Singapore Sets Quantum-Safe Deadlines and Funds OT Migration

On 16 October 2026, the Cyber Security Agency of Singapore (CSA) published a new advisory on migrating to quantum-resistant cryptography. The document is aimed at organizations exposed to quantum-related cyber risk and sets out specific dates. It explicitly names OT and legacy systems among the priority use cases.

The Deadlines

The CSA recommends that exposed organizations meet these milestones:

• by 2027: have a migration plan in place;
• by 2035: complete the transition, in line, according to the source, with international guidance;
• by 2031: for Critical Information Infrastructure (CII) systems, a target derived from the guidelines the CSA sent to CII owners in June 2026.

The Quantum-Safe Kickstarter Grant

Alongside the deadlines comes an incentive: the Quantum-Safe Kickstarter Grant, a time-limited seed funding scheme for pilot projects. The program runs from 1 November 2026 to 31 October 2027, and each pilot can last up to six months. It is open to all organizations, with priority given to CII owners, and participants must report the results achieved and the impact demonstrated.

The priority use cases are:

• end-to-end migration of applications or systems;
• cryptographic discovery and inventory;
• migration of OT, legacy and infrastructure-intensive systems.

Following a public consultation, the CSA has also updated the Quantum Readiness Index and the Quantum-Safe Handbook.

Why Cryptography Is a Long-Term Problem

It is not certain when quantum computers will be able to break the most widely used cryptography today. The CSA points out, however, that cryptography is embedded in applications, networks and infrastructure and involves many vendors. Identifying dependencies and replacing them without disrupting operations takes time, particularly for critical infrastructure and legacy systems.

Cryptography is everywhere: finding it and changing it without stopping operations takes years, not weeks.

First Steps Suggested by the Handbook

The handbook advises against attempting a full audit in one go, and instead recommends starting with the most exposed systems:

• data that must remain confidential for years;
• internet-facing systems, such as VPNs, email and cloud services;
• long-lifecycle equipment, such as building management systems, industrial control systems and production machinery, which is hard to update quickly.

Next come assigning clear responsibilities, for example with a RACI model, identifying, evaluating and testing quantum-safe solutions for priority systems, and involving vendors and technology partners. The sources consulted do not cover further steps.

What This Means for OT Teams

Industrial plants are cited among the long-lived assets that are difficult to update. A practical starting point is a cryptographic inventory of PLCs, HMIs, SCADA, remote access and VPN connections: which protocols and algorithms they use, which firmware handles them, and which vendor is responsible for updates.

The grant is a Singapore program, and the source does not say whether equivalent measures exist in other regions. Still, the 2027, 2031 and 2035 milestones offer a reference timeline for those operating elsewhere, where plant lifecycles often exceed ten years.

A Practical Takeaway

In the coming months, it makes sense to appoint an owner, choose a limited scope of exposed or long-lived systems and start the inventory, then ask vendors about their roadmaps. A migration plan by 2027 is a realistic goal if you begin with visibility into what is deployed in the field today.