What Malaysia's PQC Readiness Strategy Means for CISOs, CTOs and Enterprise Leaders

Malaysia has moved faster than most of Southeast Asia on post-quantum cryptography. A national migration framework arrived in 2024. A readiness roadmap followed in October 2025, a National Cryptography Policy in November 2025, and in July 2026 a National PQC Migration Plan and a quantum cryptography sandbox. In September 2026 an independent regional assessment placed Malaysia alone in the top readiness tier in ASEAN.

The work does not land on the CISO's desk alone. Moving cryptography touches product, infrastructure, procurement, risk and operations, so this guide is written for the whole group: CISOs and heads of cybersecurity, CTOs and technology and product chiefs, chief risk and compliance officers, heads of emerging and quantum technology, and OT leaders. It also covers what the strategy means for universities that want to teach this or open a quantum research lab.

New to the topic? The video Quantum Security Explained is a useful starting point, and it works well for colleagues outside the security team who need the basics before the detail below.

Quick answer: Malaysia's working migration window runs from 2025 to 2030 under NACSA's non-binding plan, which builds on CyberSecurity Malaysia's five-phase framework. That framework starts with a full cryptographic inventory. No legal migration deadline exists yet and no policy requires a CBOM, but critical sectors can be bound through sector codes under the Cyber Security Act 2024. Leaders should build the inventory now, extend it into software, hardware and cryptographic bills of materials, and pilot hybrid cryptography. Universities have a defined opening in the roadmap's human readiness pillar.

Who Needs to Act on Malaysia's PQC Roadmap?

Quantum-safe migration has many owners. A practical split looks like this:

What Has Malaysia Announced on Post-Quantum Cryptography?

The programme has built up in five steps:

The Kuala Lumpur conference drew more than 600 participants from over 30 countries, which made it one of the largest dedicated PQC events anywhere.

When Does Malaysia's PQC Migration Start and End?

Malaysia has a clear start and a working end. It does not have a legal deadline in between.

The framework runs in five phases: Assess (preparation and inventory), Select (algorithm selection and standardisation), Validate (validation and pilot), Deploy (implementation) and Monitor (monitoring and resilience). The document does not say whether it is mandatory or voluntary, so treat it as expected practice until a regulator says otherwise.

What Are the Three Pillars of Malaysia's PQC Roadmap?

1. Technical readiness. A migration plan spanning 2025 to 2030, proof-of-concept PQC deployments and a sandbox for testing quantum-safe implementations in government systems.
2. Strategic alignment. Coordination across government, alignment with NIST and EU frameworks, public sector pilots, early adoption of hybrid cryptography and frameworks for cryptographic agility.
3. Human readiness. Capability-building that connects national workforce development with global PQC expertise, in collaboration with UN agencies, ASEAN counterparts and universities.

The third pillar matters most to universities, and a later section covers it.

Is Malaysia's PQC Roadmap Mandatory?

The answer has three layers.

• The roadmap is non-binding. NACSA's chief executive described it as a strategic framework. It names no algorithm requirements and aligns with NIST's standards.
• The policy has one mandatory tier. Under MyKriptografi, national trusted cryptographic products (PKTN) are mandatory for dealings involving Official Secrets and for classified data held by National Critical Information Infrastructure (NCII) entities. That governs product choice. It sets no post-quantum deadline.
• The law offers a route. The Cyber Security Act 2024 (Act 854) defines eleven NCII sectors, including banking and finance, energy, transport, healthcare and information and communication. Sector leads can write cryptographic requirements into sector codes of practice, and NCII entities must then follow them. At the latest independent review, no sector code mandating PQC migration had been published, and Bank Negara Malaysia's technology risk policy carried no PQC content. A banking sector code is the item to watch.

The pace of policy is the clearer signal. At the July launch, Prime Minister Anwar Ibrahim said that a National Cryptography Policy and cryptography action plans "were not things we discussed years ago." Check NACSA's current guidance if you operate in Malaysia, because this position can change quickly.

What Do CBOM, SBOM and HBOM Mean for Malaysian PQC Readiness?

Three bills of materials answer three different questions. Together they give a CTO, a CRO or a head of cybersecurity an evidence trail for both supply chain and cryptographic risk.

A CBOM complements an SBOM and does not replace it. The CycloneDX 1.6 standard, released in 2024, introduced the CBOM (developed by IBM Research) next to formats for software, hardware, services and AI/ML bills of materials. NIST's NCCoE has a draft practice guide, SP 1800-38B, on cryptographic discovery, and CISA's HBOM working group published a hardware bill of materials framework in 2023.

Where does Malaysia stand? The policy MyKriptografi does not require a CBOM or an inventory. CyberSecurity Malaysia's framework does, in Phase 1, which calls for a detailed inventory of cryptographic assets including protocols and key management systems. It also asks organisations to assess dependencies on third-party vendors, which is where an SBOM and HBOM earn their keep.

The direction elsewhere is clear. India's roadmap calls for mandatory bills of materials in all government RFPs. The Philippines already makes an SBOM mandatory for government software procurement. In the United States, an executive order signed on 22 June 2026 reportedly directs CISA and NIST to publish minimum CBOM elements within 270 days. A company that builds its three bills of materials now will meet most vendor questionnaires before they arrive.

What Should Enterprise Leaders Do Now?

The steps below follow the order in which most national roadmaps, Malaysia's included, ask organisations to work.

1. Build the CBOM first (CISO, Head of Cybersecurity). List every algorithm, certificate, key and protocol across applications, networks and third-party software.
2. Add the SBOM and HBOM (CTO, CTPO, OT leads). Map which libraries and which hardware hold the cryptography, so you know what can be patched and what needs replacing.
3. Classify by data life (CRO, CCO). Mark which data must stay confidential for ten years or more. That data is the target of harvest-now, decrypt-later collection, so it sets your priority order.
4. Ask vendors for PQC dates (Procurement, CTO). Request dated commitments for ML-KEM and ML-DSA support in every product that touches sensitive data. Malaysia's trusted algorithm list already includes the NIST post-quantum standards.
5. Pilot hybrid cryptography (Head of Emerging Technology). Combine classical and post-quantum algorithms on one contained link or application. Malaysia's roadmap names early hybrid adoption as an aim.
6. Design for crypto-agility and name an owner (CTO, board). Move algorithm choices out of application code and into configuration. Assign one accountable programme lead and budget for skills.

To see how a migration programme is framed from the first assessment to the last system, watch Navigating Quantum Safe Migration. It pairs well with the steps above when you brief your own leadership team.

What Does Malaysia's PQC Strategy Mean for Universities and Quantum Research Labs?

Human readiness is the third pillar of the national roadmap, and it names universities as partners. The surrounding signals point the same way. NACSA has presented a planned Cyber Security and Cryptology Development Centre. A November 2025 PKI Consortium conference deck lists Universiti Putra Malaysia among the partners supporting the national proof-of-concept. MIMOS opened a Quantum Intelligence Center in February 2025 with an aim of building a quantum valley, and the Prime Minister endorsed a National Quantum Policy and a National Quantum Task Force in October 2025.

For a university deciding whether to offer technical courses or to open a Centre of Excellence or quantum research lab, a workable path looks like this:

1. Anchor the curriculum to the national framework. Teach the five phases (Assess, Select, Validate, Deploy, Monitor) and the algorithms on Malaysia's trusted list: ML-KEM, ML-DSA and SLH-DSA.
2. Teach inventory as a hands-on skill. Build labs on CBOM, SBOM and HBOM, because inventory is Phase 1 and every employer will need it.
3. Build a testbed that mirrors the sandbox. Cover hybrid TLS, PKI migration, performance benchmarking, crypto-agility testing and embedded or OT hardware.
4. Partner early. Talk to NACSA and CyberSecurity Malaysia about pilots, case studies and joint supervision, and about the MyCC and MyCV evaluation schemes the framework references.
5. Plan for sovereignty. The policy's emphasis on national trusted products and a national algorithm list gives research on indigenous algorithms and evaluation a clear role.

Check programme approval, funding and accreditation requirements with the relevant Malaysian authorities before launching, because we found no published funding call specific to PQC teaching labs. Institutions exploring industry partnerships can look at QNu Academy as one route.

How Does Malaysia's Approach Compare With India's?

Both countries start with visibility and both lean on pilots. They differ on binding force, testing and bills of materials.

India's detail was presented at the PQC Migration Workshop at Pragati Q-Foundry 2026 in New Delhi on 30 September 2026. For a business with operations in both markets, the first two steps, inventory and risk classification, are identical.

Where Does QShield 2.0 Fit?

Both roadmaps begin with one question: where does your cryptography actually live? QShield 2.0 is QNu Labs' sovereign post-quantum platform built around that question. Its Quantum Readiness Risk Assessment module discovers certificates, keys and algorithms across an estate and builds the cryptographic bill of materials, then classifies exposure, ranks migration order and keeps checking as standards change. It can run on-premises or air-gapped, and it is designed so algorithms can change without rebuilding the systems above them.

Watch the QShield 2.0 launch video for a short overview, see how the platform has grown in QShield vs. QShield 2.0.