CISA, Australia's ACSC and NSA publish questions to ask vendors about post-quantum cryptography readiness
- What it is: vendor-neutral questions meant to show whether a vendor understands quantum-related risk, is open about its cryptographic implementations, and supports a secure, cost-effective and timely PQC transition.
- Why vendors: CISA notes many organizations depend on third parties for managed services, cloud and cryptography-dependent products. Cryptography is also built into hard-to-update systems such as industrial control systems and IoT devices, which depend on vendor support or replacement.
- Context from CISA: widely used public-key cryptography is expected to become vulnerable once cryptographically relevant quantum computers exist, so organizations should plan the transition before then.
- Use: a procurement and third-party-risk checklist. CISA points to its PQC Initiative page for more resources.
Sources: CISA: Post-Quantum Questions to Ask Your Vendors (Nov 5)