Payments, data exchange and critical infrastructure all rely on cryptography. A cryptographically relevant quantum computer (CRQC) would be able to break widely used public-key algorithms such as RSA and ECC. Attackers can also "harvest now, decrypt later" (HNDL), so data that must stay confidential for a long time is already at risk today.
The draft master plan from Thailand's National Cyber Security Agency (NCSA) turns the national readiness framework into an actionable plan. It rests on four policy stances:
- PQC-first: post-quantum cryptography is the main approach.
- QS-aware: work proceeds under the quantum-security readiness framework.
- QKD-selective: quantum key distribution is used only where it is necessary and supported by evidence.
- Smart Adopter: technology is adopted with judgement and in a verifiable way.
The work runs in four phases:
- Phase 0 (2026): set up the mechanisms.
- Phase 1 (to 2027): build a cryptographic inventory.
- Phase 2 (2028–2030): run pilots and migrate high-risk systems.
- Phase 3 (2031–2035): migrate at scale and assure readiness.
Readiness gates (A, B, C) control the move from one phase to the next. Delivery is organised around nine functional roles (R1–R9) and eight national work packages. Procurement is used as a lever, so that new systems are crypto-agile from the start.
What you can start now: inventory where and how your systems use cryptography, identify long-lived sensitive data, and add PQC and crypto-agility requirements to new procurements.
Source: NCSA (Thailand), draft for public consultation. It is not final and should not be cited as official. Copyright belongs to NCSA. Shared by InfraLab for educational purposes.