The Australian Signals Directorate (ASD) has set out a staged transition towards post-quantum cryptography (PQC), with the first milestone landing at the end of 2026. By then, ASD recommends organisations have a refined PQC transition plan.
For entities covered by the PSPF, PQC planning is already a requirement. Reaching ASD’s end-of-2026 milestone means doing the discovery and decision-making earlier: understanding what relies on your cryptography, assessing your exposure and setting priorities that can support an executable transition program.
What does ASD expect organisations to do about post-quantum cryptography?
ASD recommends three major milestones for Australia’s transition to PQC.
1. End of 2026: refine your transition plan
Your plan should account for your organisation’s security goals, risk tolerances, dependencies and the value of your data
2. End of 2028: start transitioning critical systems and data
Start with systems that are critical to your organisation, handle highly sensitive, classified or long-lived data, or are likely to be difficult and time-consuming to update.
3. End of 2030: complete the PQC transition
By this point, organisations should have completed their PQC transition. ASD also recommends ceasing the use of traditional asymmetric cryptography by the end of 2030, including RSA, Diffie-Hellman (DH), Elliptic Curve Diffie-Hellman (ECDH) and the Elliptic Curve Digital Signature Algorithm (ECDSA).
Figure 2: ASD’s recommended PQC transition milestones alongside the potential exposure window for long-lived data as the likelihood of a cryptographically relevant quantum computer (CRQC) increases.
The gap between planning and implementation is where the milestone is easiest to misread. Moving from a refined plan to critical systems already being in transition leaves limited time for discovery, prioritisation, procurement, testing and remediation.
Is the 2026 PQC milestone mandatory for Australian Government agencies?
No, ASD’s 2026 post-quantum cryptography (PQC) milestone is a recommendation. Developing, implementing, and maintaining a PQC transition plan is mandatory for entities covered by the Protective Security Policy Framework (PSPF), and that requirement applies from 1 July 2026. ASD recommends a refined plan by the end of 2026. The PSPF requirement doesn’t specify an end-of-2026 deadline.
The Australian Government’s PSPF Release 2026 added Requirement 0223 and modified Requirement 0212, both applying from 1 July 2026. Requirement 0223 says a PQC transition plan is developed, implemented, and maintained. Requirement 0212 says approved post-quantum cryptographic encryption algorithms are supported on newly procured cryptographic equipment and software, in accordance with the guidelines for cryptography in ASD’s Information Security Manual (ISM).
The ISM’s cryptography guidance provides the technical detail. PSPF Requirement 0085 requires entities to apply ISM controls and cyber security guidelines on a risk-based approach. ISM-2073, introduced in September 2025, states that a PQC transition plan is developed, implemented, and maintained. ISM-1917, updated in September 2025, states that the development and procurement of new cryptographic equipment, applications and libraries ensures support for the use of ML-DSA-87, ML-KEM-1024, SHA-384, SHA-512 and AES-256 by no later than 2030. The ISM also states that DH, ECDH, ECDSA and RSA will not be approved beyond 2030.
For organisations outside the PSPF, ASD’s PQC transition milestones provide a benchmark for their own transition planning.
Why does post-quantum cryptography matter to Australian Government now?
ASD gives three reasons to start preparing now: deploying new protections can take longer than expected, the arrival date of a cryptographically relevant quantum computer is uncertain, and highly sensitive or classified information protected by traditional cryptography may be exposed to Harvest Now, Decrypt Later attacks.
That last point changes how we think about urgency, because information being protected today may need to stay confidential long enough for future advances in quantum computing to matter.
What should government agencies do first to prepare for PQC?
Start by establishing where traditional asymmetric cryptography exists across your environment and what depends on it. ASD’s LATICE framework follows five phases: Locate, Assess, Triage, Implement, and Communicate and Educate. It starts by locating and inventorying where traditional asymmetric cryptography is used.
Figure 1: ASD’s LATICE framework for post-quantum cryptography transition planning: Locate, Assess, Triage, Implement, and Communicate and Educate.
Knowing your organisation needs a transition plan is different from having the evidence required to build one. A plan built without that evidence can look complete, with dates, owners and milestones, and still rest on assumptions.
Security teams may know where some important certificates, encryption technologies and cryptographic services sit, but a transition program needs a more complete picture across systems, applications, infrastructure and dependencies. You can’t transition what you can’t see, so that’s the gap we’d close first.
Getting started doesn’t mean a full transformation on day one. A first pass looks like this:
-
-
Identify where traditional asymmetric cryptography is used, particularly across systems handling sensitive or long-lived data.
-
Map dependencies across vendors, applications, and application programming interfaces (APIs).
-
Plan to transition high-priority assets first.
-
What should security leaders take from the 2026 PQC milestone?
The 2026 milestone comes with a deadline before the deadline. ASD recommends a refined plan by the end of 2026, but the discovery, dependency mapping and prioritisation that make it credible need to happen earlier. If you’re starting now, focus on establishing a useful baseline: a list of your critical systems and the information they protect, an external view of what’s visible across your public-facing environment and a named owner for the plan.
Post-quantum readiness comes from the informed decisions you make today, because they determine how effectively your organisation can transition tomorrow.
Start your PQC planning with better visibility
If you’re working towards a PQC transition plan, start by understanding where traditional asymmetric cryptography exists across your environment, what depends on it, and where your biggest risks sit. Together with Venari Security, The Missing Link can help you build greater visibility of your cryptographic environment and identify the priorities that should shape your transition planning.
Talk to us about your PQC readiness.
