Thai SEC Quantum Risk Guide for Boards: 5 Steps to Prepare for Post-Quantum Cryptography A plain-English summary of the Thai SEC's 2026 quantum risk and PQC guide for boards: the 5 key steps, example 12-month outcomes and what it does not require.
Thai SEC Quantum Risk Guide for Boards: 5 Steps to Prepare for Post-Quantum Cryptography
In September 2026, the IT risk supervision and inspection department of Thailand's Securities and Exchange Commission (SEC) published Quantum Risk Governance & PQC Transition , a 45-page guide for company directors with nine chapters and four board tools. The guide is in Thai; quoted phrases below are our translations.
Short answer: it is advice, not law. The guide calls itself preliminary guidance and "not a legal requirement or regulation" (PDF page 2). It asks boards to know where the quantum risk sits, decide what goes first and set a roadmap that does not disrupt the business, not to rush into buying technology or replace all encryption at once. Two things any firm can start now: name one accountable executive, and start listing where the organisation uses cryptography.
What the guide is, and who it is for
Its stated readers are boards and senior executives of organisations in the capital market (page 4); it does not single out listed companies, brokers or asset managers. Because the risk reaches client data, transactions and investor confidence, the guide treats it as a governance matter rather than an IT project (page 7). It names no post-quantum algorithm, and every chapter ends with a do/don't table and five governance questions.
Why it lands on the board's desk now
Nobody can say when a quantum computer able to break today's encryption (a CRQC) will exist. Citing the Global Risk Institute, the guide says the risk could become significant from the 2030s (page 1). The executive summary gives three reasons to start now (PDF page 2):
Data can be at risk before the threat arrives. Traffic captured today can be decrypted later: Harvest Now, Decrypt Later (HNDL). The guide's examples include trading records kept for legally required periods and non-public M&A or large-order information (pages 5–6).Trust can be attacked. Forged signatures or certificates could make systems accept fake instructions: Trust Now, Forge Later (TNFL). Think online account opening, signed orders and the certificates that connect a broker to market infrastructure (pages 5–6).Transition takes time. Legacy systems, certificates, key-management hardware and vendors can take a year to several years to change (page 1).
Not all encryption is equally exposed: public-key RSA and ECC are the vulnerable part, while AES is far less affected (page 5). The guide points to NIST's FIPS 203–205, published in 2024 (page 38).
Thailand's National Cyber Security Agency (NCSA) has a draft quantum-readiness framework for 2026–2035, and the SEC guide says firms "may consider" aligning with it (page 2). The page 3 table recommends that critical and high-risk systems complete risk reduction or migration of their high-risk parts by 2030, and that general systems complete migration or have appropriate supporting measures by 2035. A note says these dates are for planning, not a forecast of when the threat arrives.
The 5 key steps
The executive summary recommends five key steps for organisations (PDF page 2).
1. Assign accountability
Name one accountable executive with decision rights, budget access and a direct line to the CEO or board (page 15), and split roles along the IIA Three Lines Model (page 14). No new standalone policy is needed; fold quantum risk into existing cybersecurity, technology-risk or ERM frameworks (page 14). The chapter 1 "don't" list warns against accepting an "in progress" report with no scope, high-risk systems, timeline or evidence (page 7).
2. Build a cryptographic inventory (CBOM)
A Cryptographic Bill of Materials records which system uses which cryptography, for what, who owns it and what it depends on, including cloud, packaged software, APIs and certificate providers the firm does not control (page 17). For illustration, a broker using a vendor's order system and an external e-KYC API should include both services in its inventory scope and obtain cryptographic information from their providers. The guide suggests linking the inventory to the asset register and not relying on one scanner or questionnaire (page 18). For background, see asset inventories and external attack surfaces , and use that information alongside system documentation and provider information when building the CBOM. Unsure which systems the first pass should cover? Talk to our team ; hands-on discovery runs through partners. More in our CBOM and crypto agility article .
3. Prioritise by business risk
Weigh business model, system criticality, how long data must stay secret, legal obligations and vendor dependence (PDF page 2). The guide warns against a fixed rule that only data kept for more than ten years counts as high risk (page 18): an order-signing system may hold little long-lived data, yet a forged signature hurts at once. Personal data also ties to the security duty under Thailand's PDPA (page 18; see PDPA basics ).
Chapter 3 adds Mosca's rule, X + Y > Z. X is how much longer the data must stay confidential, Y is the time needed to migrate, and Z is the estimated time before a quantum computer could break current cryptography. If X + Y > Z, the data may not stay secure for as long as it needs to. The guide suggests working through at least three scenarios: early, expected and late (pages 12–13); see our HNDL and Mosca article .
4. Test before switching
Test before transition or live use; a pilot in a controlled scope is one option (PDF page 2). PQC is not just a software update: protocols, applications, devices and partner links may need work (page 9), and new key and signature sizes can slow logins and transactions (page 20). For illustration, a broker could include peak order volumes in tests under realistic workloads. Hybrid (old plus new algorithms) is not automatically safer (pages 9–10).
5. Build the capability to keep changing
Crypto agility means switching or retiring algorithms in time, without disrupting services or requiring a major rebuild every time (page 20), built into development, procurement and audit (PDF page 2). The guide suggests PQC readiness in every new procurement (page 22), at least six points in the TOR or contract for critical services (pages 22–23), and evidence rather than a vendor's bare claim of PQC support (page 22). See vendor PQC readiness .
Example outcomes for the first 12 months
The executive summary lists these as "example" outcomes, with "example" underlined (PDF page 2). Organisations can use them to define their own outcomes; they are not mandatory deliverables and are not tied to a calendar year:
an accountable executive and clear roles;
an inventory of cryptography in critical systems, noting what is not yet covered;
a priority list of data, systems and transactions, with reasons;
vendor and service-provider risk being managed;
a roadmap and an initial budget;
a pilot tested before transition or live use;
board reporting on progress, residual risk, obstacles, budget and decisions needed.
Chapter 9 assigns no fixed years or durations to individual phases. Phase 1 includes a "first 12-month plan" as an output, and page 27 also says organisations may consider NCSA's 2026–2035 framework; it does not assign those years to the five phases.
The whole guide on one table
Part Pages What you get Ch. 1 Strategic risk 5–8 HNDL and TNFL in capital markets; why boards own it Ch. 2 Technology options 9–11 PQC as the base; QKD and QRNG for specific cases Ch. 3 Timeframes 12–13 Mosca's rule; 2030–2035 as a planning frame Ch. 4 Roles 14–16 Accountable executive, Three Lines, board reporting Ch. 5 CBOM 17–19 Inventory scope; at least five prioritisation factors Ch. 6 Crypto agility 20–21 Change without downtime; real-load tests; rollback Ch. 7 Supply chain 22–24 Vendor ranking, evidence, TOR terms, contingency Ch. 8 People 25–26 Role-based skills plan for 12–24 months Ch. 9 Five-phase plan 27–28 Initiate, survey, pilot, migrate, make routine Tool 1 Governance questions 29–32 Questions, evidence and decisions per phase Tool 2 Risk screening table 33 What the board tracks first Tool 3 Board dashboard 34–35 Where risk sits, what changed, what to decide Tool 4 Key vendor summary 36 Vendors that could hold up the plan
Every number in the Tool 3 dashboard is hypothetical; the guide says they are illustrative only, not an SEC requirement or expectation (page 34). If you plan to use software for part of step 2, see pricing and have a partner confirm scope before you budget.
What the guide does not require
Is it mandatory?
No. The guide says so in three places (PDF page 2, page 4 and page 42), and it mentions no penalties, inspections or reporting to the SEC.
Do we have to finish by 2030 or 2035?
The 2026–2035 window is the NCSA's draft, which firms "may consider" (pages 2 and 27). The page 3 targets use "should", and chapter 3 treats 2030–2035 as a planning frame, not the date the threat arrives (page 13). The 12-month outcomes are examples for setting your own outcomes, not mandatory deliverables.
Do we need QKD, a particular scanner or a new committee?
No. PQC is the base; QKD and QRNG are optional and do not replace it (pages 9–10). Page 42 states that mentioning technologies, products or services does not imply SEC endorsement or support, and the CBOM discussion on pages 17–18 prescribes no file format or CBOM standard. The guide also says no standalone policy is needed (page 14) and recommends board reporting at least quarterly (page 15).
Where to start at the next board meeting
A board need not use every question at once (page 29). Two from chapter 1 make a good opening (page 8): has quantum risk entered the corporate risk register, and who is accountable for the outcome? Which data or transactions need long protection and could be captured today for decryption later?
Then ask what has not been measured yet; the 12-month example itself asks firms to note what is not yet covered. If your team uses zcrX , its cryptography posture lists certificates and algorithms on hosts and build systems with an Agent installed, scored quantum-safe, ready or not ready, and a host with no Agent shows as not measured rather than assumed safe. That shows what the Agents can see; vendor systems, prioritisation, planning and the transition itself remain work for your team and partners. The PQC Readiness page explains what zcrX measures.
More in this series
Contact us
Want to talk through which systems your first cryptographic inventory should cover, or what to prepare before the board meeting? Talk to our team — the consultation is free. zcr supplies the software; hands-on discovery, planning and transition work is delivered through partners.
Sources
Thai SEC — Quantum Risk Governance & PQC Transition guide for company directors (September 2026, PDF, in Thai) — read 27 October 2026. "Page N" is the page number printed in the document; "PDF page 2" is the executive summary, which has no printed page number. Quoted phrases are our translations. Products | Pricing | Resources | Insights | Contact 