NSA, CISA and Australian Partners Publish Vendor Questions for PQC Readiness

On November 4, 2026, the National Security Agency (NSA), the Cybersecurity and Infrastructure Security Agency (CISA), and the Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC) released Post-quantum questions to ask your vendors: Evaluating third-party readiness for post-quantum cryptography. The vendor-neutral guidance is intended to help organizations assess how prepared third parties are to manage the transition to post-quantum cryptography (PQC) and mitigate risks associated with a cryptographically relevant quantum computer. It is an assessment resource rather than a contract, solicitation, or announced procurement requirement.

The guidance addresses a procurement challenge created by organizations’ dependence on vendor products, managed services, and cloud services. In many cases, vendors select and implement the cryptographic mechanisms used in those offerings. That means an organization’s PQC transition depends not only on its own plans and technical capacity, but also on vendor readiness, transparency, and roadmaps. Gaps or delays in a supplier’s product or service can undermine an otherwise well-developed customer transition plan and leave residual risk in the supply chain.

For acquisition and vendor-management teams, the questions can be incorporated into market research, vendor assessments, contract renewals, and ongoing assurance processes. Structured engagement can help buyers understand where cryptographic dependencies exist, how vendors assess quantum-related risks, and whether products and services can support a secure, cost-effective, and timely transition. The agencies note that engaging vendors early can reduce late-stage surprises, including discovering that a critical product, service, or dependency cannot support PQC within required timeframes.

The material aligns vendor engagement with high-level phases of an organization’s PQC transition: locating and inventorying cryptographic dependencies; assessing system-level risk; triaging and prioritizing systems; implementing PQC algorithms; and communicating with vendors and educating relevant stakeholders. Contractors and suppliers can use the questions to prepare clear, consistent information about cryptographic implementations, dependencies, transition plans, and support capabilities. This may help vendors respond to customer assurance requests and distinguish documented readiness from plans that remain incomplete. The published information announces no contract value, solicitation, or deadline, and does not characterize the guidance as a compliance mandate.

• NSA, CISA, and ASD’s ACSC jointly released vendor-neutral PQC readiness questions on November 4, 2026.
• The resource is titled Post-quantum questions to ask your vendors: Evaluating third-party readiness for post-quantum cryptography.
• Procurement teams can use the questions during sourcing, vendor assessments, contract renewals, and ongoing vendor assurance.
• The assessment focuses on vendors’ cryptographic dependencies, implementation transparency, quantum-risk awareness, transition plans, and support capabilities.
• The agencies frame vendor readiness as a supply-chain consideration because third parties often select and implement cryptography in products, managed services, and cloud services.
• The transition framework covers inventorying dependencies, assessing risk, prioritizing systems, implementing PQC algorithms, and communicating with vendors and stakeholders.
• Early engagement can help identify whether critical products, services, or dependencies may miss an organization’s transition timeframes.
• Vendors and contractors can prepare evidence about product capabilities and roadmaps to support customer risk reviews and renewal discussions.
• The guidance is voluntary assessment material; no compliance mandate, solicitation, contract value, or deadline was announced.