Encryption is a quiet foundation of digital trust. It protects government services, financial transactions, critical infrastructure, healthcare records, software updates and digital identities. But that foundation is approaching a major transition. 

Cryptographically relevant quantum computers could break many public-key cryptographic systems used today – with some in Industry estimating this could happen as early as 2029.  

The risk begins before those computers arrive: adversaries can already collect encrypted data now and decrypt it later, an approach known as “Harvest Now, Decrypt Later.” A related “Trust Now, Forge Later” risk could undermine future confidence in digital signatures executed today to validate software, firmware, certificates, business agreements, and transactional records.

Figure: Australian Cyber Security Centre – Planning for post-quantum cryptography

Post-quantum cryptography (PQC) addresses these risks with algorithms designed to withstand attacks from future quantum computers. Despite its name, PQC can be deployed on classical infrastructure today. In 2024, the U.S. National Institute of Standards and Technology finalised its first PQC standards, giving governments and industry a practical basis for migration. 

The CCAPAC Annual Report 2026: Quantum Readiness in Asia — Risks and Opportunities, produced with the assistance of Cisco, finds that progress across Asia Pacific is real but uneven. Its assessment of seven geographies shows different strengths: 

• Australia has strong strategic foundations and international alignment.
• China is investing in both quantum key distribution and PQC.
• India has the ambition and scale to coordinate readiness across a rapidly digitising economy.
• Japan combines strong research capabilities with proactive regulatory engagement.
• Singapore pairs a strong research base with coordinated policy and regulatory engagement.
• South Korea is advancing government-led roadmaps and domestic technology capabilities.
• Taiwan has taken practical steps, including financial-sector guidance and public-sector migration plans.

Quantum readiness is a public policy issue 

PQC migration is more than a cryptographic upgrade. Cryptography is embedded across networks, applications, cloud services, identity systems, operational technology, software supply chains and long-lived data stores. Many organisations do not know where vulnerable algorithms are used. Some suppliers lack clear migration roadmaps, while legacy and embedded devices may need replacing rather than patching.  

Hardware can add a particularly difficult dimension. Some IoT devices, industrial control systems and embedded technologies can lack the flexibility to adopt new NIST PQC  algorithms through a software update. For these systems, quantum readiness may depend on procurement and replacement decisions made years in advance. 

Governments must protect their own systems, but they can also set expectations across critical infrastructure and the wider economy, shape procurement markets and help industry transition.  

Five policy priorities stand out.

1. Treat quantum risk as a national resilience challenge

Quantum risk belongs on the strategic policy agenda, not only within specialist technical teams. Government secrets, health records, identity systems, critical infrastructure controls and code-signing certificates all have long-term confidentiality or trust requirements. Their exposure could affect national security, economic confidence and public trust. 

Policymakers should therefore embed PQC readiness into national cybersecurity strategies, digital economy plans, critical infrastructure frameworks and public sector security requirements. Quantum readiness should be visible to ministers, agency heads, boards and regulators — not confined to specialist technical teams. 

This also requires clearer national timelines. Guidance alone may not create sufficient urgency. Where governments already know that vulnerable cryptography must be retired, they should signal clear milestones for cryptographic inventories, migration plans, high-risk system remediation and eventual deprecation of classical-only public-key cryptography.

2. Build visibility through cryptographic inventories

Organisations cannot prioritise migration without knowing what they need to protect. 

A foundational action is to require, or at least strongly encourage, visibility of ICT assets and cryptographic inventories across government, critical infrastructure and regulated sectors. 

Mature cryptographic inventories should identify vulnerable algorithms, the systems and data that depend on them, how long that data must remain confidential, who controls remediation and whether the system is capable of crypto-agile upgrade —i.e., can the existing hardware support modern and future cryptographic requirements. 

This matters because PQC migration cannot happen all at once. Governments and organisations will need to prioritise systems based on risk, consequence and feasibility. 

Systems protecting long-lived sensitive data, essential services, payments, identities and software signing may need early attention; lower-risk systems may migrate through normal refresh cycles.

3. Use procurement to prevent future legacy risk

Products bought today may remain in service well into the quantum-risk window. Devices with hard-coded cryptography or limited processing capacity may be difficult to upgrade later. 

Government procurement should therefore seek support for approved PQC algorithms, crypto-agility and clear vendor migration pathways across network equipment, cloud and identity platforms, operational technology, IoT devices and managed services. Critical infrastructure operators should also be encouraged to apply similar expectations when procuring particularly high-consequence systems. 

This is not a call for premature replacement. As discussed in Cisco’s blog, Turning End-of-Life Technology Risk into National Advantage, unmanaged legacy technology can become inherited exposure. PQC-ready procurement can help avoid creating the next generation of that risk.

4. Align standards and support interoperability

The CCAPAC report also highlights a major regional risk: standards fragmentation and duplicative testing requirements.  

Asia Pacific markets are taking different approaches to PQC standards and certification. Research diversity is valuable, but incompatible requirements could increase costs, complicate cross-border operations and supply chains, and slow the adoption of security-enhancing technologies, potentially weakening security outcomes. 

Governments should pursue alignment through regional and international standards bodies, alongside mutual recognition of testing, standards crosswalks and interoperability testing. Forums including APEC and ASEAN-related digital economy processes may be helpful in reducing duplication of efforts. 

5. Prioritise critical infrastructure and high-consequence sectors

Critical infrastructure operators face particular challenges in preparing for PQC, while the essential services they provide make timely migration especially important. 

Critical infrastructure often relies on complex, long-life systems with slow replacement cycles and limited opportunities for downtime. Migration must therefore be planned early, tested carefully and aligned with equipment lifecycles. 

Governments should consider incorporating quantum risk into existing critical infrastructure risk-management obligations. Sector-specific guidance can help operators identify cryptographic dependencies, assess “Harvest Now, Decrypt Later” exposure and report progress against milestones. Staged timelines can also help avoid a last-minute rush for specialist talent, trusted vendors and hardware. 

Beyond these five priorities, governments should also consider how smaller organisations can make the transition to PQC. Clear guidance, accessible tools and workforce development can help ensure PQC readiness is not limited to the largest enterprises. Building this capacity early can also ease pressure on scarce expertise as migration accelerates. 

From readiness to resilience 

Asia Pacific has an opportunity to lead.  

The region has world-class digital economies, advanced technology industries, strong cybersecurity institutions and growing quantum research capability. But readiness will not happen by default.  

The policy agenda is clear: elevate quantum risk, build visibility, set timelines, align standards, use procurement, prioritise critical infrastructure, support SMEs and invest in workforce capability.  

The transition to post-quantum cryptography will take years. That is precisely why the work must begin now.  

The quantum era should not be framed only as a threat. Managed well, it can become a catalyst for stronger digital trust, better technology governance and more resilient infrastructure across Asia Pacific.  

The choice before policymakers is not whether to act. It is whether to act early enough to make the transition orderly, interoperable and secure.