What Korea's national PQC roadmap looks like from the outside, and why it matters beyond its borders
Quantum-safe cryptography is usually discussed as a future-facing "get ready when you can" recommendation. South Korea just broke from that pattern. Its intelligence agency has now attached specific years, specific procedures, and specific penalties-in-waiting to post-quantum cryptography (PQC) adoption across the public sector, turning a long-term aspiration into a compliance calendar.
For organizations watching Korea as a market, a partner ecosystem, or simply a bellwether for how a technically advanced, cyber-exposed country handles the quantum transition, the details are worth a closer look.
South Korea's Intelligence Agency Lays Out a National Roadmap
On September 17, 2026, South Korea's National Intelligence Service (NIS) — the agency responsible for the country's cyber and national security policy, roughly analogous to a blend of a national CERT and security regulator — presented its "Comprehensive Plan for PQC Transition" at Cyber Summit Korea (CSK 2026) in Seoul. The plan is built around 2 core strategies, 6 major tasks, and 59 detailed action items.
Two elements of the announcement stand out. First, PQC adoption will become part of the formal scorecard used to evaluate the cybersecurity posture of national and public institutions. Second, for the first time, the NIS attached hard deadlines to when specific PQC algorithms must actually be deployed.
What Changes, and When
PQC Enters Korea's Cybersecurity Assessment System
To understand why this matters, it helps to know what that scorecard is. Since 2007, the NIS has run an annual "Cybersecurity Posture Assessment" under Korea's Cyber Security Work Regulation (Article 13), on-site auditing central government agencies, provincial governments, and public institutions on how well their security management, operations, and incident response actually hold up. The results feed into the government's broader performance evaluation system, and the weight given to this assessment inside public institutions' management evaluations was recently raised from 0.25 points to 0.6 points. (Byline Network)
Starting in 2027, PQC adoption status becomes a new line item in that assessment. A metric that used to live in the "recommended" category now sits alongside the factors that determine an institution's official security score.
Two Mandate Tracks, Each on Its Own Clock
The plan sets separate timelines for the two core cryptographic functions: Key Encapsulation Mechanism (KEM), used for key exchange, and Digital Signature Algorithm (DSA), used for authentication and integrity.
Key Encapsulation Mechanism (KEM)
- January 2027: Candidate algorithms selected for validation
- January 2028: Validation carried out
- January 2029: Deployment becomes mandatory
Digital Signature Algorithm (DSA)
- January 2028: Candidate algorithms selected for validation
- January 2030: Deployment becomes mandatory (two years after candidate selection)
Both tracks follow the same three-step logic — select, validate, mandate — with KEM running about a year ahead of DSA. The NIS also said it is in discussions to pull forward its broader target of completing a nationwide PQC transition by 2035.
Why the Deadlines Now
This announcement didn't appear out of nowhere. It sits on top of a legislative change: an amendment to Korea's Quantum Technology Industry Act that passed the National Assembly in May 2026. Article 18-2 of that law requires government ministries, local governments, and public institutions to establish and carry out plans for securing and applying quantum security technology. By one count, that obligation reaches roughly 600 organizations — 342 public institutions (30 state-owned enterprises, 58 quasi-governmental agencies, and 254 other public bodies), 18 government ministries, and 243 local governments. (Data Economy)
It's worth being precise here: the law itself doesn't spell out KEM- or DSA-style deployment deadlines. What it does is establish a general legal obligation to "plan and act." The NIS roadmap, by contrast, is a separate technical execution plan that sets concrete validation and deployment dates for KEM and DSA across "the national and public sector broadly" — its own wording, not a named list of the roughly 600 institutions covered by the law. The two tracks clearly belong to the same policy push, but which specific organizations must hit the NIS's 2029 and 2030 dates hasn't been spelled out as a single, unified list. What is clear is the direction: this is no longer a distant "whenever quantum computers arrive" scenario. It's a concrete schedule landing within the next three to four years.
The Industry Isn't Quite There Yet
Setting a deadline is one thing. Having a supply of certified products ready to meet it is another, and this is where the picture gets more mixed.
As of this writing, only three companies hold PQC certification under Korea's KCMVP (Korea Cryptographic Module Validation Program, the country's equivalent of FIPS 140-3 validation): Hancom WITH (January 2025), Xgate (April 2026), and ITSEN PNS (July 2026). Certification took roughly four months for Xgate and three months for ITSEN PNS. (Data Economy)
Set against the roughly 600 institutions with a legal planning obligation — and the broader public-sector demand that will need to line up with the NIS's own 2029 and 2030 dates — the number of certified PQC products, and the time it takes to certify each one, is a gap that needs to close quickly. Algorithm standardization, commercial implementation, and national certification are three separate steps, each with its own timeline, and how much that combined process can be compressed will largely determine how fast the transition actually moves. That's less a flaw specific to any one company or program than a normal growing pain for a new cryptographic standard working its way through an entire industry.
The Bridge: A Hybrid Approach to PQC
To close that gap in the meantime, the NIS and Korea's National Security Research Institute published a revised Cryptographic Module Implementation Guide on September 10, 2026. Its centerpiece is permission to combine PQC with already-validated cryptographic algorithms — for both key establishment and digital signatures — rather than requiring a clean swap. (Newsworks)
In this hybrid model, values from an existing algorithm and a PQC algorithm are concatenated to derive a new shared secret. PQC is treated as a non-security-critical add-on layer, one that must not interfere with how the existing cryptographic system already behaves.
The revision is aimed at two goals at once: getting ahead of the quantum computing threat while giving domestic vendors room to transition gradually without breaking compatibility with systems already in production. It's a practical acknowledgment that a full PQC transition isn't something that happens overnight, and a real bridge built to cover the distance in between.
Where This Leaves Things
The short version of the NIS announcement is that PQC transition in Korea has moved from the realm of recommendation into the realm of regulation. Assessment integration lands in 2027, KEM deployment becomes mandatory in 2029, DSA deployment becomes mandatory in 2030 — and a separate legal basis now requires the public sector to plan for and pursue quantum security technology in the first place.
At the same time, the number of certified PQC products is still small, and certification itself takes time. The government's decision to allow a hybrid approach reads as a direct response to that gap — an attempt to manage the distance between where the industry stands today and where policy wants it to be.
For the next few years, the operative question in Korea won't just be "by when does this need to happen." It will increasingly be "how do we secure validated PQC products and a workable transition path in time to meet that schedule" — a question that applies well beyond Korea's own borders, to any organization tracking how a government-mandated PQC transition actually plays out in practice.
Frequently Asked Questions
When exactly does PQC deployment become mandatory in Korea?
Key Encapsulation Mechanism (KEM) deployment becomes mandatory in January 2029, and Digital Signature Algorithm (DSA) deployment becomes mandatory in January 2030. Each track goes through a candidate-selection stage and a validation stage before the mandate takes effect.
When does PQC start factoring into Korea's cybersecurity assessments?
Starting in 2027, PQC adoption status becomes part of the annual Cybersecurity Posture Assessment that Korea's National Intelligence Service runs for national and public institutions.
Which organizations are actually required to comply?
Under an amendment to Korea's Quantum Technology Industry Act passed in May 2026, roughly 600 organizations — 342 public institutions, 18 government ministries, and 243 local governments — are legally required to establish and carry out plans for securing quantum security technology. Separately, the NIS's KEM/DSA deployment mandates (2029/2030) apply to "the national and public sector broadly," but no single published list ties those exact ~600 organizations to those exact dates.
Do existing cryptographic systems need to be replaced with PQC right away?
Not necessarily. Korea's revised Cryptographic Module Implementation Guide allows a hybrid approach that combines PQC with already-validated algorithms, giving organizations a path to transition gradually while keeping existing systems compatible.
References
See It in Practice
If you're evaluating whether your organization's systems are ready for this timeline, take a look at ICTK's post-quantum cryptography solutions.
☑️ Explore ICTK's Quantum-Ready Technology
☑️ Talk to Us About PQC Services
Read more
What Korea's national PQC roadmap looks like from the outside, and why it matters beyond its borders
Quantum-safe cryptography is usually discussed as a future-facing "get ready when you can" recommendation. South Korea just broke from that pattern. Its intelligence agency has now attached specific years, specific procedures, and specific penalties-in-waiting to post-quantum cryptography (PQC) adoption across the public sector, turning a long-term aspiration into a compliance calendar.
For organizations watching Korea as a market, a partner ecosystem, or simply a bellwether for how a technically advanced, cyber-exposed country handles the quantum transition, the details are worth a closer look.
South Korea's Intelligence Agency Lays Out a National Roadmap
On September 17, 2026, South Korea's National Intelligence Service (NIS) — the agency responsible for the country's cyber and national security policy, roughly analogous to a blend of a national CERT and security regulator — presented its "Comprehensive Plan for PQC Transition" at Cyber Summit Korea (CSK 2026) in Seoul. The plan is built around 2 core strategies, 6 major tasks, and 59 detailed action items.
Two elements of the announcement stand out. First, PQC adoption will become part of the formal scorecard used to evaluate the cybersecurity posture of national and public institutions. Second, for the first time, the NIS attached hard deadlines to when specific PQC algorithms must actually be deployed.
What Changes, and When
PQC Enters Korea's Cybersecurity Assessment System
To understand why this matters, it helps to know what that scorecard is. Since 2007, the NIS has run an annual "Cybersecurity Posture Assessment" under Korea's Cyber Security Work Regulation (Article 13), on-site auditing central government agencies, provincial governments, and public institutions on how well their security management, operations, and incident response actually hold up. The results feed into the government's broader performance evaluation system, and the weight given to this assessment inside public institutions' management evaluations was recently raised from 0.25 points to 0.6 points. (Byline Network)
Starting in 2027, PQC adoption status becomes a new line item in that assessment. A metric that used to live in the "recommended" category now sits alongside the factors that determine an institution's official security score.
Two Mandate Tracks, Each on Its Own Clock
The plan sets separate timelines for the two core cryptographic functions: Key Encapsulation Mechanism (KEM), used for key exchange, and Digital Signature Algorithm (DSA), used for authentication and integrity.
Key Encapsulation Mechanism (KEM)
Digital Signature Algorithm (DSA)
Both tracks follow the same three-step logic — select, validate, mandate — with KEM running about a year ahead of DSA. The NIS also said it is in discussions to pull forward its broader target of completing a nationwide PQC transition by 2035.
Why the Deadlines Now
This announcement didn't appear out of nowhere. It sits on top of a legislative change: an amendment to Korea's Quantum Technology Industry Act that passed the National Assembly in May 2026. Article 18-2 of that law requires government ministries, local governments, and public institutions to establish and carry out plans for securing and applying quantum security technology. By one count, that obligation reaches roughly 600 organizations — 342 public institutions (30 state-owned enterprises, 58 quasi-governmental agencies, and 254 other public bodies), 18 government ministries, and 243 local governments. (Data Economy)
It's worth being precise here: the law itself doesn't spell out KEM- or DSA-style deployment deadlines. What it does is establish a general legal obligation to "plan and act." The NIS roadmap, by contrast, is a separate technical execution plan that sets concrete validation and deployment dates for KEM and DSA across "the national and public sector broadly" — its own wording, not a named list of the roughly 600 institutions covered by the law. The two tracks clearly belong to the same policy push, but which specific organizations must hit the NIS's 2029 and 2030 dates hasn't been spelled out as a single, unified list. What is clear is the direction: this is no longer a distant "whenever quantum computers arrive" scenario. It's a concrete schedule landing within the next three to four years.
The Industry Isn't Quite There Yet
Setting a deadline is one thing. Having a supply of certified products ready to meet it is another, and this is where the picture gets more mixed.
As of this writing, only three companies hold PQC certification under Korea's KCMVP (Korea Cryptographic Module Validation Program, the country's equivalent of FIPS 140-3 validation): Hancom WITH (January 2025), Xgate (April 2026), and ITSEN PNS (July 2026). Certification took roughly four months for Xgate and three months for ITSEN PNS. (Data Economy)
Set against the roughly 600 institutions with a legal planning obligation — and the broader public-sector demand that will need to line up with the NIS's own 2029 and 2030 dates — the number of certified PQC products, and the time it takes to certify each one, is a gap that needs to close quickly. Algorithm standardization, commercial implementation, and national certification are three separate steps, each with its own timeline, and how much that combined process can be compressed will largely determine how fast the transition actually moves. That's less a flaw specific to any one company or program than a normal growing pain for a new cryptographic standard working its way through an entire industry.
The Bridge: A Hybrid Approach to PQC
To close that gap in the meantime, the NIS and Korea's National Security Research Institute published a revised Cryptographic Module Implementation Guide on September 10, 2026. Its centerpiece is permission to combine PQC with already-validated cryptographic algorithms — for both key establishment and digital signatures — rather than requiring a clean swap. (Newsworks)
In this hybrid model, values from an existing algorithm and a PQC algorithm are concatenated to derive a new shared secret. PQC is treated as a non-security-critical add-on layer, one that must not interfere with how the existing cryptographic system already behaves.
The revision is aimed at two goals at once: getting ahead of the quantum computing threat while giving domestic vendors room to transition gradually without breaking compatibility with systems already in production. It's a practical acknowledgment that a full PQC transition isn't something that happens overnight, and a real bridge built to cover the distance in between.
Where This Leaves Things
The short version of the NIS announcement is that PQC transition in Korea has moved from the realm of recommendation into the realm of regulation. Assessment integration lands in 2027, KEM deployment becomes mandatory in 2029, DSA deployment becomes mandatory in 2030 — and a separate legal basis now requires the public sector to plan for and pursue quantum security technology in the first place.
At the same time, the number of certified PQC products is still small, and certification itself takes time. The government's decision to allow a hybrid approach reads as a direct response to that gap — an attempt to manage the distance between where the industry stands today and where policy wants it to be.
For the next few years, the operative question in Korea won't just be "by when does this need to happen." It will increasingly be "how do we secure validated PQC products and a workable transition path in time to meet that schedule" — a question that applies well beyond Korea's own borders, to any organization tracking how a government-mandated PQC transition actually plays out in practice.
Frequently Asked Questions
When exactly does PQC deployment become mandatory in Korea?
Key Encapsulation Mechanism (KEM) deployment becomes mandatory in January 2029, and Digital Signature Algorithm (DSA) deployment becomes mandatory in January 2030. Each track goes through a candidate-selection stage and a validation stage before the mandate takes effect.
When does PQC start factoring into Korea's cybersecurity assessments?
Starting in 2027, PQC adoption status becomes part of the annual Cybersecurity Posture Assessment that Korea's National Intelligence Service runs for national and public institutions.
Which organizations are actually required to comply?
Under an amendment to Korea's Quantum Technology Industry Act passed in May 2026, roughly 600 organizations — 342 public institutions, 18 government ministries, and 243 local governments — are legally required to establish and carry out plans for securing quantum security technology. Separately, the NIS's KEM/DSA deployment mandates (2029/2030) apply to "the national and public sector broadly," but no single published list ties those exact ~600 organizations to those exact dates.
Do existing cryptographic systems need to be replaced with PQC right away?
Not necessarily. Korea's revised Cryptographic Module Implementation Guide allows a hybrid approach that combines PQC with already-validated algorithms, giving organizations a path to transition gradually while keeping existing systems compatible.
References
See It in Practice
If you're evaluating whether your organization's systems are ready for this timeline, take a look at ICTK's post-quantum cryptography solutions.
☑️ Explore ICTK's Quantum-Ready Technology
☑️ Talk to Us About PQC Services
Read more