Is Your Vendor Ready for the Quantum Era? New Joint Guidance Lists the Questions to Ask

CISA, the Australian Signals Directorate's Australian Cyber Security Centre (ASD's ACSC) and the US National Security Agency (NSA) have released joint guidance and a quick-reference list to help organisations check vendor readiness for post-quantum cryptography (PQC). As quantum computing advances, widely used public-key cryptography is expected to become vulnerable to cryptographically relevant quantum computers. PQC uses algorithms designed to withstand both classical and quantum-enabled threats, and organisations need to plan the transition before such computers become available.

Most businesses depend on third parties for managed services, cloud capabilities and other products that rely on cryptography. Some of that cryptography sits in systems and devices that are hard to update, have long lifecycles and need vendor support or replacement, such as industrial control systems and Internet of Things (IoT) devices. This means a successful transition depends heavily on how prepared your vendors are, and early, structured conversations with them are critical.

The guidance sets out vendor-neutral questions to help organisations judge whether a vendor understands quantum-related risks, is transparent about its cryptographic implementations, and can support a secure, cost-effective and timely move to PQC. CISA also provides further resources on its PQC Initiative page.