IC Technology & Cyber — 2026-11-07

NSA, CISA, and Australian ASD Release Joint Post-Quantum Cryptography Vendor Readiness Guidance

BLUFProcurement teams now have a trilateral benchmark to pressure vendors on post-quantum readiness, giving contract renewals real leverage over suppliers who lack credible PQC migration plans.

The National Security Agency, CISA and the Australian Signals Directorate's ACSC jointly issued "Post-quantum questions to ask your vendors" on November 4, according to NSA's press release 12. The guidance supplies vendor-neutral questions for procurement, contract renewals and ongoing vendor assurance, organized by five phases of an organization's post-quantum cryptography (PQC) transition, from inventorying cryptographic dependencies to communicating with vendors 1. ISSSource reported that an accompanying quick-reference list contains the full question set by phase, and that the guidance targets long-term and cloud service contracts 3. ISSSource also reported that the guidance flags industrial control systems, legacy systems and IoT devices, where cryptography is hard to update and needs vendor support or replacement 3. ExecutiveGov covered the release on November 5 4.

Analysis
NSA, CISA and ASD's ACSC give procurement and vendor-management teams a common checklist for testing whether suppliers can support a post-quantum transition. Tying questions to the five transition phases lets buyers demand cryptographic inventories and PQC roadmaps before signing long-term or cloud service contracts. Operators of industrial control systems, legacy systems and IoT devices face the sharpest exposure, since their cryptography is hard to update and needs vendor support or replacement. Vendors that cannot answer will draw closer scrutiny at renewals, though the guidance treats early reluctance as non-disqualifying if the vendor engages openly. The release may instead serve mainly as a signal to vendors, building market pressure for roadmaps, and not as a tool buyers will apply systematically. Confidence is high: two primary agency publications agree on scope and structure, and two secondary outlets repeat them without contradiction.

4 sources

NSA Joins ASD's ACSC and CISA to Provide Practical Questions to Evaluate Third-Party Readiness for Post-Quantum Cryptography - National Security Agency
Post-quantum questions to ask your vendors - Australian Signals Directorate's ACSC
Guidance on Quantum Questions for Vendors - ISSSource
NSA Releases Joint Guidance to Gauge Vendor Post-Quantum Readiness - ExecutiveGov