry and skills.
This page is a general overview of guidance relevant to post-quantum cryptography. Specific obligations depend on each organisation's circumstances.
The common thread
A current cryptographic inventory, a transition plan the organisation owns and a governance cycle that shows progress over time.
A 30-minute consultation, led by a PQC expert, maps the guidance that applies to the organisation to a practical plan.
Book a 30-minute consultation