Malaysia PQC Migration Framework: Five Phases

The Malaysia PQC migration framework is CyberSecurity Malaysia’s five-phase guide for moving from pre-quantum cryptography to post-quantum cryptography (PQC). The phases are Assess, Select, Validate, Deploy and Monitor, and each ends with named outputs. The document is titled Post-Quantum Cryptography Migration Framework (reference CD-4-RPT-2724-PQCMigration-V1, copyright 2024). CyberSecurity Malaysia describes the framework as “a structured and strategic pathway to help organisations transition from traditional cryptographic systems to quantum-safe alternatives”.

The framework is addressed to three groups in Malaysia: government agencies, critical infrastructure operators and private organisations. It is available as a public download from CyberSecurity Malaysia’s MyKripto platform. This review covers its structure, the Malaysian assurance schemes it relies on, the points that need reading alongside current standards, how its phases correspond to the ECEM lifecycle, and where Quantum Sentinel supports each phase.

Where the framework sits in Malaysia’s PQC programme

The framework is one element of a wider national effort:

• September 2024: the inaugural South-East Asia Post-Quantum Cryptography (SEA-PQC) Summit was held in Malaysia during Malaysia Cryptology Week, 22 to 26 September 2024.
• October 2024: Budget 2025, tabled on 18 October 2024, announced that Universiti Putra Malaysia would establish the Malaysian Cryptology Technology and Management Centre (Pusat Teknologi dan Pengurusan Kriptologi Malaysia) in collaboration with the National Cyber Security Agency (NACSA), to plan and coordinate the migration of the country’s cryptographic systems to PQC.
• Late 2025: the Malaysian government unveiled the National Post-Quantum Cryptography Migration Plan 2025-2030 and a PQC sandbox proof-of-concept programme.

The framework carries a 2024 copyright date and therefore predates the national plan. Its text does not set organisation-level deadlines, unlike Australia’s LATICE framework, which pairs its phases with an end-of-2030 date. Its adoption-rate indicator refers instead to progress that aligns with “the national timeline”.

The five phases of the Malaysia PQC migration framework

Each phase in the framework is described with an objective, a list of activities and a list of expected outputs. The named outputs make the framework practical, because every phase ends with defined deliverables.

Phase 1: Preparation [Assess]. Four activities: identify critical systems; create an inventory of cryptographic assets (a cryptography bill of materials is the usual form), including encryption protocols, key management systems and sensitive data; conduct a risk assessment; and assess external dependencies, including the cryptographic practices of third-party vendors and partners. The risk assessment “should prioritise systems based on the potential impact of a security breach and the longevity of the data they protect”. Outputs: a list of critical systems, a comprehensive inventory of cryptographic assets, a risk assessment report and an understanding of external dependencies.

Phase 2: Algorithm Selection and Standardisation [Select]. Four activities: adopt global and national standards (NIST, ETSI, ISO and MySEAL); select PQC algorithms for encryption, digital signatures and key exchange; test and evaluate the algorithms, including hybrid solutions that combine pre-PQC and PQC algorithms; and complete certification and compliance. Outputs: a set of selected algorithms aligned to standards, a performance and compatibility evaluation report, and certification and compliance documentation.

Phase 3: Validation and Pilot [Validate]. Four activities: pilot testing in critical systems; hybrid cryptographic solutions during the pilot; pilot evaluation and feedback; and optimisation of the PQC solutions. Outputs: validated PQC solutions, a pilot evaluation report, documented best practices and lessons learned, and optimised solutions ready for full-scale deployment.

Phase 4: Implementation [Deploy]. Five activities: migration planning and execution, including a sector-specific roadmap that starts with high-risk areas such as finance, defence and healthcare; infrastructure upgrades; deployment of quantum-safe solutions in priority systems, replacing RSA and ECC; testing and validation of deployed systems, including penetration tests; and compliance and certification, including Malaysia’s National Trusted Cryptographic Product (PKTN) scheme. Outputs: fully deployed PQC solutions in high-priority systems, upgraded infrastructure, a testing and validation report, and compliance and certification documentation.

Phase 5: Monitoring and Resilience [Monitor]. Four activities: post-migration audits; continuous monitoring; responding to emerging threats; and continuous improvement and system updates. Outputs: regular audit reports, a real-time monitoring system, contingency plans for emerging quantum threats and vulnerabilities, and a process for continuous updates.

The Malaysian assurance layer

The framework ties algorithm choice and product assurance to national schemes:

• MySEAL (Senarai Algoritma Kriptografi Terpercaya Negara) is the National Trusted Cryptographic Algorithm List. The framework states that it is “highly recommended” that organisations choose algorithms listed in MySEAL.
• MyCV is the Malaysian Cryptography Validation scheme, administered by the Information Security Certification Body (ISCB) of CyberSecurity Malaysia. It covers cryptographic module validation and cryptographic algorithm validation, based on ISO/IEC 19790:2012 and ISO/IEC 24759:2017. The framework suggests that all cryptographic modules undergo MyCV certification.
• MyCC, the Malaysian Common Criteria scheme, and PKTN, the Produk Kriptografi Terpercaya Negara programme, complete the chain. Products that deploy MySEAL algorithms through libraries assessed and certified by MyCV should endeavour to be certified under Malaysian Common Criteria “en route towards being acknowledged as a PKTN product”.

Technical and security guidance

Beyond the five phases, the framework sets out a series of cross-cutting positions:

• Algorithm families. Four families of PQC algorithms are named: lattice-based, code-based, multivariate and hash-based.
• Hybrid solutions. Hybrid combinations of pre-PQC and PQC algorithms are positioned as a pilot-phase option and as a temporary compensating control for modules that cannot be migrated immediately.
• Downgrade prevention. Systems that support both pre-PQC and PQC algorithms must be configured to prevent downgrades to older methods unless a downgrade is explicitly reviewed and approved. The framework identifies man-in-the-middle attacks as the risk.
• Interoperability. A dual compatibility approach is recommended, under which legacy systems that handle archival data may continue to use pre-PQC cryptography until they can be fully transitioned.
• Cryptographic agility. The ability to switch algorithms with minimal disruption is treated as central to long-term security.
• Third parties and cloud. Vendor assessments and supply chain review are recommended, along with evaluation of third-party cloud providers for PQC readiness.
• Long-term confidentiality. Data that requires long-term confidentiality is to be prioritised for encryption, because information collected today may be decrypted in the future, a risk described in the harvest now, decrypt later threat model.
• Operational technology. Manufacturing, energy and transport are named as sectors that must protect real-time systems without compromising operational efficiency.

Key performance indicators

Section 9 of the framework recommends five indicators: the percentage of critical and non-critical systems migrated; the number of personnel trained; the security incidents mitigated as a result of migration; compliance with regulatory standards, including PKTN and standards from NIST and ISO; and the PQC adoption rate across the public and private sectors.

The first indicator carries a dependency. A percentage of systems migrated can be calculated only against a complete count of systems that use cryptography, which is the Phase 1 inventory.

Reading the framework alongside current standards

Several points in the document need to be read against the current position:

• Algorithm names. The framework lists CRYSTALS-Kyber, CRYSTALS-Dilithium, SPHINCS+ and FALCON. NIST released FIPS 203, FIPS 204 and FIPS 205 on 13 August 2024, derived from Kyber, Dilithium and SPHINCS+. The standards are named ML-KEM (FIPS 203), ML-DSA (FIPS 204) and SLH-DSA (FIPS 205), and product documentation, procurement requirements and configuration settings use those names. The framework describes FALCON as at draft stage. NIST’s post-quantum cryptography standardization page, updated in August 2026, still lists FIPS 206 (FN-DSA, based on FALCON) as in development. NIST also selected HQC for standardisation in March 2025.
• MyCV expansion. The framework expands MyCV differently in two sections: as Malaysian Cryptographic Validation in Section 4.1 and as Malaysian Cybersecurity Verification in Section 6.2. CyberSecurity Malaysia’s scheme pages use Malaysian Cryptography Validation, which is the name that applies to the scheme.
• Parameter sets. The framework does not name algorithm parameter sets. Algorithm choice is deferred to MySEAL and to the standards bodies it cites.

How the framework maps to the ECEM lifecycle

Enterprise Cryptographic Exposure Management (ECEM) describes the same journey as a continuous six-stage lifecycle: Discover, Inventory, Assess, Prioritise, Transition, Monitor. The framework maps onto it as follows:

• Phase 1 (Assess) corresponds to Discover, Inventory, Assess and Prioritise. Identifying critical systems and inventorying cryptographic assets correspond to Discover and Inventory. The risk assessment, ordered by breach impact and data longevity, corresponds to Assess and Prioritise.
• Phases 2, 3 and 4 (Select, Validate, Deploy) correspond to Transition. Together they cover algorithm choice, pilots and deployment.
• Phase 5 (Monitor) corresponds to Monitor.

The structural point is that Phase 1 carries four of the six ECEM stages. Every later phase reads from its outputs: algorithm selection depends on knowing what is deployed, pilot scope depends on knowing which systems matter most, and the migration percentage depends on the inventory.

How Quantum Sentinel supports Malaysia’s PQC migration framework

Quantum Sentinel is built around the ECEM lifecycle. Its capabilities correspond most directly to the Phase 1 outputs and the Phase 5 monitoring outputs, and they support planning across Phases 2 to 4.

• Phase 1, inventory. Discovery covers endpoints, servers, applications, databases, PKI, HSMs, cloud environments and source code repositories, and builds a living Enterprise CBOM (Cryptography Bill of Materials) that maps the algorithms, certificates and keys in use. Discovery is agentless and read-only, using secure API integrations, PKI and HSM connectors, network protocols, source code repository scanning and cloud provider APIs. This corresponds to the framework’s inventory output.
• Phase 1, risk assessment. Cryptographic Exposure Assessment scores exposure using business context and recognised industry guidance including NIST and CNSA 2.0, and produces prioritised plans. This corresponds to the framework’s critical systems list and risk assessment report.
• Phases 2 to 4, planning. Migration roadmaps support the journey to PQC. Because the CBOM records where each algorithm is used, pilot selection and sector-by-sector rollout start from evidence.
• Phase 5, monitoring. Continuous tracking of cryptographic posture and progress towards quantum readiness provides the baseline for audits and for the framework’s migration indicators.
• Deployment model. Quantum Sentinel is deployed on-premises or within private infrastructure, supports air-gapped networks and segmented enterprise environments, and keeps cryptographic metadata inside the security perimeter. That model is relevant to government agencies and critical infrastructure operators, two of the framework’s three audiences.

Quantum Sentinel does not issue certification or replace the national schemes. Algorithm listing under MySEAL and product assurance under MyCV, MyCC and PKTN remain separate processes under the relevant national schemes. Quantum Sentinel supplies the visibility and prioritisation that precede them.

Evidence to hold before Phase 2 begins

Organisations working to the framework can test Phase 1 readiness against its own outputs:

• A list of critical systems that require prioritised protection.
• An inventory of cryptographic assets that includes protocols, key management systems and data types.
• A risk assessment that ranks systems by breach impact and data longevity.
• A record of external dependencies, with vendor and cloud provider PQC plans requested.

Without these four items, algorithm selection in Phase 2 rests on assumptions. With them, every later phase has a defined starting point.

Frequently asked questions

What is the Malaysia PQC migration framework?

It is the Post-Quantum Cryptography Migration Framework published by CyberSecurity Malaysia (reference CD-4-RPT-2724-PQCMigration-V1, copyright 2024). It guides government agencies, critical infrastructure operators and private organisations in Malaysia through the move from pre-quantum cryptography to post-quantum cryptography in five phases.

What are the five phases of the framework?

Assess (Preparation), Select (Algorithm Selection and Standardisation), Validate (Validation and Pilot), Deploy (Implementation) and Monitor (Monitoring and Resilience). Each phase has an objective, a list of activities and a list of expected outputs.

What are MySEAL, MyCV and PKTN?

MySEAL is the National Trusted Cryptographic Algorithm List. MyCV is the Malaysian Cryptography Validation scheme, administered by the Information Security Certification Body of CyberSecurity Malaysia. PKTN is the Produk Kriptografi Terpercaya Negara programme for trusted cryptographic products. The framework recommends MySEAL algorithms and suggests MyCV certification for cryptographic modules.

Does the framework set a migration deadline?

The framework text does not set organisation-level deadlines. Its adoption-rate indicator refers to the national timeline. The Malaysian government unveiled the National Post-Quantum Cryptography Migration Plan 2025-2030 in late 2025.

How does the framework map to the ECEM lifecycle?

Phase 1 (Assess) corresponds to the ECEM stages Discover, Inventory, Assess and Prioritise. Phases 2, 3 and 4 (Select, Validate, Deploy) correspond to Transition. Phase 5 (Monitor) corresponds to Monitor.

Source: CyberSecurity Malaysia, Post-Quantum Cryptography Migration Framework (2024). Supporting references: CyberSecurity Malaysia, Post-Quantum Cryptography Initiatives and Malaysian Cryptography Validation (MyCV); NIST, Post-Quantum Cryptography Standardization.

Further reading: what Enterprise Cryptographic Exposure Management is, why post-quantum deadlines are really inventory deadlines, the Quantum Sentinel platform and the Quantum Sentinel approach to PQC migration planning.