ASEAN Post-Quantum Cryptography Readiness 2026 An Empirical Assessment of the ASEAN-10

Résumé fourni par la source

This report assesses publicly verifiable national preparation for the migration to post-quantum cryptography (PQC) across the ten member states of the Association of Southeast Asian Nations assessed in this series (Brunei Darussalam, Cambodia, Indonesia, the Lao People's Democratic Republic, Malaysia, Myanmar, the Philippines, Singapore, Thailand and Vietnam, the "ASEAN-10"), as at 17 August 2026. Timor-Leste, admitted as ASEAN's eleventh member state on 26 October 2025, is excluded from the headline comparative set under the commissioning scope and is assessed separately in Annex A.The assessment was conducted because the discussion of post-quantum readiness has become dominated by declarations of intent. Standards bodies have published algorithms. Governments have published statements. Vendors have published readiness claims. Very little of this establishes what any given state has actually put in place. The question this report addresses is narrower and harder: what can each member state publicly demonstrate that it is doing to govern the replacement of quantum-vulnerable cryptography in its own national estate?The population is fixed at exactly ten states. Each was assessed against the locked five-tier framework carried over unchanged from the EU-27 assessment, running from Tier 1, denoting a government-led national migration programme with substantive implementation machinery, to Tier 5, denoting that no publicly verifiable PQCspecific activity sufficient to meet Tier 4 was identified. Classification rests on national evidence only. Membership of ASEAN, participation in ASEAN cybersecurity cooperation, joint ministerial declarations, and regional capacity-building programmes were each excluded as automatic grounds for elevation. Quantum computing research, quantum key distribution, digital identity sophistication and general cybersecurity maturity were excluded under a strict anti-conflation rule.The headline finding is that ASEAN readiness is real but thin at the top and sparse at the bottom. One state, Malaysia, demonstrates operating national migration machinery: a Cabinet-approved national cryptography policy addressing the quantum era, a statutory directive obliging critical-infrastructure entities to prepare and submit cryptographic migration data, a national migration plan launched by the Chief Secretary to the Government, and an operating national proof-of-concept sandbox. Six further states (Brunei Darussalam, Cambodia, Indonesia, Singapore, Thailand and Vietnam) demonstrate structured government preparation, ranging from a national-CERT migration guideline paired with a central bank's regulator-issued cryptographic requirement (Cambodia) to a published national migration framework with a stated requirement scope (Brunei) and a Prime Ministerial-level programme naming post-quantum cryptography among its research priorities (Vietnam). One state, the Philippines, sits at Tier 3 on a government-funded, named post-quantum cryptography research line, without migration machinery. One state shows a single isolated item of PQC-specific evidence; one state returned no sufficient public PQC evidence under this methodology, on this date, by this search.

Ce résumé expose les affirmations des auteurs. BNTIC ne l’interprète pas comme une validation indépendante des résultats.