This study explores the factors influencing the transition to Post-Quantum Cryptography (PQC) within the Philippine banking industry, a critical sector at risk from the Year-to-Quantum (Y2Q) threat. The threat posed by Cryptographically Relevant Quantum Computers (CRQCs) challenges traditional cryptographic protocols, demanding urgent preparedness. Through the Cryptographic Agility Maturity Model (CAMM), this study evaluates the industry's readiness, revealing a prevailing “L0: Initial/Not Possible” to “L1: Possible” maturity level. Qualitative interviews with five senior bank cybersecurity officers identified key internal challenges, such as distant threat perceptions, lack of cryptographic inventories, and inadequate technical capabilities, alongside external barriers, including limited regulatory guidance and supply-chain unpreparedness. The study highlights actionable enablers, including regulatory guidance, sector-wide collaboration, and public-private partnerships, to accelerate PQC readiness. This foundational research aims to catalyze future initiatives and policies for a quantum-secure financial sector in the Philippines.
This study explores the factors influencing the transition to Post-Quantum Cryptography (PQC) within the Philippine banking industry, a critical sector at risk from the Year-to-Quantum (Y2Q) threat. The threat posed by Cryptographically Relevant Quantum Computers (CRQCs) challenges traditional cryptographic protocols, demanding urgent preparedness. Through the Cryptographic Agility Maturity Model (CAMM), this study evaluates the industry's readiness, revealing a prevailing “L0: Initial/Not Possible” to “L1: Possible” maturity level. Qualitative interviews with five senior bank cybersecurity officers identified key internal challenges, such as distant threat perceptions, lack of cryptographic inventories, and inadequate technical capabilities, alongside external barriers, including limited regulatory guidance and supply-chain unpreparedness. The study highlights actionable enablers, including regulatory guidance, sector-wide collaboration, and public-private partnerships, to accelerate PQC readiness. This foundational research aims to catalyze future initiatives and policies for a quantum-secure financial sector in the Philippines.
Purpose This paper aims to examines the governance of post-quantum cryptography (PQC) transition in Gulf Cooperation Council (GCC) banking, identifies structural gaps in existing regulatory frameworks and proposes a regulatory readiness framework for orderly migration to quantum-resistant standards. Design/methodology/approach A qualitative policy-analytical methodology combines structured literature synthesis with comparative regulatory analysis of six GCC banking frameworks – Saudi Arabian Monetary Authority, Central Bank of the UAE, Central Bank of Kuwait, Qatar Central Bank, Central Bank of Bahrainand Central Bank of Oman – against five PQC governance dimensions, stress-tested across three cryptographically relevant quantum computer timeline scenarios. Findings None of the six frameworks explicitly addresses PQC transition requirements and all show critical gaps in cryptographic agility, quantum threat timeline awareness and harvest-now-decrypt-later (HNDL) risk assessment. National Institute of Standards and Technology (US)’s PQC standards (Federal Information Processing Standard 203, 204, 205) supply the technical foundation but not the regulatory coordination and supervisory capacity GCC banking requires. Practical implications The framework gives GCC banking regulators actionable guidance for introducing HNDL risk assessment, mandating cryptographic agility and establishing PQC transition planning before migration becomes compressed and disruptive. Originality/value This is among the first systematic PQC governance analyses of GCC banking, best characterised as a theoretically grounded contextual adaptation rather than a new governance theory. The proposed three-phase framework – inventory, prioritised migration, continuous resilience – is framed through a socio-technical transition lens, translating generic quantum-risk identification into a governance architecture grounded in the six GCC supervisors’ regulatory landscape.
Quantum computing poses an existential threat to public-key cryptography, with Shor's algorithm capable of breaking RSA and elliptic curve systems once cryptographically relevant quantum computers (CRQCs) emerge. While post-quantum cryptography (PQC) offers algorithmic solutions, organizational readiness extends beyond technical implementation to encompass governance, interoperability, and adaptive capacity. This review synthesizes the quantum threat landscape, evaluates NIST-standardized PQC algorithms through quantitative performance analysis, and examines global standardization dynamics. We introduce a novel Quantum Readiness Maturity Model (QRMM) that enables organizations to assess and advance their preparedness across five dimensions: cryptographic infrastructure, governance frameworks, sectoral adaptation, interoperability resilience, and strategic agility. Applying this model to finance, telecommunications, and defense sectors reveals systematic gaps in migration planning and crypto-agility. Our analysis demonstrates that quantum readiness requires treating cryptographic transformation as a strategic enterprise capability rather than a purely technical upgrade. The proposed framework provides actionable pathways for practitioners while identifying critical research directions in hybrid deployment strategies, post-quantum PKI architectures, and algorithmic diversity.
The emergence of quantum computing poses a significant threat to modern encryption standards, with the potential to render widely used cryptographic protocols obsolete. To mitigate this risk, organizations must transition to post-quantum cryptography (PQC), a process that requires technical, operational, and strategic adjustments. However, the pace and approach to adoption vary across industries and organizational size, influenced by both external pressures and internal capabilities. This study employs a mixed-methods approach, incorporating 14 expert interviews and survey responses from 37 cybersecurity professionals to examine the factors driving and inhibiting PQC adoption. The findings reveal that while regulatory mandates play a role, organizations are increasingly guided by risk exposure and reputational concerns. Key challenges include resource constraints, reliance on third-party vendors, and the complexity of cryptographic inventory assessments and legacy systems. Despite these challenges, the study found that PQC adoption will accelerate as risk awareness grows and implementation guidelines become available. It emphasizes the importance of a strategic, resilience-focused approach to cybersecurity, incorporating cryptographic agility, continuous assessments, and hybrid encryption solutions to navigate the evolving threat landscape.
Quantum computing has emerged as a potential long-term challenge to the cryptographic algorithms that currently secure digital financial systems. As financial institutions rely extensively on cryptography to protect communications, transactions, authentication processes, and sensitive information, the prospect of quantum computing has raised concerns about the future security of existing cryptographic infrastructures. This has created a need to better understand how organisations perceive and approach the transition toward post-quantum cryptography (PQC). This study explores how financial organizations in the United Arab Emirates perceive and approach the transition toward PQC. Guided by the Technology–Organization–Environment (TOE) framework,the study examines how technological, organizational, and environmental factors influence organizational perspectives and approaches toward future cryptographic transition. A qualitative research design was adopted using semi-structured interviews with nine participants in cybersecurity, technology, governance, and compliance roles across banks, financial service providers, payment organizations, and a regulatory authority within the UAE financial sector. The findings show that awareness of quantum-related risks is increasing across the sector; however, most organisations remain in the early stages of assessment and monitoring. Organisational approaches were shaped by technological, organisational, and environmental factors, including cryptographic visibility, governance, resource constraints, regulatory expectations, international standards, and ecosystem coordination. The study concludes that financial organisations in the UAE recognise PQC as an important future cybersecurity challenge but currently approach the transition through awareness-building, assessment, and monitoring rather than active implementation.Organizational responses were shaped by technological, organisational, and environmental factors, indicating that PQC transition extends beyond a purely technical challenge.
Financial institutions depend on RSA, elliptic-curve cryptography, and Diffie-Hellman key exchange for authentication, transaction integrity, and confidentiality: algorithms a sufficiently large quantum computer would break outright rather than merely weaken. No cryptographically relevant quantum computer exists yet, but the harvest-now-decrypt-later threat means data intercepted today remains at risk once one does, and financial data's long retention obligations make this a present-day planning problem rather than a distant one. This paper assesses the readiness of financial institutions in Africa to adopt post-quantum cryptography (PQC) and develops a framework for transitioning to quantum-resistant cryptographic systems. Five specific objectives drive that work: examining PQC awareness among African financial institutions, assessing current cryptographic exposure, identifying technical, financial, organizational, regulatory, and skills-related adoption barriers, evaluating the suitability of finalized PQC algorithms for financial applications, and developing a readiness and migration framework fitted to African constraints. The study's design is literature-based and conceptual: it synthesizes verified secondary evidence rather than reporting original fieldwork, and no institution was surveyed or interviewed. Its contributions include an integrated Technology-Organization-Environment/Diffusion-of-Innovation model with crypto-agility as a mediating capability, a six-dimension readiness instrument, and an algorithm-evaluation framework. The central contribution, a six-phase migration framework addressing three gaps found in every existing precedent, is paired with an adapted risk-based prioritization matrix. Headline recommendations call on institutions to name a single accountable owner and begin scoped discovery now, on regulators to extend draft cybersecurity guidance to address cryptographic agility explicitly, and on future research to empirically test the proposed model against real institutions.
Quantum computers are rapidly evolving from theoretical research to practical applications and are expected to drive major breakthroughs across multiple sectors, particularly in materials science, finance, and healthcare. However, this technological advancement also poses significant risks to conventional cryptographic systems, necessitating comprehensive national strategies for the adoption of quantum-safe cryptography. This study assesses Thailand’s preparedness for the quantum era in comparison with global initiatives by examining technical, regulatory, and institutional efforts. By incorporating elements of the PRISMA framework, this paper reveals two principal results. First, global efforts primarily focus on cryptographic inventory assessments, quantum risk evaluations, talent development, and regulatory modernization. Second, Thailand has shown an early commitment by formulating strategic roadmaps, supporting quantum research, and launching readiness assessments through initiatives led by national agencies. While certain implementation gaps persist, Thailand demonstrates strong potential to accelerate its transition through coordinated action and multi-stakeholder collaboration. Additionally, this study offers practical recommendations to advance PQC adoption and concludes that, with sustained investment and international cooperation, Thailand is well-positioned to emerge as a regional leader in post-quantum cybersecurity readiness.