PQC Governance Digest: Cut-off 16 October 2026
Singapore extended its June 2026 CII quantum-safe migration timeline to other quantum-exposed organisations, publishing an advisory and updated resources and launching a new grant. Germany published a cross-ministerial guideline implementing the EU PQC roadmap at national level. On the standards track, the X.509 Composite ML-KEM specification entered the RFC Editor Queue and two further IETF post-quantum drafts progressed, while AWS published an end-to-end ML-DSA deployment and governance guide combining ML-DSA support added to AWS KMS on 13 June 2025, AWS Private CA on 10 November 2025 and IAM Roles Anywhere on 9 March 2026. The OMB M-26-15 migration plan deadline falls on 22 October, six days from this cut-off.
This edition covers material published between 10 and 16 October 2026. The prior edition is PQC Governance Digest: 9 Oct 2026.
🇸🇬 Singapore Extends Quantum-Safe Migration Timeline Beyond CII and Launches Kickstarter Grant
Theme: #QuantumSafe #CII #Migration #ASEAN #SeedFunding
The Detail
In June 2026, CSA issued migration guidance to owners of critical information infrastructure (CII). At Singapore International Cyber Week on 14 October 2026, CSA published an advisory extending the timeline to other quantum-exposed organisations, released updated supporting resources and launched a new grant.
CSA's supporting grant page states that CII owners will need to submit migration plans by 31 March 2027, factor quantum-safe considerations into new CII procurements from 2028, and complete migration by 31 December 2031. The press release published during this window says other organisations exposed to the quantum threat are encouraged to complete migration by 2035; the grant page recommends that they have a quantum-safe migration plan in place by end-2027.
CSA simultaneously launched the Quantum-Safe Kickstarter Grant, running from 1 November 2026 to 31 October 2027. The grant provides seed funding for pilot projects of up to six months. The announcement highlights three priority areas: end-to-end migration, cryptographic discovery and inventory, and migration of OT, legacy and infrastructure-heavy systems. The detailed grant page also lists crypto-agility implementation and exploration of complementary quantum-enabled solutions, and describes all five as illustrative. The press release says the grant is open to all organisations, with priority given to CII owners; the detailed grant page limits eligibility to non-government organisations registered and incorporated in Singapore, for activities within their Singapore-based operations. Applications are now open, and grants are awarded on a first-come-first-serve basis, subject to CSA's assessment.
An updated Quantum Readiness Index and Quantum-Safe Handbook were published following public consultation. No specific algorithms are named in the announcement; CSA references "quantum-safe cryptography standards" generally.
Why it matters
CSA has published specific planning, procurement and completion milestones rather than a general statement of intent. Singapore's CII completion date of 31 December 2031 is one year later than the EU high-risk target of end-2030. Its 31 March 2027 planning deadline and 2028 procurement milestone nevertheless create concrete nearer-term requirements for CII owners. The grant funds practical pilots, including discovery, end-to-end migration and work on legacy or OT environments. For CII owners, the 31 March 2027 planning deadline makes cryptographic discovery a practical near-term priority.
🇩🇪 Germany Publishes National PQC Migration Guideline Implementing EU Roadmap
The Detail
On 12 October 2026, the German Federal Ministry of the Interior (BMI), the Federal Ministry for Digital Transformation and Government Modernisation (BMDS) and the Federal Office for Information Security (BSI) jointly published a guideline titled "Nationale Umsetzung der EU-Roadmap zur Umstellung auf Post-Quanten-Kryptografie" (National implementation of the EU roadmap for the transition to post-quantum cryptography).
The joint BMI-BMDS-BSI guideline provides structured recommendations for national implementation of the EU roadmap. It says high-risk use cases should migrate as soon as possible and no later than the end of 2030, while the overall transition should be largely complete by 2035. It recommends clear responsibilities and binding deadlines for the transition, systematic quantum-risk assessment, state-of-the-art PQC and early supply-chain engagement, and describes crypto-agility across system architectures, procurement processes and risk management as particularly important. The target audience is federal, state and municipal administrations, organisations, companies and operators of critical infrastructure.
The document is a joint cross-ministerial Leitlinie (policy guideline), not a Verordnung (regulation); the BSI release identifies no sanctions or independent legislative mandate.
Why it matters
The guideline carries the EU deadlines into a German national implementation framework. For organisations operating in Germany or supplying German critical infrastructure, the guideline identifies cryptographic agility, including in procurement processes, as particularly important.
🌐 IETF PQC Drafts Progress: X.509 ML-KEM Enters RFC Editor Queue, Constrained-Devices Draft Nears Telechat
The Detail
Three post-quantum Internet-Drafts progressed during the window:
X.509 Composite ML-KEM entered the RFC Editor Queue on 12 October 2026 at draft-22, the version tracked in the prior edition; draft-23 was posted on 14 October. The draft defines how X.509 certificates carry hybrid PQC key encapsulation, an important building block for enterprise and government PKI migration.
CMS Composite ML-KEM (draft-04) was revised on 15 October 2026 while in the RFC Editor Queue, which it entered on 18 September following its IESG telechat. This draft defines hybrid combinations of FIPS 203 ML-KEM with classical algorithms (RSA-OAEP, ECDH, X25519, X448) for Cryptographic Message Syntax applications including S/MIME email encryption.
PQUIP Adapting Constrained Devices for Post-Quantum Cryptography (draft-08) remains in IESG Evaluation, revised on 14 October 2026, and is on the telechat agenda for 22 October. This informational draft addresses PQC implementation challenges in IoT devices and constrained cryptographic modules, including secure elements, TPMs and small HSMs.
Why it matters
The RFC Editor Queue is the post-IESG pre-publication process, although reference, IANA and editorial work can remain. Both composite ML-KEM drafts are now in the queue: X.509 entered on 12 October, and CMS has been there since September. The constrained-devices draft is directly relevant to environments where cryptographic infrastructure depends on hardware modules and IoT endpoints with limited processing power, RAM and flash memory.
🌐 AWS Publishes End-to-End ML-DSA Deployment and Governance Guide
The Detail
On 12 October 2026, AWS published a two-part Security Blog series on building and governing an end-to-end quantum-resistant signing system, combining generally available ML-DSA capabilities across AWS KMS, AWS Private CA and IAM Roles Anywhere. AWS announced ML-DSA support in KMS on 13 June 2025 (key specs ML_DSA_44, ML_DSA_65 and ML_DSA_87), in AWS Private CA on 10 November 2025 and in IAM Roles Anywhere on 9 March 2026; the October series is a deployment and governance guide, not a service launch.
Part 1 details a Private CA hierarchy with an ML-DSA-87 root and ML-DSA-65 subordinate, IAM Roles Anywhere integration for CI/CD build agents, and SBOM signing. For payloads exceeding the 4,096-byte RAW limit, the guide uses the externally calculated 64-byte mu value with the EXTERNAL_MU method. Part 2 covers algorithm policy enforcement via Service Control Policies using the kms:KeySpec condition key, with deny-list and allow-list patterns and CloudTrail-based detective controls. SCPs apply to member accounts and organisational units but not the management account. The kms:SigningAlgorithm condition key cannot distinguish between parameter sets, as all three use ML_DSA_SHAKE_256. AWS Private CA currently has no algorithm-specific IAM condition key, so CA algorithm policy must be enforced through restricted provisioning, fixed templates, CloudTrail and AWS Config.
The series references CNSA 2.0 acquisition requirements (all new National Security System acquisitions must be CNSA 2.0 compliant from January 2027) and maps to EU Cyber Resilience Act obligations taking full effect 11 December 2027. AWS describes it, "as of Oct 2026", as "the first end-to-end guide from any cloud provider for post-quantum signing across the software supply chain"; this is AWS's own claim about the guide, not about service availability.
Why it matters
The guide demonstrates organisational ML-DSA controls by combining AWS KMS support available since June 2025 with ML-DSA capabilities added subsequently to AWS Private CA and IAM Roles Anywhere. The SCPs are example policies; AWS advises testing all policies in a non-production environment before deployment and adjusting example values. For National Security System acquirers facing CNSA 2.0 acquisition gates, and software producers subject to the CRA, AWS documents preventive and detective controls for the covered service APIs, subject to the limitations identified in the guide. ML-DSA-65 signature size (3,309 bytes versus 64 bytes for ECDSA P-256) remains a practical consideration for high-throughput systems.
Sources: AWS Security Blog Part 1 | AWS Security Blog Part 2 | AWS KMS ML-DSA announcement, 13 June 2025 | AWS Private CA ML-DSA announcement, 10 November 2025 | IAM Roles Anywhere ML-DSA announcement, 9 March 2026
Borderline and Watch Items
ECB Supervisory Board Vice-Chair Elderson cites quantum risk to cryptography in climate-risk keynote (14 October). At the ECB-Bank of England conference on supervising climate risk, Elderson cited quantum computing as an example of a technology with non-linear effects, stating "Quantum risk to cryptography is already a risk" and referring to "harvest now, decrypt later" exposure. This follows his 30 September remarks at the BCBS conference in Bali, logged in the 2 October edition. No supervisory expectation, deadline or publication announced. ECB speech, 14 October 2026
Singapore Cybersecurity Strategy 2026 Pillar 3 (13 October). Senior Minister K Shanmugam launched the strategy at SICW, with Pillar 3 (Strengthen Capabilities for AI and Quantum) including a commitment to accelerate national quantum-safe migration, within a five-year strategy of four pillars and two enablers. The strategy provides the policy umbrella for the CSA migration timeline above; its press release sets no deadlines, which sit in the CSA migration timeline. CSA press release, 13 October 2026
GAO-27-108740 reissued with revisions (14 October). The GAO report on federal PQC readiness, published 6 October and covered in the prior edition, was reissued on 14 October. GAO's errata says the revisions clarify the highlights-page summary and text concerning coordination with executive-branch agencies to obtain agreement that sensitive information was appropriately removed. GAO-27-108740
FIPS 140-2 status. After 21 September 2026, the remaining FIPS 140-2 validations moved off the CMVP Active list. From 22 September, only FIPS 140-3 validations remained Active. Per the CMVP FAQ, Historical status does not mean the certificate has been revoked, although the certificate may no longer reflect how the module can be used in approved mode. In SITG-Consulting's reading, whether a Historical module remains acceptable is a matter for the governing procurement or assurance requirement, not the FAQ. NIST CMVP FAQ
Global Sweep
Region | In-window signals | Status |
Global | IETF X.509 Composite ML-KEM (entered RFC Editor Queue), IETF CMS Composite ML-KEM revision, IETF PQUIP constrained devices, AWS ML-DSA deployment guide | Active |
North America | GAO-27-108740 reissued with clarifying revisions; AWS guide classified under Global because of worldwide applicability | Watch only |
Europe | BSI/BMI/BMDS Germany national PQC migration guideline; ECB Elderson speech (borderline) | Active |
Asia-Pacific | CSA Singapore migration timeline and Kickstarter Grant; Singapore Cybersecurity Strategy 2026 (borderline) | Active |
India and South Asia | No qualifying in-window signal | Null |
Latin America | No qualifying in-window signal | Null |
Africa and Middle East | No qualifying in-window signal | Null |
Approaching Deadlines
OMB M-26-15 migration plan deadline: 22 October 2026. Federal agencies are required to submit PQC migration plans to OMB and the Office of the National Cyber Director (ONCD) within 120 days of the memorandum (dated 24 June 2026). OMB M-26-15. No public announcement of submissions or extensions has been identified.
IETF PQUIP constrained-devices telechat: 22 October 2026. If approved, the draft should enter the post-IESG publication process.
CMMC Phase II: suspended. The originally scheduled 10 November 2026 transition is no longer an approaching deadline. Phase I Level 1 and Level 2 self-assessment requirements remain in force. The deviation memo is not retrievable by automated tools; status confirmed from the memo directly. DFARS class deviation 2026-O0025 Rev 3
SITG-Consulting Comment
Singapore restated its June 2026 CII planning, procurement and completion milestones, extended a recommended timeline to other quantum-exposed organisations, and paired both with pilot funding. Germany translated the EU timetable into a joint national implementation guideline, although the document remains guidance rather than regulation.
At the IETF, the two composite ML-KEM specifications were in the RFC Editor Queue at the cut-off. The constrained-devices draft remained in IESG Evaluation ahead of its 22 October telechat. These are material standards milestones, but none of the three documents should be described as a published RFC yet.
AWS's two-part guide shows how ML-DSA policy can be implemented across selected AWS service APIs through SCPs, IAM controls, controlled provisioning, CloudTrail and AWS Config. AWS also documents important limitations: SCPs do not govern customer-controlled cryptography, do not apply to the management account, and cannot directly select the AWS Private CA algorithm through an algorithm-specific condition key.
The OMB M-26-15 deadline arrives on 22 October. GAO's October assessment provides the latest published baseline: none of the 24 selected agencies had fully addressed all three preparatory practices in GAO's framework. GAO-27-108740
What Was NOT Missed
The following were checked and returned no qualifying in-window signal: NIST CSRC, NIST NCCoE, CISA, ONCD, OSFI, Bank of Canada, ENISA, ETSI, EBA, ESMA, EIOPA, NCSC UK, ANSSI, Bundesbank, NCSC-NL, DNB, ACN Italy, MAS, Bank of Japan, FSA Japan, CRYPTREC, Korea FSC/KISA, APRA, ASD ACSC, RBI, SEBI, CERT-In, MeitY, SARB, BIS, BCBS, FSB, IOSCO, IMF, ITU, WEF, Europol, Microsoft, Google, IBM, Cloudflare, Apple, Oracle, Akamai. Central bank speech registers for the Federal Reserve, Bank of England, Bundesbank, Bank of Japan and RBI were also checked.
Forward Watch: 17 to 23 October 2026
OMB M-26-15 migration plan submission deadline (22 October)
IETF PQUIP constrained-devices telechat (22 October)
CSA Singapore Quantum-Safe Kickstarter Grant applications remain open
Previous Editions
To assess your organisation's quantum-safe readiness or begin a structured migration, visit SITG-Consulting Quantum Trust PQC Assurance Services.
This digest is published by SITG-Consulting and covers post-quantum cryptography governance, regulatory and standards developments. It is not legal advice. Dates and deadlines are stated as precisely as the verified primary sources allow. Where a primary source was not independently accessible, the attribution is noted. All signals were verified at their respective primary sources. Published editions are not edited after posting; corrections are applied to future editions.
Comments