What's happening
The Australian Prudential Regulation Authority (APRA) has signalled it will sharpen its supervisory focus on quantum computing risk. Its position aligns with the Australian Signals Directorate's (ASD) published guidance, which recommends that Australian organisations hold a post-quantum cryptography (PQC) transition plan by the end of 2026 and begin implementing that plan by the end of 2028.
APRA has indicated it expects regulated entities to make timely progress against these milestones, prioritising their most critical information assets and operations first.
The cryptographic hygiene reading
Read through a cryptographic hygiene lens, the 2026 milestone is less a technology deadline than a visibility deadline. A credible transition plan cannot be written until an organisation knows where asymmetric cryptography is actually used, across TLS, VPNs, PKI, code-signing, hardware security modules, and third-party services. Few entities currently hold that inventory. APRA's public expectation that regulated entities begin mapping where cryptography is relied upon across their systems, data, and third-party providers is, in substance, a call for a cryptographic asset inventory ahead of any algorithm migration.
The harvest-now, decrypt-later exposure
The instruction to prioritise "most critical information assets and operations" puts harvest-now, decrypt-later (HNDL) risk on the supervisory record. Encrypted data captured today by an adversary can be decrypted retroactively once cryptographically relevant quantum computers mature. Long-lived financial, actuarial, and custody data — the categories APRA-regulated entities hold in volume — sit squarely inside the confidentiality horizon that HNDL is designed to exploit. A transition plan filed for 2026 without an underlying cryptographic inventory will not withstand supervisory testing, and it will not address data already exposed to future decryption.
The Cystel view
The distance between "have a plan" and "know your cryptography" is where most regulated entities will be tested first. Cryptographic agility — the ability to replace algorithms without re-architecting systems — cannot be designed before the inventory exists. Entities that treat the 2026 milestone as a documentation exercise, rather than a discovery exercise, are likely to arrive at the 2028 implementation deadline without the foundation to meet it.
Recommended next step
Cystel recommends that APRA-regulated entities begin with a structured cryptographic discovery exercise: a systematic inventory of cryptographic assets, algorithms, key lengths, certificate lifespans, and third-party dependencies, mapped against data sensitivity and retention period. This is the foundation the ASD's 2026 milestone assumes, and the starting point for any transition plan capable of withstanding supervisory scrutiny. A cryptographic vulnerability assessment can then validate where legacy asymmetric cryptography creates the greatest HNDL exposure and sequence remediation accordingly.
Sources
- APRA, remarks on quantum computing risk and cryptographic mapping expectations for regulated entities, 2026. apra.gov.au
- Australian Signals Directorate, "Planning for Post-Quantum Cryptography," cyber.gov.au. cyber.gov.au
- Overcyte, "Australia publishes new guidance on the transition to post-quantum cryptography," 2026, reporting APRA remarks at the AFIA Risk Summit.
