CISA, the Australian Signals Directorate's Australian Cyber Security Centre (ASD's ACSC), and the National Security Agency (NSA) released joint guidance and a quick-reference list. The documents help organizations assess whether their vendors are ready to move to post-quantum cryptography (PQC).
The guidance says that as quantum computing advances, widely used public-key cryptography will become vulnerable to compromise from cryptographically relevant quantum computers (CRQCs). Organizations should plan for and adopt PQC algorithms before CRQCs become available.
Many organizations depend on third-party vendors for managed services, cloud capabilities, and other cryptography-dependent products. The guidance also notes that cryptography is embedded in systems and devices that are hard to update, such as industrial control systems and Internet of Things (IoT) devices. Because of this reliance, the guidance says effective PQC transition depends on vendor readiness. It recommends early, structured engagement with vendors.
The vendor-neutral questions in the guidance are designed to help organizations determine whether a vendor understands quantum-related risks, is transparent about its cryptographic implementations, and can support a secure, cost-effective, and timely transition