Australia's ISM-1917 requires new government cryptography to support PQC by 2030
1 DECEMBER 2024, CANBERRA
The Australian Signals Directorate's Information Security Manual added control 1917, which requires new government cryptography to support post-quantum algorithms by 2030. The control names ML-DSA-87 and ML-KEM-1024 for the post-quantum schemes, with SHA-384 or SHA-512 for hashing and AES-256 for symmetric encryption. It gives Australian agencies a precise technical target rather than a general requirement.
The control targets new cryptography. It shapes what agencies build and buy from now on, rather than forcing an immediate rip-and-replace of everything in place. As agencies renew systems through 2030, the control steers the estate toward post-quantum support, so the migration happens through the normal refresh cycle instead of a single disruptive event.
The choice of parameter sets signals a conservative posture. ML-DSA-87 and ML-KEM-1024 are the highest-security configurations of their standards, so selecting them favours a larger security margin over performance. That trade-off fits government data, which often must stay protected for long periods and justifies the extra cost of the strongest options.
Why it matters. ISM-1917 turns Australia's post-quantum intent into a concrete control with named algorithms and a 2030 date for new cryptography. By tying the requirement to new systems, it makes the migration manageable through routine renewal. Agencies and their suppliers can specify ML-DSA-87 and ML-KEM-1024 in new procurements now, aligning with both the control and the international NIST standards behind it.