In this guide · 7 sections
Short answer
CSA's advisory of 14 October 2026 encourages organisations to have a quantum-safe migration plan by end 2027 and finish migrating by 2035 (2031 for CII owners). For an SME, the practical work is listing key systems, asking vendors about their quantum-safe roadmap and keeping software updated.
What CSA's quantum-safe advisory says
The Advisory on Quantum-Safe Migration for Organisations is dated 14 October 2026. Its core message: future quantum computers could break the encryption that protects data today, so organisations should plan an early, phased move to quantum-safe cryptography.
CSA notes that experts estimate a quantum computer able to do this, which it calls a Cryptographically Relevant Quantum Computer, could arrive within 5 to 10 years, though the timeline is uncertain. It also warns that attackers are expected to be stealing encrypted data now, to decrypt it later.
| Milestone | Who | Date |
|---|---|---|
| Migration plan in place | All organisations exposed to quantum risk | End 2027 |
| Complete migration of CII systems | Critical Information Infrastructure owners | 2031 |
| Complete migration | Other organisations exposed to quantum risk | 2035 (encouraged) |
CSA says Singapore's dates align with common international timelines. CII owners have separate guidance from June 2026. For everyone else, this is guidance, not a new law.
What the quantum threat means in plain English
Most encryption you rely on, such as the padlock in your browser, VPN connections and digital signatures, uses maths problems that normal computers cannot solve in any useful time. CSA's advisory names RSA, ECDSA and DSA as widely used algorithms that a powerful enough quantum computer could break.
Quantum-safe (or post-quantum) cryptography replaces these with new algorithms designed to resist quantum attacks. The US standards body NIST published the first of them, FIPS 203 (ML-KEM), on 13 August 2024. Large vendors are already adding these algorithms to browsers, cloud services and operating systems; Cloudflare, for example, documents its post-quantum support.
The risk that matters for a small business today is "harvest now, decrypt later". If you hold data that must stay confidential for 10 years or more, such as medical records, legal files or trade secrets, data stolen now could be readable later.
Does the CSA quantum advisory apply to my small business?
CSA says the advisory applies broadly to organisations that rely on digital systems, data or communications, but that not all are equally exposed. Each should assess its own exposure before deciding whether to act.
Pay closer attention if you
- Keep data that must stay secret for many years (medical, legal, financial, R&D)
- Run your own VPN, servers or custom software with built-in encryption
- Use long-life equipment such as building or industrial control systems
- Supply large companies or government agencies that will ask about readiness
Lower priority if you
- Run almost everything on mainstream cloud apps (Microsoft 365, Google Workspace, Xero)
- Hold little long-lived confidential data
- Replace laptops, phones and routers every few years
- Have no custom software or on-premise servers
For the second group, most of the migration will happen inside the cloud services you already pay for, as long as you stay on supported versions.
Practical first steps for SMEs, from CSA's list
CSA's advisory lists six steps drawn from its handbook. Here they are scaled to a small business.
List your most important systems
Write down systems holding long-lived sensitive data, internet-facing systems (website, email, VPN, cloud apps) and any long-life equipment. A one-page list is enough.
Name one person responsible
CSA asks for a clear owner. In a small firm that is usually the director or office manager, with your IT provider consulted.
Ask your key vendors five questions
Do your products support quantum-safe cryptography? What is your roadmap? Does it match our timeline? Will you migrate us automatically or do we need to act? Will it cost extra?
Favour vendors that are preparing
When renewing contracts or buying new software, choose suppliers with a published quantum-safe plan, and avoid products with hard-coded encryption and no upgrade path.
Brief the decision-makers
Frame it as business risk: customer trust, data breaches and what big clients may ask for, not maths.
Keep everything updated
Quantum-safe algorithms will mostly arrive through updates. Unsupported routers, VPN boxes and old servers will not get them, so plan to replace them.
CSA also offers a self-assessment, the Quantum Readiness Index, with its Quantum-Safe Migration Handbook, both released on 16 July 2026. They are written for larger organisations but the first questions are useful for anyone.
What to do this year vs by end 2027
Spreading the work out keeps it cheap.
Quantum-safe to-do list for a small business
Basic security hygiene matters more today. CSA's Cyber Essentials mark covers patching, access control and backups, and our Microsoft 365 security checklist covers the most common business platform. Our summary of the Singapore Cyber Landscape 2025/2026 shows which threats are hitting SMEs right now.
Do it yourself or get help?
An owner can do the inventory and vendor questions without outside help, using the steps above and CSA's resources. The technical part, checking which encryption your VPN, website and servers use, is where a second pair of eyes helps.
Our Security Health Check (S$290, paid upfront) reviews your internet-facing systems, updates and end-of-life equipment, which covers the first quantum-safe steps alongside today's risks. For Microsoft 365 or Google Workspace, Microsoft 365 / Google Security Lockdown (S$590) sets the security baseline.
Frequently asked questions
No. CSA's October 2026 advisory sets a 2031 migration target for Critical Information Infrastructure owners. Other organisations exposed to quantum risk are encouraged, not required, to complete migration by 2035 and to have a plan in place by end 2027. Large customers may still ask suppliers about readiness, so it is worth preparing early.
Nobody knows exactly. CSA's advisory says experts estimate a cryptographically relevant quantum computer could arrive within 5 to 10 years, but the timeline is uncertain and could be earlier. The more immediate concern is attackers storing encrypted data now to decrypt it later, which matters for data that must stay confidential for many years.
Usually not. For most small businesses, quantum-safe algorithms will arrive through normal software updates to operating systems, browsers and cloud services. The equipment to watch is anything that no longer gets updates, such as old firewalls, VPN appliances, servers and building systems. Replace those when support ends.
CSA suggests asking whether their products support quantum-safe cryptography, what their upgrade roadmap is, whether their timeline matches yours, whether they will handle the migration or you must act, and whether it will cost extra. Keep the answers with your contracts and ask again at renewal.
It is a self-assessment questionnaire from CSA, GovTech and IMDA, released on 16 July 2026 alongside the Quantum-Safe Migration Handbook. It scores readiness across five domains and suggests next steps, starting with low-risk first moves. It is aimed at larger organisations but the early questions are useful for small firms too.