PQC Governance Digest | Cut-off 6 November 2026
Five signals this week. The centre of gravity has shifted from standard-setting to supply chain accountability and financial sector execution.
Three of the five signals concern how organisations and regulators should evaluate, structure, and enforce post-quantum readiness across their supply chains and supervised institutions. Australia's ASD ACSC, the US NSA and CISA jointly published updated vendor readiness guidance. HKMA issued a practical migration toolkit to every authorised institution in Hong Kong. MAS opened a formal consultation on proposed supervisory expectations and indicative quantum-safe migration timelines for financial institutions in Singapore. Two IETF drafts advanced protocol infrastructure: an MLS Working Group draft submitting post-quantum cipher suites for IESG review, and an individual submission addressing cryptographic integrity for autonomous AI agent delegation chains.
No qualifying signals were identified in Latin America or Africa and the Middle East.
Prior editions: Cut-off 30 October 2026 | Cut-off 16 October 2026 | Cut-off 9 October 2026
🇦🇺🇺🇸 Australian and US Agencies Update PQC Vendor-Readiness Guidance
#supply-chain #procurement #vendor-readiness #Australia #United-States
The Detail
Australia's ASD ACSC, the US NSA, and CISA jointly published an updated edition of "Post-quantum questions to ask your vendors: evaluating third-party readiness for post-quantum cryptography" on 4 November 2026. The original was published by ASD in July 2026; this November update is a joint edition with NSA and CISA. The 19-page guidance document provides practical questions for organisations to pose during procurement, contract renewals, and ongoing supplier reviews.
The questions follow ASD's LATICE framework across five phases: locate and inventory cryptographic dependencies; assess risk; triage and prioritise systems; implement PQC algorithms; communicate with vendors and educate stakeholders.
Key areas of inquiry include whether vendors maintain a cryptographic bill of materials (CBOM), whether firmware can accept PQC signatures without hardware replacement, and whether vendors commit to dated PQC-ready releases before end of 2030.
A quick-reference list accompanies the full guidance document.
Primary source: NSA Press Release, 4 November 2026
Why it matters: Procurement teams now have a government-endorsed, multi-agency framework for holding suppliers accountable to specific, dated PQC migration commitments. The guidance operationalises what NIST IR 8547 and EO 14412 set as policy: vendor PQC readiness is a compliance consideration, not a future aspiration. Organisations using this questionnaire can establish contractual baselines for supplier cryptographic maturity before CNSA 2.0 procurement gates for National Security Systems take effect on 1 January 2027.
🇭🇰 HKMA Launches PQC Toolkit for Banks; Sector Scores 2.3 out of 10
#banking #governance #migration-planning #Hong-Kong
The Detail
The Hong Kong Monetary Authority (HKMA) and the Hong Kong University of Science and Technology (HKUST) launched a Post-Quantum Cryptography Toolkit on 2 November 2026. The toolkit was issued as a circular to all Authorised Institutions in Hong Kong.
The framework is organised around four pillars: governance and accountability, evaluation of cryptographic exposure, determination of transition requirements, and ongoing progress tracking. It includes methods for inventorying cryptographic assets, frameworks for prioritising migration, protocols for vendor collaboration, and templates for transition schedules.
The toolkit builds on the HKMA's Quantum Preparedness Index (QPI), launched in July 2026, where the sector scored 2.3 out of 10. The target is a QPI score of 10 by 2030.
Arthur Yuen, HKMA Deputy Chief Executive, stated: "The Quantum Preparedness Index has established a clear starting point for the sector." The toolkit, he said, gives banks a shared base they can adapt to their own circumstances.
Primary source: HKMA Press Release, 2 November 2026
Why it matters: A sector-wide score of 2.3 out of 10 with a 2030 target quantifies the gap between current readiness and regulatory expectation. The toolkit converts that gap into structured work. HKMA is treating PQC migration as a governance exercise, with accountability, inventory, and progress tracking built into the framework from the outset.
🇸🇬 MAS Opens Consultation on Quantum-Safe Migration Timelines for Financial Sector
The Detail
The Monetary Authority of Singapore (MAS) published Consultation Paper P019-2026 on 6 November 2026, seeking feedback on a proposed MAS Circular that would set supervisory expectations for financial institutions in Singapore to prepare for quantum-safe migration.
The proposed Circular includes indicative milestones and completion timelines. The consultation runs from 6 November to 23 November 2026.
This follows MAS Managing Director Chia Der Jiun's July 2026 announcement that MAS aims for financial institutions to achieve quantum resilience "before the end of this decade."
Primary source: MAS Consultation Paper P019-2026, 6 November 2026
Why it matters: MAS is moving from voluntary guidance toward supervisory expectations. A Circular, once finalised, carries regulatory weight: it would define what MAS holds institutions accountable for. Financial institutions operating in Singapore should submit responses by 23 November. In our assessment, the 17-day consultation window suggests that MAS considers the policy direction settled and is seeking implementation feedback, not directional input.
🌐 IETF Advances ML-KEM Hybrid Cipher Suites for Messaging Layer Security
The Detail
The IETF MLS Working Group published version 07 of draft-ietf-mls-pq-ciphersuites on 1 November 2026. The draft registers new cipher suites for the Messaging Layer Security (MLS) protocol that use ML-KEM alone or in hybrid combinations with traditional elliptic curve key encapsulation mechanisms.
Hybrid suites pair ML-KEM-768 or ML-KEM-1024 with X25519, P-256, or P-384 key agreement. Some suites also use ML-DSA post-quantum signatures. The document has been submitted to the IESG for publication as a Proposed Standard.
Primary source: IETF Datatracker, 1 November 2026
Why it matters: MLS underpins end-to-end encrypted group messaging across multiple platforms. The draft has been submitted to the IESG for publication as a Proposed Standard; once approved, deployments could adopt quantum-resistant key establishment without waiting for the full standardisation track to complete. The hybrid approach provides defence in depth during the transition period.
🌐 New IETF Draft Proposes PQC Profile for AI Agent Delegation Chains
The Detail
A new IETF Internet-Draft, "Post-Quantum Hybrid Cryptographic Delegation Chains and Merkle-Aggregated Execution Receipts for Autonomous AI Agents" (draft-durga-pquip-pqc-agentic-delegation-00), was published on 31 October 2026.
The draft proposes a post-quantum cryptographic profile for AI agent delegation and execution receipts. It specifies hybrid Ed25519 + ML-DSA-65 signatures on the hot path (real-time operations), with Merkle-folded delegation hops. For cold-path long-term non-repudiation of archived trace records, it uses SLH-DSA-SHAKE-128f.
The author is Raghuvar Karthik Durga (Microsoft). This is an individual submission (version 00), not yet adopted by a working group.
Primary source: IETF Datatracker, 31 October 2026
Why it matters: As AI agents perform tasks on behalf of organisations, the integrity and provenance of their actions become a governance question. This draft addresses the intersection of post-quantum signatures, agent delegation and archival evidence. It is an individual submission at version 00, so it is early-stage, but it signals convergence between PQC and AI governance that is worth tracking.
Global Sweep
Borderline items not qualifying as full signals:
NIST SP 800-108 Revision 2 pre-draft call (4 November 2026). NIST issued a pre-draft call for comments on revising SP 800-108r1, the recommendation for key derivation using pseudorandom functions. Recent cryptanalytic research raised concerns about output indistinguishability and key-control security in certain KDF constructions. Comments close 18 December 2026. Not a PQC instrument directly, but KDF security properties underpin post-quantum key establishment. Source: NIST CSRC.
IETF constrained devices draft v11, IESG evaluation (5 November 2026). The draft on adapting PQC for hardware security modules and constrained devices (draft-ietf-pquip-pqc-hsm-constrained) is in IESG Evaluation with a status of "Revised I-D Needed" and a DISCUSS position outstanding. Source: IETF Datatracker.
CSA Singapore Quantum-Safe Kickstarter Grant (applications opened 1 November 2026). The grant programme was announced on 14 October 2026 at Singapore International Cyber Week. The application window opened on 1 November. Priority use cases include CII system migration, cryptographic discovery, and OT/legacy system migration. The main policy announcement was covered in the Cut-off 16 October edition. Source: CSA Singapore.
ECB SSM action plan deadline (31 October 2026). Significant institutions supervised by the ECB were required to submit action plans on AI-enabled cybersecurity threats by this date, under letter SSM-2026-0301 (issued July 2026). The letter explicitly states that "progress toward practical quantum computing will have a significant impact on the cybersecurity landscape" and that adopting "post-quantum cryptography may involve a longer time frame but must start now." The ECB has announced a separate, forthcoming supervisory letter dedicated to quantum risks. Source: ECB SSM Letter.
Unverified lead: RBI published Master Directions on Cyber Resilience and Digital Payment Security Controls for Non-Bank Payment System Operators on 5 November 2026. The full text is behind a CAPTCHA and could not be retrieved. It is unknown whether the document includes quantum-risk or PQC provisions.
SITG-Consulting Comment
Three observations from this week's scan.
PQC governance is entering the procurement phase. The ASD-NSA-CISA vendor readiness guidance turns migration pressure into questions that contracting officers can ask today: what cryptography is embedded, what needs replacing, and when supported PQC releases will arrive. Organisations that have not assessed their suppliers' cryptographic maturity now have a concrete, multi-agency tool for doing so.
Asia-Pacific financial regulators continue to set the pace on specificity. HKMA's QPI score of 2.3 out of 10 is a rare quantified baseline in a field where readiness claims are typically qualitative. MAS's proposed Circular would formalise supervisory expectations for quantum-safe migration, including indicative milestones and completion timelines. Taken together with CSA Singapore's migration timeline (CII by 2031; other quantum-exposed organisations encouraged to migrate by 2035, with plans recommended by 2027), Singapore and Hong Kong have published specific, dated PQC migration frameworks with quantified baselines; comparable specificity in financial regulation is not yet visible in Europe or North America.
The IETF AI agent delegation draft is early-stage but structurally significant. As autonomous agents proliferate, the question of how to build a quantum-resistant audit trail for their actions is no longer theoretical. The fact that an IETF submission now proposes a concrete cryptographic profile for agent delegation and archival evidence is worth watching.
If your organisation is assessing its post-quantum readiness or supply chain exposure, SITG-Consulting's Quantum Trust PQC Assurance services can help structure that work.
What Was NOT Missed
Regions checked with no qualifying signals beyond those listed above: Europe (ENISA, European Commission, ECB, EBA, ESMA, BSI, ANSSI, NCSC UK, BaFin, FCA, PRA, DNB, NCSC-NL checked; ECB deadline event noted in Global Sweep); India and South Asia (MeitY, CERT-In, RBI, SEBI, DST, DRDO, DSCI, IDRBT, PTA Pakistan, SBP Pakistan, Bangladesh Bank, CBSL Sri Lanka checked; RBI Master Directions unverified lead noted); North America (NIST CSRC, NSA/CNSA, CISA, OMB, DHS, DoD CIO, GAO, Treasury/OCC, SEC, Federal Reserve, FFIEC, CCCS, CSE checked; Signal 1 issued by NSA and CISA; NIST SP 800-108r2 noted in Global Sweep); Latin America (null); Africa and Middle East (null).
Multilateral and standards bodies checked with no qualifying signals: ISO/IEC JTC 1/SC 27, ETSI QSC, ITU-T SG17, W3C, BIS, FSB, WEF, G7/G20, NATO, OECD, FIRST.org, OASIS, IEEE.
Central banks checked with no PQC speeches or statements in window: Federal Reserve, Bank of England, Bank of Japan, ECB, Deutsche Bundesbank, Banque de France, Bank of Canada, RBA, PBOC, SNB, SAMA.
Tier 2 vendor leads noted but not cited as sources: IBM unified Quantum Safe suite, announced on 27 October and covered by Quantum Computing Report on 31 October; IonQ's acquisition of Elisity, completed on 3 November and announced on 4 November (Form 8-K dated 5 November). Vendor releases are tracked for context but excluded from the signal set per editorial policy.
Blocked or inaccessible sources: BIS Denis Beau speech full text (client error); CISA multiple pages (403/connection refused); RBI Master Directions PDF (CAPTCHA); PBOC English page (robots.txt); PTA Pakistan, SBP Pakistan (site errors). These limitations are disclosed; no finding was inferred from content that could not be verified.
Forward Watch: 7 to 13 November 2026
MAS P019-2026 consultation closing 23 November. CNSA 2.0 procurement gate for National Security Systems approaching (1 January 2027, 55 days from end of window). EO 14412 FAR proposed rule deadline 19 December 2026. EO 14412 s.5(d) CBOM minimum elements deadline approximately 19 March 2027.
Disclaimer: This digest is published by SITG-Consulting for informational purposes. It does not constitute legal, regulatory or technical advice. Primary sources are cited for publication and policy claims. Regional scan results reflect SITG-Consulting's own research window and accessible sources. Readers should verify applicability to their jurisdiction and circumstances.
Comments