On November 4, the National Security Agency (NSA) joined the Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC), and the U.S. Cybersecurity and Infrastructure Security Agency (CISA) in releasing “Post-quantum questions to ask your vendors: Evaluating third-party readiness for post-quantum cryptography.”
This guidance outlines practical and effective ways to mitigate risks posed by a cryptographically relevant quantum computer, the agency said. It provides vendor-neutral questions for use during procurement activities, contract renewals, or ongoing vendor assurance processes to assess post-quantum cryptography (PQC) readiness.
Many organizations rely on third-party vendor products, managed services, and cloud services where the vendors choose and implement cryptographic mechanisms. As a result, reliance on vendors means that an organization’s transition to PQC will depend on its vendors’ readiness, transparency, and roadmaps. Even where an organization has strong cryptographic expertise and a refined PQC transition plan, weaknesses or delays within the supply chain can undermine these efforts and introduce residual risk.
The guidance structures engagement across different vendor types and risk profiles by aligning to the high-level phases of an organization’s PQC transition:
- Locate and inventory cryptographic dependencies
- Assess risk to individual systems
- Triage and prioritize systems for transition
- Implement PQC algorithms
- Communicate with vendors and educate relevant stakeholders
Early and structured engagement also reduces the likelihood of late-stage surprises, such as discovering a critical product, service, or dependency cannot support PQC within required timeframes.
The authoring agencies urge organizations, third-party vendors, and other stakeholders to use this guidance to help assess how well a vendor understands quantum-related risks; maintains transparency over its cryptographic implementations; and supports a secure, cost-effective and timely transition to PQC.
Read the full report.
Source: NSA
IC News delivers the situational awareness you need to get ahead and stay ahead in the IC contracting space. Subscribe today for full access to 10,000+ articles, plus new articles each weekday.
By Loren Blinde
November 5, 2026
