The Cyber Security Agency of Singapore released the finalised Quantum-Safe Migration Handbook and Quantum Readiness Index, developed with GovTech and Infocomm Media Development Authority (IMDA). The handbook sets out the no-regrets moves organisations can make now, helps them identify the crown jewels to protect first, and carries Singapore’s latest expectations for critical information infrastructure owners. The index measures how far along organisations actually are, rather than how far along they assume they are.
That guidance builds on work already underway. The National Quantum Strategy committed roughly S$300 million to the national effort; The National Quantum-Safe Network and NQSN+ have been trialing quantum-safe connectivity on commercial networks (IMDA). Additionally, the Monetary Authority of Singapore told financial institutions two years ago to inventory their cryptographic assets and build crypto agility.
Singapore is not alone. Across Asia Pacific, governments and regulators are accelerating plans for a quantum-safe future.
In Australia, the Australian Signals Directorate has set an even harder date, requiring RSA, Diffie-Hellman, ECDH and ECDSA to be out of use by the end of 2030, five years ahead of the NIST deprecation timeline.
All of this is meaningful progress. But guidance and deadlines will not close the distance between the risk organisations carry today and the disruption waiting for them. Harvest now, decrypt later turns quantum into a present-tense problem. Adversaries are already collecting encrypted traffic on the assumption they will read it later, and a region running on financial services, trade and government records offers plenty worth taking.
Meanwhile, a second force is compressing response times: AI. Attackers use it to find weaknesses and cross networks faster than incident processes were built to handle. Quantum and AI are different problems that arrive at the same one, which is speed. Both widen the gap between how fast threats move and how fast defenders can respond.
As migration plans take shape, organisations should also plan for the reality that prevention often fails. When it does, the ability to contain the intrusion and limit impact separates a manageable incident from a national one. Risk-based visibility, microsegmentation and containment belong in those plans from the start.
Where confidence outruns capability
Breaches will happen. What turns one into a national problem is the inability to contain it quickly enough to keep essential services running.
Recent research found that while 95% of IT and cybersecurity leaders said they are confident they can detect unauthorised lateral movement, 46% said their organisations struggle to stop attackers once they are inside. Only 17% said they can isolate a compromised asset in near real time.
Detection has matured. Containment has not. For critical information infrastructure (CII) operators, the consequence is direct. Once an adversary is inside, the question stops being whether anyone saw them and becomes how far they travel before someone closes the path.
An assume-breach mindset shifts the focus from stopping every intrusion to limiting what an attacker can do once inside, using controls that restrict unnecessary access and prevent a single compromise from cascading into an outage that affects essential services or exposes sensitive data.
The importance of risk-based visibility
Organisations need to know where sensitive data resides, how it travels, which systems rely on legacy encryption, and which assets carry the most operational weight. Without it, disruption spreads through connected systems before anyone has mapped the dependencies.
Quantum adds a second discovery problem. Cryptography has to be traced across applications, systems, suppliers, and embedded devices, along with the assets that run algorithms, which now carry a use-by date. MAS asked financial institutions this in 2024. CSA’s handbook now asks it of everyone.
Crypto agility depends on that groundwork. Nobody updates what they cannot see, or modernises a system blind to what its cryptography supports.
Since few organisations can defend everything equally, prioritisation decides the outcome. Risk-based visibility surfaces the systems and dependencies that matter most, then points controls at them.
Microsegmentation limits how far attackers can move
Zero Trust becomes real at the point of enforcement, where implicit trust gets stripped out, and access narrows to what is needed. Strategy documents do not achieve that. Enforceable policy does.
Under Singapore’s CII framework, operators already have to understand their dependencies and demonstrate that essential services can withstand stress. Australia’s Security of Critical Infrastructure Act sets a similar bar. Microsegmentation answers both the regulatory and operational questions.
Left unsegmented, a network lets attackers roam well past their entry point. Microsegmentation closes that down by enforcing least-privilege communication between systems, shutting down pathways that nothing depends on, and ringfencing sensitive assets, so breaches stay where they start.
During the migration itself, segmentation buys time. Quantum-safe transitions take years, and legacy systems that cannot be upgraded quickly stay exposed throughout. Tight boundaries around them are often the only sensible interim control.
Preparing for Q-Day starts now
Q-Day is the point at which a quantum computer can break today’s public-key cryptography. Nobody knows the date. Everything harvested before it arrives still has to survive it.
A 2030 deadline will not protect data being collected in 2026. Organisations that lack the visibility to migrate away from vulnerable systems, applications and networks are already behind. Adversaries do not need a quantum computer to steal quantum research. They only need access.
Organisations need to protect sensitive data and high-value systems across the full lifecycle. Stronger visibility, an assume breach mindset, crypto agility and microsegmentation help CII owners across Asia Pacific prepare for Q-Day while reducing the risk they carry now.
Quantum readiness cannot wait for quantum-safe migration to be complete. Understand what matters most, limit unnecessary access, and contain attacks before one intrusion becomes something far more consequential.
