CISA, the National Security Agency, and the Australian Cyber Security Centre released joint guidance on November 5, 2026. The publication aims to help organizations evaluate vendor readiness for transitioning to post-quantum cryptography.
Assessing Vendor Readiness
CISA, the Australian Signals Directorate's Australian Cyber Security Centre, and the National Security Agency released joint guidance and a quick-reference list on November 5, 2026. The publication is designed to help organizations evaluate vendor readiness for transitioning to post-quantum cryptography.
As quantum computing advances, widely used public-key cryptography will face vulnerabilities from cryptographically relevant quantum computers. Organizations must plan for and transition to PQC before these threats materialize.
Supply Chain Dependencies
Many organizations depend on third-party vendors for cloud capabilities, managed services, and other cryptography-dependent products. Additionally, industrial control systems and Internet of Things devices have long asset lifecycles and require vendor support to update.
Organizations can use the vendor-neutral questions outlined in the guidance to determine whether vendors understand quantum risks and support a timely PQC transition.
What to do
- Use the vendor-neutral questions outlined in the guidance to determine whether a vendor understands quantum-related risks, maintains transparency over its cryptographic implementations, and supports a secure, cost-effective and timely transition to PQC.
Key facts and where they come from
- CISA, ASD's ACSC, and the NSA released joint guidance to help organizations assess vendor readiness for transitioning to post-quantum cryptography.
released joint guidance and an accompanying quick-reference list to help organizations assess vendor readiness for transitioning to post-quantum cryptography (PQC).
- Widely used public-key cryptography will become vulnerable to compromise from cryptographically relevant quantum computers as quantum computing advances.
As quantum computing advances, widely used public-key cryptography will become vulnerable to compromise from cryptographically relevant quantum computers (CRQCs).
- Many organizations rely on third-party vendors for managed services, cloud capabilities, and cryptography-dependent products.
Many organizations rely on third-party vendors for managed services, cloud capabilities, and other cryptography-dependent products and services.
