Australian organisations following ASD’s milestones should have a refined plan for moving to post-quantum cryptography by the end of 2026. For a security team reading this in November 2026, that is eight weeks away. For a company selling post-quantum products, it is the most useful date on the calendar.
When do Australian organisations need to move to post-quantum cryptography?
ASD’s Information security manual recommends that Australian organisations stop using traditional asymmetric cryptography by the end of 2030. That covers the algorithms behind most of today’s encryption and digital signatures: RSA, Diffie-Hellman, ECDH and ECDSA. ASD recommends replacing them with post-quantum algorithms it has approved.
ASD sets three milestones on the way.
| By the end of | Organisations should have |
|---|---|
| 2026 | a refined plan for the transition, based on their security goals, risk tolerance, dependencies and the value of their data |
| 2028 | started the transition, beginning with critical systems and data |
| 2030 | completed the transition |
The standards are already in place. The US National Institute of Standards and Technology published its first three post-quantum standards, FIPS 203, 204 and 205, on 13 August 2024.
What is harvest now, decrypt later?
Harvest now, decrypt later is an attack where someone copies encrypted data today and stores it until a quantum computer can break the encryption. Nobody knows when a quantum computer capable of that will exist. Data that must stay confidential for years is exposed now, because the theft has already happened.
For a board, think of a locked filing cabinet carried out of the building today and opened years later. The lock held on the night. It didn’t matter.
How should post-quantum vendors market against the deadline?
Post-quantum vendors should match their content to the stage each buyer has reached, cite the standard their product implements, and leave fear out of it. Three practical points follow from ASD’s own guidance.
Match content to ASD’s phases. ASD’s LATICE framework starts with locating where traditional asymmetric cryptography is used, then assessing the value of what it protects, then triaging systems for transition, then implementing. A buyer still locating needs an inventory guide. A buyer triaging needs a way to rank systems. Sending implementation pitches to a team still building its inventory wastes the meeting.
Don’t outrun the regulator. ASD warns organisations not to rush ahead of standardised and verified implementations. It neither recommends nor prohibits hybrid schemes that combine post-quantum and traditional algorithms. A vendor whose urgency outruns ASD’s position loses the buyer who has read it.
Name the standard. Say which FIPS standard your product implements and where it has been tested. In a market full of ‘quantum-safe’ claims, a specific standard is proof a sceptic can check.
The budget calendar matters too. Australian technology budgets are set before the financial year starts on 1 July, so the money for the 2028 milestone gets decided in the budget rounds ahead of it. A vendor that waits for the buyer to come looking will meet them at procurement, competing on price.
The 2030 date gives post-quantum vendors something most security marketing lacks: a deadline the buyer didn’t invent and can’t ignore. Use it carefully, and it does half the persuading for you.
To build a campaign around it, book a 30-minute meeting or take the Marketing Pen Test.