On August 26, Singapore’s Cyber Security Agency (CSA) and Government Technology Agency (GovTech) announced a Request for Information on quantum-safe market readiness and capability. The RFI asks providers of products, platforms, consulting, systems integration, and emerging capabilities to describe what they can offer as government agencies and Critical Information Infrastructure owners prepare for migration.
The announcement is meaningful because it moves the discussion from general urgency to market evidence. A migration roadmap depends on products that can be deployed, integration services that understand existing environments, and suppliers willing to state exactly what their offerings protect. Procurement teams should treat this as a model for their own discovery: “quantum safe” is not a sufficient specification.
Market readiness is not a binary property
A product may support a NIST-standardized post-quantum algorithm in one protocol while retaining classical cryptography elsewhere. A platform may protect new sessions but leave certificate authentication, code signing, firmware validation, backups, or stored data unchanged. A service provider may be able to assess an environment but depend on another vendor to implement remediation.
These differences are normal. PQC migration is a portfolio of changes, not a single installation. The risk appears when broad labels hide the boundary between supported, configured, negotiated, tested, and governed. Buyers need claims at the level of cryptographic function, protocol, version, deployment mode, and operating constraint.
A useful response to a market inquiry should therefore identify the algorithms and parameter sets implemented; whether the design is post-quantum-only or hybrid; which keys, certificates, libraries, endpoints, and protocols are affected; what remains classical; and what evidence demonstrates interoperability and performance. It should also identify dependencies on hardware, cloud services, trust stores, certificate authorities, and third parties.
Procurement should begin with the current environment
Supplier capability cannot be evaluated in isolation from the buyer’s estate. Before comparing products, an organization needs to know where cryptography is used, what function it performs, who controls it, and how long the protected data or signature must remain trustworthy.
That means building a cryptographic inventory across applications, infrastructure, network services, certificates, libraries, key-management systems, appliances, firmware, and supplier-managed services. It also means recording uncertainty. An area that has not been observed is not evidence that cryptography is absent.
With that baseline, procurement can map a vendor claim to a real dependency. A high-throughput network encryptor may be relevant to a defined link but irrelevant to application-layer signatures. A PQC-enabled TLS stack may address session confidentiality but not an embedded verifier. Consulting support may accelerate planning while leaving implementation ownership with product teams. The inventory prevents a compelling demonstration from being mistaken for complete coverage.
Ask for evidence that survives the sales cycle
Quantum-safe buying should produce durable records, not just presentations. For each material claim, teams should retain the supplier, product and version, date, scope, configuration, test method, result, and known limitations. Where certification or validation is relevant, record the exact module and certificate rather than assuming that every deployment inherits the claim.
Interoperability evidence is especially important. A migration can fail at the boundary between two individually conformant components. Test the complete path with realistic certificate chains, payloads, network conditions, failover, rollback, monitoring, and key lifecycle procedures. Performance results should include operational measures such as latency, throughput, memory, failure rates, and recovery—not merely primitive-level benchmarks.
Evidence must also age. A result tied to an earlier firmware release, algorithm draft, or integration partner may no longer support the current state. Procurement terms should address notification of cryptographic changes, support periods, vulnerability handling, upgrade paths, exportable inventory data, and access to updated attestations.
What buyers should do next
- Define use cases before requesting products. Separate key establishment, authentication, data at rest, code signing, device identity, and other functions.
- Provide a structured response template. Require exact algorithms, protocols, versions, deployment modes, dependencies, exclusions, and evidence.
- Map responses to inventory records. Connect each claimed capability to assets and owners in the current environment.
- Test operational paths. Validate interoperability, performance, failure handling, observability, and rollback in representative conditions.
- Contract for lifecycle transparency. Require change notices, support timelines, remediation responsibilities, and updated evidence.
How Vista Platform helps
Vista Platform is a self-hosted cryptographic system of record. Its operating loop is discovery, canonical inventory, evaluation, action, and proof. Vista Platform Core is free of charge and includes discovery, inventory, compliance and PQC assessment, and CBOM generation without asset, sensor, seat, or time caps.
Vista can help teams reconcile discovered evidence into governed records, compare cryptographic state with policy, assign migration actions, and preserve proof for procurement and review. It tracks and governs PQC migration; it does not generate PQC keys or perform every migration step. Vista is not a vulnerability scanner, selected-asset Active Scan is not indiscriminate network scanning, and discovery gaps are not proof of absence. The post-quantum overview describes the operating approach.
Where uncertainty remains
The public announcement summarizes the RFI; detailed submission materials require access through Singapore’s GeBiz system. The inquiry is intended to understand supply, not to certify every respondent or establish that the market is ready. The most useful conclusion is therefore procedural: governments and enterprises need comparable, evidence-backed capability data before they can turn migration milestones into credible acquisition and implementation plans.
Sources
- Quantum-Safe Market Readiness and Capability, Cyber Security Agency of Singapore, August 26, 2026.
- Post-Quantum Cryptography, National Institute of Standards and Technology, current program guidance.