QSC Atlas

← All countries

Japan

NIST bloc Standard-contextualiser

Japan's approach is evaluation-led and is now firming into a dated plan. CRYPTREC, the national cryptographic evaluation body, publishes post-quantum cryptography guidelines and has added a post-quantum list as Table 2 of the CRYPTREC cipher list. A cross-ministerial liaison council run from the Cabinet Secretariat's National Cyber Unit set a target of completing the migration of government agencies to post-quantum cryptography by around 2035, with a roadmap to be drawn up in the 2026 financial year, and METI has set the same approximate 2035 deadline for industry with adjustments according to how sensitive the information is. The Digital Agency carries the migration among its trust-policy priorities, the Financial Services Agency has issued recommendations for deposit-taking financial institutions, and the Bank of Japan, MIC and NICT support the work through guidance, evaluation and research.

Governance credibility

Governance credibility for JapanA six-axis reading out of two: Relevance 2.0 / 2, Coherence 2.0 / 2, Effectiveness 1.5 / 2, Efficiency 2.0 / 2, Governance 2.0 / 2, Impact 2.0 / 2.RelCohEffEff.GovImp
Governance credibility scores for Japan, each out of two. Hover or focus a row to highlight its axis.
CriterionScoreConfidence
Relevance2.0 / 2Medium
Coherence2.0 / 2Medium
Effectiveness1.5 / 2Medium
Efficiency2.0 / 2Medium
Governance2.0 / 2Medium
Impact2.0 / 2Medium

Regulatory basis

  • Common Standards for Cybersecurity Measures for Government Agencies (government cryptography-use rules) national Binding (market access)
  • CRYPTREC Post-Quantum Cryptography list (Table 2 of the CRYPTREC cipher list) national Guidance
  • CRYPTREC Cryptographic Technology Guideline on Post-Quantum Cryptography (FY2024 edition) national Guidance
  • Cybersecurity Strategy (government PQC migration measures, December 2025) national Soft law
  • Liaison Council on the Use of Post-Quantum Cryptography in Government Agencies (interim summary, around-2035 target) national Soft law
  • FSA Study Group report on PQC response for deposit-taking financial institutions national Guidance

Legal status: Binding

Government agencies procuring information systems must, under the Common Standards set by the Cybersecurity Strategic Headquarters, specify ciphers from the CRYPTREC Ciphers List in their procurement requirements, which makes the list binding by market access for government suppliers. This currently governs cryptography generally rather than mandating post-quantum algorithms; CRYPTREC has evaluated and is adding the NIST post-quantum algorithms (ML-KEM and others), and its post-quantum guideline remains advisory. There is no general post-quantum obligation on the private sector.

Standards and algorithms

Standard families
NIST FIPS 203, FIPS 204, FIPS 205
Algorithms
ML-KEM

Hybrid stance

None stated

Migration timeline

today
2026
2035
20252036
  1. 2026Government post-quantum migration roadmap to be drawn up (FY2026)
  2. 2035Government and, as a rule, industry migration to post-quantum cryptography to be completed, adjusted by information criticality

Target completion: 2035

Governmental and standards bodies

  • CRYPTREC National cryptographic technology evaluation body, publishes PQC guidelines and maintains the PQC cipher list
  • Cabinet Secretariat Runs the cross-ministerial PQC liaison council through its National Cyber Unit and set the around-2035 government migration target
  • Digital Agency Carries PQC migration in its trust-policy priorities and commissioned a study on migration
  • METI Industrial cybersecurity lead, set the around-2035 PQC migration deadline for industry
  • FSA Financial Services Agency, issued recommendations for deposit-taking financial institutions migrating to PQC
  • BOJ Bank of Japan, explains PQC and how financial institutions should respond
  • MIC Ministry of Internal Affairs and Communications, evaluates and funds cryptographic R&D toward PQC
  • NICT National research institute supporting PQC R&D and reporting implementation and deployment status

Key institutional documents

Advising on this transition, or your own sector's? Request a briefing →