CISA, the NSA and the Australian Signals Directorate's Australian Cyber Security Centre have released joint guidance, plus a quick-reference list, to help organizations judge whether their vendors are ready for post-quantum cryptography (PQC).
PQC means encryption algorithms built to withstand attacks from both classical computers and quantum ones. The agencies' concern is cryptographically relevant quantum computers, or CRQCs: machines powerful enough to break the public-key cryptography in wide use today. Organizations, the guidance says, must plan and transition to PQC before CRQCs become available.
The new document targets a practical bottleneck. Many organizations depend on third parties for managed services, cloud capabilities and other products that rely on cryptography. Some of that cryptography sits in systems that are hard to update and tied to long asset lifecycles, such as industrial control systems and Internet of Things (IoT) devices. Fixing those often requires vendor support or outright replacement.
That reframes the migration. Swapping algorithms is a technical task, but for a large share of any organization's estate it is also a procurement question: what the supplier plans to ship, and when. The guidance says early, structured engagement with vendors is critical to planning.
The questions are vendor-neutral. They are meant to show whether a vendor understands quantum-related risks, maintains transparency over its cryptographic implementations, and supports a secure, cost-effective and timely move to PQC. Three tests, in other words: awareness, openness and delivery.
The guidance rests on a plain premise. The deadline is set by when CRQCs arrive, and for much of the equipment organizations run, the vendors set the pace of the response. CISA points readers to its PQC Initiative page for further resources.