FEATURE systems, network infrastructure, cloud services, hardware and software. Some of those systems have been around for decades and some will probably still be around a decade from now.
This is why waiting for certainty around Q-Day is the wrong strategy.
ANZ got Y2K right
Australia and New Zealand handled Y2K well because organisations started early and treated it as a serious technology programme. We need the same discipline with post-quantum cryptography, but this time there is no single, universal deadline forcing everyone to act.
The Australian Signals Directorate’ s( ASD) Australian Cyber Security Centre published
One of the mistakes made is assuming the risk commences when a cryptographically relevant quantum computer arrives.
guidance in September 2025 setting a phased timeline: a refined transition plan by the end of 2026, migration of the highest-risk systems by the end of 2028 and full transition by 2030. That’ s a sensible structure, but it’ s guidance, not law. And there’ s no penalty for missing it.
New Zealand’ s approach is looser still. The GCSB’ s National Cyber Security Centre has folded quantumreadiness into the NZ Information Security Manual but hasn’ t set a migration deadline.
By comparison, Google has committed to a hard 2029 deadline for full post-quantum migration across its products and infrastructure and the UK’ s National Cyber Security Centre has given organisations until 2035.
Mohan Veloo, Chief Technology Officer, Asia Pacific, China and Japan at F5 www. intelligentcio. com
INTELLIGENT CIO APAC
25