Post-Quantum Requirements in Australia

The Australian Signals Directorate (ASD) recommends that organizations stop using traditional asymmetric cryptography by the end of 2030. That is five years earlier than the 2035 date most jurisdictions set for full migration. ASD asks organizations to have a transition plan by the end of 2026 and to begin the transition by the end of 2028, starting with their most critical systems.

In a June 2026 speech, Therese McCarthy Hockey, a Member of the Australian Prudential Regulation Authority (APRA), told regulated entities to start mapping where they rely on cryptography. She said APRA will step up its supervisory engagement on quantum risk over the following year. APRA wants evidence that boards understand the risk and are advancing plans to meet ASD’s timeline. In this course, we cover ASD’s guidance, APRA’s expectations, the rules for critical infrastructure and government, and the evidence that shows your organization is on track.

Course Outline

Module 1. What Regulators Everywhere Ask For (30 minutes)

Organizations face post-quantum requirements through government mandates, supplier obligations, critical infrastructure rules, sector supervision, and pressure from customers and insurers. Regulators in every jurisdiction ask for the same core evidence, from an accountable owner and a cryptographic inventory to a dated roadmap and progress reports. We cover NIST’s FIPS 203, 204 and 205 and compare Australia’s 2030 date with full-migration dates in the United States, the UK, the EU and Singapore.

Module 2. Australia’s Requirements in Detail (60 minutes)

We work through ASD’s guidance on planning for post-quantum cryptography and the Information Security Manual (ISM). That covers the 2026, 2028 and 2030 milestones, the algorithms ASD approves and its position on hybrid schemes. We cover APRA’s June 2026 speech and its 2026–27 Corporate Plan, which expects entities to make timely progress on their plans. We show how APRA’s expectations apply under CPS 234 on information security and CPS 230 on operational risk management. For critical infrastructure owners, we cover the risk management program rules under the Security of Critical Infrastructure Act 2018. For Commonwealth entities, we cover how they apply the ISM under the Protective Security Policy Framework.

Module 3. Demonstrating Compliance in Australia (30 minutes)

We cover what APRA’s supervisors, auditors and government assessors will ask to see. That includes the map of where you rely on cryptography, the transition plan due by the end of 2026, and the priority given to your most critical systems. It also includes supplier commitments under CPS 230 and board papers that show the board understands the risk. You map the work to the ISM, CPS 234 and ISO/IEC 27001, and learn to report progress against ASD’s milestones.

Prerequisites

None. Post-Quantum Foundation explains the threat and the algorithms if you want that background first.

Who this course is for

CISOs, chief risk officers, compliance leads, company secretaries and migration program managers at APRA-regulated banks, insurers and superannuation funds. Also useful for critical infrastructure owners under the SOCI Act, Commonwealth and state government entities, and the suppliers that serve them.

What you’ll be able to do afterward

• Explain ASD’s 2026, 2028 and 2030 milestones and what each one requires of your organization
• Map where your organization relies on cryptography, as APRA expects
• Build a transition plan by the end of 2026 that puts your most critical systems first
• Prepare board papers that show the board understands the risk and is advancing a plan
• Apply CPS 234, CPS 230 and the SOCI risk management rules to quantum risk
• Report progress to your board and supervisors against ASD’s timeline

What you leave with

When you finish, we email you the course handbook, a PDF of every slide with notes that explain it in full. It includes a reference table of the Australian instruments covered, with their dates and sources. We also include a PDF copy of Quantum Ready. The handbook is yours to keep.

Enrollment includes 180 days of access to the online on-demand course. Where that course is not yet published, the 180 days start on the day it is.

Where this course fits

You can take this course on its own. If you operate across Asia-Pacific, add PQC Compliance: Singapore, or take PQC Compliance: Global Overview for every jurisdiction in one session. Banks should continue with Quantum-Safe Financial Services, insurers with Quantum-Safe Insurance, and critical infrastructure owners with Quantum-Safe OT and Critical Infrastructure. Directors can take Quantum Security for Boards.

Why we teach this

We built the course on Quantum Ready, the book on organizational readiness written by the course author, and on the Applied Quantum PQC Migration Framework, published openly under Creative Commons. Our faculty runs migration programs and follows each Australian instrument as ASD and APRA issue it. We revise the course when a regulator issues or changes a rule.

Certificate of Completion

Upon completion, you receive a Quantum Academy certificate of completion. It confirms that you completed the course and is separate from Quantum Academy’s professional certifications.

About this program

Quantum Academy credentials are private professional credentials issued by Quantum Academy, a trade name of Post-Quantum Institute. They are not government-issued licenses, accredited degrees, or academic credit, and earning one does not guarantee employment, promotion, regulatory approval, or any other specific outcome.

Quantum Academy programs are educational and informational only, and are not legal, compliance, or engineering advice.