While Singapore is funding PQC pilots and urging critical infrastructure operators to step up efforts, what are other SEA countries doing?

In South-east Asia, one modern city is turning post-quantum cryptography (PQC) from a research topic into a timed national migration program. Singapore’s Cyber Security Agency (CSA) now expects owners of critical information infrastructure (CII) to submit migration plans by March 2027; and will require newly procured systems to be quantum-safe ready from January 2028 to meet migration deadlines by the end of 2031.

In South-east Asia, one modern city is turning post-quantum cryptography (PQC) from a research topic into a timed national migration program. Singapore’s Cyber Security Agency (CSA) now expects owners of critical information infrastructure (CII) to submit migration plans by March 2027; and will require newly procured systems to be quantum-safe ready from January 2028 to meet migration deadlines by the end of 2031.

Other organisations in the country facing material quantum risk are advised to prepare plans by the end of 2027 and complete migration by 2035.

The agency has also launched a grant to move organizations beyond planning. Open from 1 November 2026 to 31 October 31 2027, it will fund pilots of up to six months, with priority for CII owners in sectors such as banking, energy and info-communications. CSA will cover up to 70% of eligible project costs, while applicants must contribute at least 30% in cash.

Elsewhere in the region:

• Malaysia’s National PQC Migration Plan 2025–2030, launched in late 2025, is paired with a sandbox and proof-of-concept program for government and critical-infrastructure systems. CyberSecurity Malaysia has also developed a PQC migration framework, while the country’s National Security Council says it is guiding operators of national critical information infrastructure through cryptographic inventories, risk assessment, skills development and phased migration. Malaysia’s program is strategic rather than compliance-driven: unlike Singapore, it has not imposed binding deadlines or mandatory completion dates. Still, its combination of a national plan, testing environment and critical-infrastructure outreach makes it the most institutionally advanced PQC effort outside Singapore.
• Thailand has a foundation in quantum research, and its Quantum Technology Roadmap runs from 2020 to 2029. Its universities have worked on quantum key distribution and quantum communications. Reported pressure from the central bank on financial institutions suggests that finance may become Thailand’s first practical PQC migration zone, even though a comprehensive national migration framework has not emerged.
• Indonesia and Vietnam remain at earlier stages of PQC planning. Indonesia’s most visible work is basic quantum research through BRIN’s quantum-physics research center, rather than a nationwide cryptographic transition program. Vietnam has university-level quantum projects and policy interest in emerging technologies, but no comparable operational PQC migration framework has been publicly identified.
• The Philippines has a quantum strategy or roadmap, according to regional policy analysis, but a recent Malaysian assessment had placed it in Tier 3 for PQC readiness.
• Laos and Myanmar have been ranked lower, reflecting limited public evidence of dedicated programs.

The regional gap is therefore less about awareness than execution. Singapore is setting deadlines and funding real-world pilots; Malaysia is building a national migration architecture; Thailand has research depth and financial-sector momentum; and much of the rest of ASEAN is still developing the institutional capacity to inventory, test and replace cryptography at scale.