Malaysia Achieves Tier 1 Status in Post-Quantum Cryptography Readiness

Brian Couzens

Sep 27

3 min read

Updated: Oct 6

On 15 September 2026, Malaysia's National Security Council (Majlis Keselamatan Negara), an agency of the Prime Minister's Department, confirmed Malaysia as the only ASEAN member state at Tier 1 for post-quantum cryptography migration readiness. The assessment behind that finding is SITG-Consulting's ASEAN Post-Quantum Cryptography Readiness 2026: An Empirical Assessment of the ASEAN-10, published on 1 September.

The statement and the report were reported by:

Bernama, Malaysia's national news agency
RTM, Malaysia's national broadcaster
Business Today
Sinar Daily
Sarawak Tribune
VietnamPlus, the English-language service of Vietnam's national news agency VNA

Insights from the Council

The Council described the Tier 1 position as a reflection of Malaysia's preparation to protect government data, financial transactions, digital identities, communications, and critical services from the future threat that quantum computing poses to today's encryption.

The assessment criteria focused on nationally verifiable action and implementation, not on statements of intent. This distinction is crucial. The report separates what a state has implemented from what it has merely announced. A national security body has accurately recognised this difference.

Malaysia's Unique Position

Tier 1 does not mean migration is complete. No state currently meets that standard. A framework built around it would measure nothing. Tier 1 assesses whether national migration machinery exists and operates effectively.

Malaysia is the only ASEAN state where this machinery is demonstrably in place. The assessment identified four key elements working together:

A Cabinet-approved national cryptography policy, MyKriptografi
A directive issued under the Cyber Security Act 2024, obligating specific organisations to act
A national post-quantum migration plan with a 2030 horizon
An operational proof-of-concept sandbox that funds participants

Sector regulators have begun translating national instruments into their own requirements. Each element alone would place a state at Tier 2. The combination, actively running, elevates Malaysia to Tier 1.

Regional Landscape

Six states currently sit at Tier 2: Brunei Darussalam, Cambodia, Indonesia, Singapore, Thailand, and Vietnam. Each has a named national authority and a substantive instrument. However, none had converted guidance into a binding obligation with a defined population as of the evidence cut-off date.

Singapore's position illustrates this boundary. Its guidance is authoritative, and its milestones are dated. However, those milestones are expressly non-mandatory. The sophistication of discourse does not equate to the sophistication of governance. This assessment measures the latter.

The Philippines is classified at Tier 3, based on funded research rather than migration machinery. Laos is at Tier 4. Myanmar is at Tier 5, defined carefully: sufficient publicly verifiable, post-quantum-specific evidence was not found under this method on this date. This is not a finding of inactivity.

The distribution of tiers does not follow size, wealth, or digital reputation. Brunei Darussalam, one of the bloc's smallest states, has published one of the most comprehensive national frameworks reviewed in this series.

Understanding the Findings

Three qualifications accompany the results, applicable to Malaysia and others.

First, the classification is a point-in-time finding, with an evidence cut-off of 17 August 2026. Every state, including Malaysia, will be re-tested at the next evidence pass.

Second, the report has already updated its findings. Two rounds of independent audits moved Cambodia up twice and the Philippines once. Every change is documented with its reasoning. Open verification items are published, detailing actions needed to close each one.

Third, Tier 1 is a statement about national machinery, not about individual organisations. A bank, hospital, or utility operating in Malaysia is not considered migrated because the state has a plan. These entities are obliged to act, which is a different matter.

Future Directions

The Council has indicated that the next phase will focus on collaboration between lead agencies for National Critical Information Infrastructure, operators of that infrastructure, and industry partners.

This stage is critical. National programmes can either succeed or stall here. Policy sets direction. Migration occurs within cryptographic inventories, supplier contracts, procurement specifications, and the dependency chains beneath them. The organisations named in the directive now bear the responsibility for this work, and their boards carry the accountability.

For boards and regulators in ASEAN, the Malaysian sequence offers a valuable lesson: policy first, then a binding instrument with a named population, followed by a plan with a date, and finally a testing ground before committing. The EU's Coordinated Roadmap and the United Kingdom's National Cyber Security Centre timelines follow this same order, with inventory ahead of deadlines.

Read the Report

The full assessment is available on Zenodo under a Creative Commons Attribution 4.0 licence, free to read, reuse, and challenge.

SITG-Consulting (2026). ASEAN Post-Quantum Cryptography Readiness 2026: An Empirical Assessment of the ASEAN-10. Version 1.2. Zenodo. https://doi.org/10.5281/zenodo.22218529

Test it against your own retrieval and tell us where it is wrong.