Expose the Evidence: ASEAN PQC (Post Quantum Cryptography) Readiness 2026
Expose what ASEAN member states can actually demonstrate about post quantum migration. Not what they intend. Not what they announce. What they can prove.
SITG Consulting has released ASEAN Post Quantum Cryptography Readiness 2026, published on Zenodo under CC BY 4.0: https://doi.org/10.5281/zenodo.22218529
The report assesses all ten ASEAN member states against the same locked five tier framework applied to the EU 27 and the United Kingdom. Evidence cut off: 17 August 2026. Population: exactly ten states. Method: publicly verifiable national evidence only.
Declarations of intent do not count. Vendor claims do not count. Regional cooperation does not count. Quantum research does not count. Only what each state can demonstrate it is doing to govern the replacement of quantum vulnerable cryptography in its own national estate.
Malaysia: The Region’s Only Tier 1
Malaysia is the only ASEAN state with operating national migration machinery.
The evidence includes:
Cabinet approved national cryptography policy addressing the quantum era
Statutory directive under the Cyber Security Act 2024 obliging critical infrastructure entities to prepare and submit cryptographic migration data
National migration plan launched by the Chief Secretary to the Government
National proof of concept sandbox awarding grants before the plan was publicly launched
This is machinery in operation, not aspiration.
Singapore: Tier 2, Not Tier 1
Singapore’s guidance is technically mature and its milestones are dated. But every milestone retrieved or corroborated is non mandatory.
Sophistication of discourse is not the same as sophistication of governance.
Singapore sits at Tier 2.
Structured Preparation Across Six States
Six further ASEAN members demonstrate structured government preparation:
Brunei Darussalam
Cambodia
Indonesia
Thailand
Vietnam
Singapore
Seven of ten ASEAN states therefore sit at Tier 1 or Tier 2.
Sparse or Isolated Evidence at the Bottom
The Philippines sits at Tier 3 on a government funded, named PQC research line without migration machinery
One state shows a single isolated PQC specific item
One state returned no sufficient public PQC evidence under this method, on this date, by this search
The report states this explicitly rather than implying inactivity.
Two Rounds of Hostile Audit
The report has already undergone two adversarial audit rounds across multiple AI models. Both rounds moved classifications upward.
It also:
Corrected one of its own citations
Narrowed the claim resting on that citation rather than quietly replacing it
Moved Cambodia upward twice across three versions
Moved the Philippines upward once
Published all four open verification items with the exact action required to close each one
The audit trail is deposited with the report, not promised.
Abstract
This report assesses publicly verifiable national preparation for migration to post quantum cryptography across the ASEAN 10 as at 17 August 2026. Timor Leste, admitted as ASEAN’s eleventh member state on 26 October 2025, is excluded from the headline comparative set and assessed separately in Annex A.
The assessment addresses the gap between declarations of intent and demonstrable national action. The framework runs from Tier 1 to Tier 5. Classification rests strictly on national evidence. Regional cooperation, general cybersecurity maturity, quantum research, quantum key distribution and digital identity sophistication were excluded under anti conflation rules.
Headline finding: ASEAN readiness is real but uneven. Malaysia demonstrates operating machinery. Six further states demonstrate structured preparation. One state sits on named PQC research without machinery. One shows a single isolated item. One shows none under this methodology.
Full report: https://doi.org/10.5281/zenodo.22218529
Read it. Test it. Challenge it.
Every load bearing claim carries its source at the point of the claim, keyed to a 38 entry register. The framework is locked. The gaps are published. The audit trail is public.
If your organisation touches ASEAN, directly or through supply chains, this is the evidence base.
Comments