ASEAN Post-Quantum Cryptography Readiness 2026 An Empirical Assessment of the ASEAN-10

This report assesses publicly verifiable national preparation for the migration to post-quantum cryptography 
(PQC) across the ten member states of the Association of Southeast Asian Nations assessed in this series (Brunei 
Darussalam, Cambodia, Indonesia, the Lao People's Democratic Republic, Malaysia, Myanmar, the Philippines, 
Singapore, Thailand and Vietnam, the "ASEAN-10"), as at 17 August 2026. Timor-Leste, admitted as ASEAN's 
eleventh member state on 26 October 2025, is excluded from the headline comparative set under the 
commissioning scope and is assessed separately in Annex A.
The assessment was conducted because the discussion of post-quantum readiness has become dominated by 
declarations of intent. Standards bodies have published algorithms. Governments have published statements. 
Vendors have published readiness claims. Very little of this establishes what any given state has actually put in 
place. The question this report addresses is narrower and harder: what can each member state publicly 
demonstrate that it is doing to govern the replacement of quantum-vulnerable cryptography in its own national 
estate?
The population is fixed at exactly ten states. Each was assessed against the locked five-tier framework carried 
over unchanged from the EU-27 assessment, running from Tier 1, denoting a government-led national migration 
programme with substantive implementation machinery, to Tier 5, denoting that no publicly verifiable PQC
specific activity sufficient to meet Tier 4 was identified. Classification rests on national evidence only. 
Membership of ASEAN, participation in ASEAN cybersecurity cooperation, joint ministerial declarations, and 
regional capacity-building programmes were each excluded as automatic grounds for elevation. Quantum 
computing research, quantum key distribution, digital identity sophistication and general cybersecurity maturity 
were excluded under a strict anti-conflation rule.
The headline finding is that ASEAN readiness is real but thin at the top and sparse at the bottom. One state, 
Malaysia, demonstrates operating national migration machinery: a Cabinet-approved national cryptography 
policy addressing the quantum era, a statutory directive obliging critical-infrastructure entities to prepare and 
submit cryptographic migration data, a national migration plan launched by the Chief Secretary to the 
Government, and an operating national proof-of-concept sandbox. Six further states (Brunei Darussalam, 
Cambodia, Indonesia, Singapore, Thailand and Vietnam) demonstrate structured government preparation, 
ranging from a national-CERT migration guideline paired with a central bank's regulator-issued cryptographic 
requirement (Cambodia) to a published national migration framework with a stated requirement scope (Brunei) 
and a Prime Ministerial-level programme naming post-quantum cryptography among its research priorities 
(Vietnam). One state, the Philippines, sits at Tier 3 on a government-funded, named post-quantum cryptography 
research line, without migration machinery. One state shows a single isolated item of PQC-specific evidence; one 
state returned no sufficient public PQC evidence under this methodology, on this date, by this search.