Post-Quantum Requirements in Canada
Canada set its federal dates in 2025. In its roadmap, the Canadian Centre for Cyber Security asks departments to migrate high-priority systems by the end of 2031 and remaining systems by the end of 2035. A Treasury Board Security Policy Implementation Notice, in effect since October 9, 2025, made departmental plans and annual progress reports mandatory from April 1, 2026.
Suppliers have obligations too. Since April 1, 2026, federal contracts with a digital component must include post-quantum clauses. The clauses require compliance with Cyber Centre recommendations, validated cryptographic modules and crypto-agility. In this course, we cover what the federal instruments require, what suppliers must deliver, and how banks and critical infrastructure operators use the same dates.
Course Outline
Module 1. What Regulators Everywhere Ask For (30 minutes)
Organizations face post-quantum requirements through government mandates, supplier obligations, critical infrastructure rules, sector supervision, and pressure from customers and insurers. Regulators in every jurisdiction ask for the same core evidence, from an accountable owner and a cryptographic inventory to a dated roadmap and progress reports. We cover NIST’s FIPS 203, 204 and 205 and compare Canada’s dates with those in the United States, the UK and the EU.
Module 2. Canada’s Requirements in Detail (60 minutes)
We work through the Treasury Board notice and the Cyber Centre roadmap (ITSM.40.001). That covers the plans and annual reports from April 2026 and the plan update in April 2027. It also covers the inventory and priority milestones in April 2028 and the 2031 and 2035 deadlines. We cover the procurement clauses for contracts with a digital component and the Cyber Centre’s algorithm guidance (ITSP.40.111). We explain how Shared Services Canada’s own plan affects departments that use its services. For banks and insurers, we cover the G7 Cyber Expert Group roadmap, which suggests upgrading the most important systems by 2030 to 2032.
Module 3. Demonstrating Compliance in Canada (30 minutes)
We cover what Treasury Board, auditors and federal buyers will ask to see. That includes the departmental plan, the system inventory with cryptographic detail, and priority rankings for systems exposed to harvest-now-decrypt-later attacks. It also includes supplier evidence for the contract clauses and the annual progress reports. You also learn to report progress to your board.
Prerequisites
None. Post-Quantum Foundation explains the threat and the algorithms if you want that background first.
Who this course is for
Departmental security officers, CIO and CSO teams, procurement officers and migration program managers in federal departments and agencies, and the suppliers that sell to them. Also useful for compliance and risk teams at Canadian banks, insurers and critical infrastructure operators.
What you’ll be able to do afterward
- Explain what the Treasury Board notice and the Cyber Centre roadmap require, and by when
- Build a departmental plan and system inventory that meet the April milestones
- Write or answer the post-quantum clauses in federal contracts
- Map the 2031 and 2035 deadlines onto your migration plan
- Apply the G7 financial-sector roadmap if you work in a bank or insurer
- Report progress to Treasury Board, to auditors or to your board of directors
What you leave with
When you finish, we email you the course handbook, a PDF of every slide with notes that explain it in full. It includes a reference table of the Canadian instruments covered, with their dates and sources. We also include a PDF copy of Quantum Ready. The handbook is yours to keep.
Enrollment includes 180 days of access to the online on-demand course. Where that course is not yet published, the 180 days start on the day it is.
Where this course fits
You can take this course on its own. If you operate in several countries, add PQC Compliance: Global Overview. Suppliers that sell to both governments should also take PQC Compliance: United States. In PQC for GRC Professionals, you map the requirements into controls and audit evidence.
Why we teach this
We built the course on Quantum Ready, the book on organizational readiness written by the course author, and on the Applied Quantum PQC Migration Framework, published openly under Creative Commons. Our faculty runs migration programs and follows each Canadian instrument as federal authorities issue it. We revise the course when a regulator issues or changes a rule.
Certificate of Completion
Upon completion, you receive a Quantum Academy certificate of completion. It confirms that you completed the course and is separate from Quantum Academy’s professional certifications.
About this program
Quantum Academy credentials are private professional credentials issued by Quantum Academy, a trade name of Post-Quantum Institute. They are not government-issued licenses, accredited degrees, or academic credit, and earning one does not guarantee employment, promotion, regulatory approval, or any other specific outcome.
Quantum Academy programs are educational and informational only, and are not legal, compliance, or engineering advice.
