The Cyber Security Agency of Singapore (CSA) will pay up to 70% of the cost of pilot projects that test quantum-safe migration in real operating environments, with priority for owners of critical information infrastructure (CII). Josephine Teo, Singapore’s Minister for Digital Development and Information, announced the Quantum-Safe Kickstarter Grant on October 14, 2026, in an address on the second day of Singapore International Cyber Week.
Singapore’s Commissioner of Cybersecurity designates computer systems as CII under the Cybersecurity Act when they are necessary for essential services in sectors such as banking and finance, energy, and info-communications. CSA opened applications more than five months before March 31, 2027, the deadline for CII owners to submit quantum-safe migration plans to the agency through their sector leads, the government agencies that oversee each CII sector. Under CSA’s guidance, those owners are to finish migrating by December 31, 2031.
Teo also announced an advisory for organizations outside CII that are exposed to quantum risk. In it, CSA said those organizations should aim to have a migration plan in place by the end of 2027 and encouraged them to complete migration by 2035.
In her address, Teo said organizations “do not become quantum-safe overnight, just because they want to.” CSA wrote that attackers are already expected to be stealing encrypted data, intending to decrypt it once quantum computers mature.
Disclosure: Quantum Observer’s Editor-in-Chief Marin Ivezic is the founder and CEO of Applied Quantum, a quantum systems integration and consulting firm, and the author of its PQC Migration Framework.
Eligibility
On the grant page, CSA limits eligibility to non-government organizations registered and incorporated in Singapore that carry out the pilot in their Singapore operations. In its press release, CSA described the grant as open to all organizations, with priority for CII owners.
Applicants can run a pilot in-house or with a solution provider, including one based overseas, as long as the solution is deployed and evaluated in a Singapore operating environment. CSA wrote that its list of vendors is non-exhaustive and that inclusion on it is not an endorsement.
Terms and payments
Applicants must contribute 30% of project costs in cash, according to the grant page. Internal staff time does not count toward that share. Applicants also bear any goods and services tax.
CSA will fund projects from November 1, 2026, to October 31, 2027. Each pilot may run for up to six months and must finish by the end of that period, though CSA may approve extensions case by case.
CSA aims to decide within four weeks of receiving a complete application and awards grants on a first-come, first-served basis, subject to eligibility, scope, and strategic value. It said it may limit the number of awards to any single corporate group. CSA has not published a total budget or a per-project cap.
For a pilot run with a solution provider, CSA pays half the grant once it has approved the project and the applicant has signed the letter of award and a commercial agreement. It pays the other half when it accepts the final report. For an in-house pilot, CSA pays nothing upfront and pays the full grant after completion, report acceptance, and submission of cost documentation.
Priority use cases
CSA listed five illustrative priority use cases. The first three are end-to-end migration of one small, low-complexity application or system, cryptographic discovery and inventory, and migration of legacy and infrastructure-heavy systems, including operational technology (OT) that controls physical equipment.
The other two are crypto-agility, the ability to swap cryptographic algorithms with minimal disruption and redesign, and limited trials of quantum key distribution (QKD) or other quantum-enabled security technologies. QKD is a method of sharing encryption keys over optical links that relies on quantum physics. CSA described such trials as “complementing but not necessarily replacing” post-quantum cryptography in use cases that need additional assurance.
Pilot reports
Every funded pilot must end with a report in eight sections, including results, limitations and risks, and the time and resources the organization and its provider invested. CSA wrote that it wants to use the effort data to “calibrate future guidance on what projects realistically require.”
CSA also wrote that negative or inconclusive results “remain valuable and should be documented transparently.” It may publish aggregated or anonymized findings across pilots but will not publish an individual organization’s report without its explicit consent.
Plans and procurement for CII owners
Under CSA’s guidance for CII owners, new CII systems contracted from January 1, 2028, must support quantum-safe algorithms or be capable of supporting them by December 31, 2031.
CSA does not require the plans to contain a complete roadmap. Owners must tell CSA why any information is missing. They must also update their plans as migration proceeds and flag material deviations to CSA.
Market survey and other timelines
CSA and the Government Technology Agency (GovTech) are separately running a request for information on the readiness of the market for quantum-safe products and services. Suppliers can respond through GeBIZ, Singapore’s government procurement portal, until November 27, 2026.
In the advisory, CSA wrote that “common timelines have emerged” internationally for critical systems to complete migration by 2031 and for all other affected systems to do so by 2035. It said Singapore is aligned with those timelines.
In Germany, two federal ministries and the BSI, the national cybersecurity agency, published a national guideline on October 12. They wrote that high-risk systems should complete migration by the end of 2030 and that most of the transition should be complete by 2035, as Quantum Observer reported.
