The Australian Signals Directorate’s guidance on planning for post-quantum cryptography sets a date most boards have not yet put in a risk register: the end of 2030.1
What ASD recommends
In the Information Security Manual, ASD recommends ceasing the use of traditional asymmetric cryptography by the end of 2030. That covers RSA, Diffie-Hellman, Elliptic Curve Diffie-Hellman and the Elliptic Curve Digital Signature Algorithm, the algorithms behind most TLS, VPN, code-signing and identity systems in use today.12
ASD’s high-level milestones:
- By the end of 2026: a refined transition plan, accounting for security goals, risk tolerances, dependencies and the value of your data.
- By the end of 2028: transition commenced, starting with critical systems and data.
- By the end of 2030: transition complete.1
The replacements already exist. NIST published its first post-quantum standards, ML-KEM for key establishment and ML-DSA for signatures, in August 2024.3
Why it matters to the board
Two reasons. First, “harvest now, decrypt later”: data stolen today can be read once a capable quantum computer exists. If your data must stay confidential for ten years, its exposure window may already be open. Second, cryptography is buried in vendors, devices and contracts you do not control. Five years is roughly one refresh cycle for network equipment and core platforms, so anything you buy from now on should be quantum-ready.
The ISM is guidance, not law, for most private companies. But regulators, insurers and enterprise customers tend to adopt ASD’s expectations as the benchmark, and a 2026 planning milestone will be an easy question to ask in due diligence.
Three questions for your next board meeting
- Do we have an inventory of where we use public-key cryptography, including inside vendor products?
- Which of our data must stay confidential beyond 2030, and is it protected against harvest-now attacks?
- Do our procurement contracts require post-quantum readiness from suppliers?
How we help
Our Post-Quantum Readiness Roadmap delivers the 2026 plan ASD asks for: a cryptographic inventory, a risk-ranked migration sequence and supplier clauses. The Emerging Tech Lab benchmarks quantum-safe VPNs before you commit. Brief a CISO.
References
- Australian Signals Directorate, “Planning for post-quantum cryptography”. cyber.gov.au
- Australian Signals Directorate, Information Security Manual: Guidelines for cryptography. cyber.gov.au
- NIST, “NIST Releases First 3 Finalized Post-Quantum Encryption Standards”, 13 August 2024. nist.gov