[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"branding":3,"analytics":7,"article-cisa-and-nsa-give-buyers-post-quantum-questions-for-vendors":10,"sections":41},{"siteName":4,"siteTagline":5,"publisherName":4,"contactEmail":6},"The Revision","Tech news, decoded.","editor@therevision.news",{"gaMeasurementId":8,"adsenseClientId":9},"G-ZW2MV82GYR","ca-pub-8533917693782264",{"article":11},{"id":12,"slug":13,"title":14,"dek":15,"body_md":16,"tags_json":17,"published_at":18,"created_at":19,"updated_at":20,"status":21,"review_note":22,"review_notes":23,"image_url":22,"persona_id":22,"persona_name":22,"section":30,"tags":31,"sources":36,"feedback":40,"feedback_at":22,"cost_usd":40,"total_tokens":40},12412,"cisa-and-nsa-give-buyers-post-quantum-questions-for-vendors","CISA and NSA Give Buyers Post-Quantum Questions for Vendors","A joint CISA, NSA and Australian guide gives organizations vendor-neutral questions to test whether suppliers are ready for post-quantum cryptography.","CISA, the NSA and the Australian Signals Directorate's Australian Cyber Security Centre have released joint guidance, plus a quick-reference list, to help organizations judge whether their vendors are ready for post-quantum cryptography (PQC).\n\nPQC means encryption algorithms built to withstand attacks from both classical computers and quantum ones. The agencies' concern is cryptographically relevant quantum computers, or CRQCs: machines powerful enough to break the public-key cryptography in wide use today. Organizations, the guidance says, must plan and transition to PQC before CRQCs become available.\n\nThe new document targets a practical bottleneck. Many organizations depend on third parties for managed services, cloud capabilities and other products that rely on cryptography. Some of that cryptography sits in systems that are hard to update and tied to long asset lifecycles, such as industrial control systems and Internet of Things (IoT) devices. Fixing those often requires vendor support or outright replacement.\n\nThat reframes the migration. Swapping algorithms is a technical task, but for a large share of any organization's estate it is also a procurement question: what the supplier plans to ship, and when. The guidance says early, structured engagement with vendors is critical to planning.\n\nThe questions are vendor-neutral. They are meant to show whether a vendor understands quantum-related risks, maintains transparency over its cryptographic implementations, and supports a secure, cost-effective and timely move to PQC. Three tests, in other words: awareness, openness and delivery.\n\nThe guidance rests on a plain premise. The deadline is set by when CRQCs arrive, and for much of the equipment organizations run, the vendors set the pace of the response. CISA points readers to its PQC Initiative page for further resources.","[\"post-quantum\",\"cryptography\",\"cisa\",\"vendor-risk\"]","2026-11-05T12:00:00.000Z","2026-11-08T00:53:35.315Z","2026-11-08T00:53:37.487Z","published",null,[24],{"id":25,"reviewer":26,"round":27,"reason":28,"status":29},"editor-r1","editor",1,"Remove or source the 'November 5' publication date, which does not appear in the source, and name CISA instead of 'a US civilian cyber agency'. Cut the unsupported claims about what the guidance says or implies: that it gives no date for a CRQC, that it emphasizes knowing where cryptography lives in products, and that the agencies 'expect some uncomfortable replies'. Then end on a concluding line grounded in the source.","resolved","security",[32,33,34,35],"post-quantum","cryptography","cisa","vendor-risk",[37],{"name":38,"url":39},"CISA Advisories","https:\u002F\u002Fwww.cisa.gov\u002Fresources-tools\u002Fresources\u002Fpost-quantum-questions-ask-your-vendors",0,{"sections":42},[43,48,52,57,62,67,72,77,82,87,92,97,102,107],{"name":44,"slug":45,"count":46,"latest_published_at":47},"AI","ai",7110,"2026-11-08T14:34:09.000Z",{"name":49,"slug":30,"count":50,"latest_published_at":51},"Security",1099,"2026-11-08T15:24:01.000Z",{"name":53,"slug":54,"count":55,"latest_published_at":56},"Deals","deals",620,"2026-11-08T08:00:00.000Z",{"name":58,"slug":59,"count":60,"latest_published_at":61},"Policy","policy",604,"2026-11-07T15:48:26.000Z",{"name":63,"slug":64,"count":65,"latest_published_at":66},"Consumer Tech","consumer-tech",336,"2026-11-08T21:00:00.000Z",{"name":68,"slug":69,"count":70,"latest_published_at":71},"Hardware","hardware",316,"2026-11-08T14:36:39.000Z",{"name":73,"slug":74,"count":75,"latest_published_at":76},"Science","science",222,"2026-11-07T16:19:17.000Z",{"name":78,"slug":79,"count":80,"latest_published_at":81},"Software","software",154,"2026-11-08T15:42:52.000Z",{"name":83,"slug":84,"count":85,"latest_published_at":86},"Startups","startups",150,"2026-11-06T16:50:01.000Z",{"name":88,"slug":89,"count":90,"latest_published_at":91},"Dev Tools","dev-tools",125,"2026-11-06T22:15:59.000Z",{"name":93,"slug":94,"count":95,"latest_published_at":96},"General","general",111,"2026-11-08T21:27:29.000Z",{"name":98,"slug":99,"count":100,"latest_published_at":101},"Gaming","gaming",94,"2026-11-08T20:52:05.000Z",{"name":103,"slug":104,"count":105,"latest_published_at":106},"Reviews","reviews",38,"2026-10-20T12:00:00.000Z",{"name":108,"slug":109,"count":110,"latest_published_at":111},"How-To","how-to",8,"2026-10-05T09:00:00.000Z"]