Summary

  • Singapore’s 2031 migration target applies to Critical Information Infrastructure; a separate 2035 recommendation covers other organizations whose systems or data face quantum risk.
  • The first hard task is discovering where vulnerable cryptography sits across systems, suppliers and operational dependencies, then assigning owners and testing replacements.

Singapore’s quantum-safe timetable puts an unglamorous task ahead of algorithm selection: finding every place cryptography has become part of a service’s operating machinery.

On 14 October, the Cyber Security Agency of Singapore (CSA) advised organizations exposed to quantum risk to prepare migration plans by the end of 2027 and complete migration by 2035. Those dates are guidance for exposed organizations, not a blanket statutory deadline. Critical Information Infrastructure (CII) has a tighter track under June guidance: owners are to submit plans to their Sector Leads by 31 March 2027, target completion by 31 December 2031, and ensure CII acquisitions from 1 January 2028 support post-quantum cryptography or are quantum-safe-ready by the 2031 deadline.

The split matters. A company outside the CII framework should not read 2031 as its legal deadline. Yet a later 2035 horizon does not make the discovery work optional. CSA’s recommended plan asks organizations to identify exposed systems and data, assign accountable owners, examine suppliers’ roadmaps, test compatibility and performance, and preserve the ability to change cryptographic choices.

That is a dependency-mapping problem. Encryption may sit in a product, protocol, device, managed service or vendor component that the operator neither built nor buys as a distinct “cryptography” line item. Long-lived confidential data also creates a different exposure from a service that can be replaced quickly. An inventory limited to code repositories or direct software contracts can therefore look complete while missing the parts that set the actual migration sequence.

The procurement date turns this into a governance issue. If new CII purchases must support post-quantum algorithms or be ready for them, procurement specifications and supplier evidence need to arrive before the final migration window. A roadmap assertion is not the same as a tested upgrade path; operators need to know who bears integration costs, what support periods apply, and whether a change can be rolled back without interrupting service.

CSA says a cryptographically relevant quantum computer could emerge in five to ten years, while acknowledging uncertainty. That is a planning scenario, not a forecasted arrival date or evidence that present systems have already been broken. NIST finalized three post-quantum standards in August 2024, giving buyers a standards-based destination, but standards do not resolve local compatibility, performance or legacy-system constraints.

The new Quantum-Safe Kickstarter Grant may help Singapore-incorporated non-government organizations test a bounded case. It offers up to 70% of eligible costs, with at least 30% cash co-funding, for pilots of up to six months; applicants must document methods, results and limitations. A useful pilot can expose integration costs or show that a proposed migration does not work. It cannot certify an entire estate from one application or device.

The immediate measure of readiness is therefore not how many projects use the phrase “quantum-safe.” It is whether an organization can name the systems at risk, the person accountable for each, the supplier evidence still missing, and the test that would justify moving a replacement into production.

Sources