Singapore's CSA urges quantum-safe migration by 2027, grants seed funding for pilots from 2026

The Cyber Security Agency of Singapore has issued guidance recommending that organisations establish quantum-safe migration plans by 2027. This advice aims to prepare for future advances in quantum computing that could undermine current cryptographic methods protecting digital communications and sensitive data.

Root cause

Current cryptographic standards may become vulnerable once sufficiently powerful quantum computers are developed. Although the exact timeline for this capability remains uncertain, the potential risk to widely used encryption methods necessitates early preparation. Singapore adopts a risk-based approach to address this emerging threat landscape.

Attack path

Quantum computers could eventually break the encryption protecting transactions, communications and information today. The agency notes that cryptography is embedded across applications, networks and infrastructure. This widespread integration means that breaking one method could expose multiple interconnected systems to compromise.

Affected versions

The guidance applies to all organisations exposed to quantum-related risks, with specific recommendations for different sectors. Critical Information Infrastructure systems are advised to complete their migration by 2031. Other organisations are recommended to aim for full transition by 2035.

Mitigation

• Assess risk exposure and identify critical systems early.
• Engage technology vendors to understand available quantum-safe solutions.
• Test suitable solutions without disrupting ongoing operations.
• Manage changes carefully in legacy and infrastructure-heavy systems.

Why it matters

Quantum-safe migration is complex because cryptography is deeply embedded in modern IT stacks. Teams usually need to map existing dependencies before selecting new algorithms. Checking whether legacy systems can support new cryptographic standards is essential. Organisations should verify that vendors provide clear roadmaps for compatibility. This preparation prevents operational disruption during the eventual transition to post-quantum cryptography.

What to do and how to stay safe: Cyber Security Agency of Singapore

• Inventory all cryptographic assets across applications and networks.
• Identify which systems handle sensitive or long-lived data.
• Engage vendors to confirm their quantum-safe migration timelines.
• Monitor official guidance for updates on implementation standards.

Step-by-step guide: Password Policies Examples That Reduce Password Fatigue

General security guidance from the Vector Bulletin newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

When should Critical Information Infrastructure complete migration?

Critical Information Infrastructure systems are advised to complete their migration by 2031, according to the Cyber Security Agency of Singapore.

Is there funding available for these projects?

Yes, the Quantum-Safe Kickstarter Grant provides seed funding for pilot projects from November 2026 to October 2027.

What are the priority use cases for the grant?

Priority use cases include end-to-end migration, cryptographic discovery, and migration of operational technology and legacy systems.