A low score is not always a failure. In Singapore’s quantum-safe journey, it is a diagnostic. Early assessments using the Quantum Readiness Index (QRI) have indicated that banking-sector readiness for post-quantum cryptography remains in the early stages, with surveyed institutions scoring in the low single digits on a ten-point scale. Rather than embarrassing the industry, the number has become a catalyst for structured action.
Why the Score Is Low
The QRI, developed alongside CSA’s Quantum-Safe Migration Handbook, evaluates readiness across awareness, planning, trials and production deployment. A low aggregate score reflects a familiar reality: cryptographic functions are deeply embedded and inconsistently implemented. Most institutions still lack a complete understanding of where cryptography resides across systems, vendors, APIs, mobile clients and legacy platforms.
That visibility gap is not cosmetic. First inventories routinely reveal outdated hash functions, short RSA keys, expired certificates and divergent configurations across business lines. You cannot retire an algorithm you cannot find. You cannot prioritise a migration sequence without a factual baseline. As one industry expert put it, “An inventory gives you a factual baseline. You can’t prioritise or sequence a migration plan if you don’t know what you’re running”.
The Handbook as an Operating Manual
CSA’s Quantum-Safe Migration Handbook is designed to turn the score into a work plan. It provides no-regrets first moves, guidance on identifying an organisation’s “crown jewels,” updated recommendations on quantum-safe algorithms, and Singapore’s requirements for critical information infrastructure owners. The companion QRI allows system owners to self-assess across five domains and identify gaps that require attention.
The framework is deliberately practical. It acknowledges that quantum-safe migration is a multi-year endeavour and that early planning makes an orderly, cost-effective transition possible. For banks, the immediate tasks are inventory, crypto-agility and vendor alignment—not wholesale replacement.
From Score to Strategy
The QRI’s value lies in benchmarking. It gives boards a common language and regulators a comparable dataset. It also exposes uncomfortable dependencies: third-party providers, core banking platforms and payment rails that may not be ready on the bank’s timeline. That is why MAS has emphasised that outsourcing does not dilute accountability; financial institutions remain responsible for the resilience of services delivered through external parties.
A 2.3 out of 10 is a starting line, not a verdict. The institutions that improve fastest will be those that treat cryptographic inventory as a continuous discipline, embed crypto-agility into architecture decisions, and align procurement with quantum-safe requirements now. The QRI and Handbook are available from CSA: https://www.csa.gov.sg/resources/publications/quantum-safe-handbook-and-quantum-readiness-index/.
Leave a Reply