Post-Quantum Requirements in Singapore
The Cyber Security Agency of Singapore (CSA) published its Quantum-Safe Handbook in July 2026, with three milestones for owners of critical information infrastructure (CII). Owners are to submit a quantum-safe migration plan to CSA by March 31, 2027. From January 1, 2028, newly procured CII systems should support quantum-safe algorithms or be quantum-safe ready. Migration should be complete by December 31, 2031.
In October 2026, CSA recommended that other organizations exposed to quantum risk put a migration plan in place by 2027 and aim to finish by 2035. CSA also announced the Quantum-Safe Kickstarter Grant and will fund pilot projects of up to six months from November 1, 2026. In this course, we cover CSA’s milestones and Handbook, MAS guidance for financial institutions, and the evidence that shows your organization is on track.
Course Outline
Module 1. What Regulators Everywhere Ask For (30 minutes)
Organizations face post-quantum requirements through government mandates, supplier obligations, critical infrastructure rules, sector supervision, and pressure from customers and insurers. Regulators in every jurisdiction ask for the same core evidence, from an accountable owner and a cryptographic inventory to a dated roadmap and progress reports. We cover NIST’s FIPS 203, 204 and 205 and compare Singapore’s dates with those in Hong Kong, Australia, the EU and the United States.
Module 2. Singapore’s Requirements in Detail (60 minutes)
We work through CSA’s Quantum-Safe Handbook and the Quantum Readiness Index, its self-assessment questionnaire. That covers the 2027 plan, the 2028 procurement milestone and the 2031 completion date for CII owners. We explain the legal basis for the milestones under the Cybersecurity Act, including the Code of Practice for CII owners and the Commissioner’s power to issue directions. We cover the 2035 target for other organizations and how to apply for the Kickstarter Grant. For financial institutions, we cover the MAS advisory of February 2024 on quantum risks and MAS’s Technology Risk Management Guidelines. We also show how the milestones apply across the 11 CII sectors, from banking and finance to healthcare and energy.
Module 3. Demonstrating Compliance in Singapore (30 minutes)
We cover what CSA, MAS and auditors will ask to see. That includes the migration plan due by March 31, 2027, the cryptographic inventory, your Quantum Readiness Index results and procurement specifications for new CII systems. It also includes supplier commitments and progress reports. You map the work to the CII Code of Practice and MAS’s Technology Risk Management Guidelines, and learn to report progress to your board.
Prerequisites
None. Post-Quantum Foundation explains the threat and the algorithms if you want that background first.
Who this course is for
CISOs, compliance and risk leads, procurement officers and migration program managers at CII owners and government agencies in Singapore. Also useful for MAS-regulated financial institutions, for other organizations that hold sensitive data needing long-term protection, and for the suppliers that serve all of them.
What you’ll be able to do afterward
- Explain CSA’s milestones for CII owners and the 2035 target for other organizations
- Prepare a migration plan for submission to CSA by March 31, 2027
- Write quantum-safe requirements into procurement for new CII systems from 2028
- Use the Quantum Readiness Index to measure progress and brief senior management
- Apply MAS guidance on quantum risk if you work in financial services
- Decide whether a Kickstarter Grant pilot suits your organization, and prepare the application
What you leave with
When you finish, we email you the course handbook, a PDF of every slide with notes that explain it in full. It includes a reference table of the Singapore instruments covered, with their dates and sources. We also include a PDF copy of Quantum Ready. The handbook is yours to keep.
Enrollment includes 180 days of access to the online on-demand course. Where that course is not yet published, the 180 days start on the day it is.
Where this course fits
You can take this course on its own. If you operate across Asia-Pacific, add PQC Compliance: Australia, or take PQC Compliance: Global Overview for every jurisdiction in one session. CII owners should continue with Quantum-Safe OT and Critical Infrastructure, and financial institutions with Quantum-Safe Financial Services. In PQC for GRC Professionals, you map the requirements into controls and audit evidence.
Why we teach this
We built the course on Quantum Ready, the book on organizational readiness written by the course author, and on the Applied Quantum PQC Migration Framework, published openly under Creative Commons. Our faculty runs migration programs and follows each Singapore instrument as CSA and MAS issue it. We revise the course when a regulator issues or changes a rule.
Certificate of Completion
Upon completion, you receive a Quantum Academy certificate of completion. It confirms that you completed the course and is separate from Quantum Academy’s professional certifications.
About this program
Quantum Academy credentials are private professional credentials issued by Quantum Academy, a trade name of Post-Quantum Institute. They are not government-issued licenses, accredited degrees, or academic credit, and earning one does not guarantee employment, promotion, regulatory approval, or any other specific outcome.
Quantum Academy programs are educational and informational only, and are not legal, compliance, or engineering advice.
