Agencies urge organizations to assess vendor readiness for post-quantum cryptography
A joint guidance effort from the U.S. Cybersecurity and Infrastructure Security Agency (CISA), the Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC) and the U.S. National Security Agency (NSA) is intended to help organizations evaluate whether their vendors are preparing for post-quantum cryptography (PQC). The agencies released vendor-neutral questions and a companion quick-reference list for use in supplier discussions.
The guidance addresses a long-term but consequential change in cryptography. Widely used public-key cryptographic systems could be vulnerable to compromise by cryptographically relevant quantum computers (CRQCs). The agencies say organizations should plan to transition to PQC before such computers become available. PQC refers to algorithms designed to withstand attacks using both classical computers and quantum-enabled capabilities.
Vendor readiness is part of the transition
Many organizations depend on third parties for managed services, cloud capabilities and products or services that rely on cryptography. As a result, an organization’s ability to prepare for PQC may depend in part on the readiness and support of its suppliers. Early, structured engagement can help organizations understand whether vendors recognize quantum-related risks and are planning for the transition.
The guidance’s questions are designed to help buyers assess three broad areas: a vendor’s understanding of quantum-related risks, its transparency about cryptographic implementations, and its ability to support a secure, cost-effective and timely move to PQC. The material is vendor-neutral, making it applicable to discussions across different supplier relationships rather than tied to one product or technology provider.
For procurement, security and technology teams, the questions offer a basis for bringing cryptographic transition into existing vendor-risk conversations. Teams can use them to clarify what a supplier knows about cryptography in the services and products it provides, what information it can share about those implementations, and how it expects to assist customers as requirements change. The guidance does not, in the supplied description, prescribe a single transition schedule or a specific vendor response; organizations will need to assess answers in the context of their own systems and dependencies.
Hard-to-update systems require attention
The agencies also draw attention to technology that can be difficult to update. Cryptography may be embedded in devices and systems with long asset lifecycles, or in environments where changing components requires vendor support or replacement. Industrial control systems and Internet of Things (IoT) devices are examples identified in the guidance.
These dependencies can make supplier engagement particularly important. A buyer may not have direct control over how cryptography is implemented or changed in a vendor-supported system. Understanding the supplier’s readiness and the support it can provide can therefore inform planning for products that are not easily replaced or updated. The guidance frames this as a supply-chain concern, not solely an internal cryptography project.
Organizations can incorporate the questions into structured conversations with vendors and use the responses to identify where further information or planning is needed. This can help teams build a clearer view of third-party dependencies as they prepare for a transition, including dependencies in managed services, cloud capabilities, industrial control systems and IoT devices. The agencies emphasize that early engagement is critical to effective planning.
Use the questions to start supplier discussions
The joint guidance is intended for organizations across government and industry, including small and medium businesses. Its practical value lies in giving buyers a common starting point for assessing vendor preparedness and transparency. It does not remove the need for organizations to understand their own cryptographic dependencies, but it can help them ask suppliers how those dependencies will be addressed.
Organizations seeking additional material can consult CISA’s PQC Initiative resources. For security leaders, procurement teams and system owners, the immediate takeaway is to include post-quantum readiness in vendor engagement before long-lived or difficult-to-update systems become urgent transition challenges.
