NSA, CISA, and ASD issue guidance on post-quantum cryptography vendor readiness

The National Security Agency (NSA), the Cybersecurity and Infrastructure Security Agency (CISA), and the Australian Signals Directorate (ASD) have released a joint guide to help organizations evaluate supplier preparedness for post-quantum cryptography (PQC).

The 19-page document provides 31 vendor-neutral questions designed for use during acquisitions, contract renewals, and ongoing supplier assurance reviews. The guidance is organized into five transition phases: locate, assess, triage, implement, and communicate.

Agencies warned that a cryptographically relevant quantum computer could eventually defeat current public-key cryptography. Because many organizations rely on vendor-supplied managed services, cloud platforms, and hardware, the transition to PQC depends heavily on supplier transparency and roadmaps. The guide highlights potential risks, such as hardcoded cryptography, opaque proprietary systems, and vendors offering PQC only as a premium add-on. The agencies aim to help security leaders mitigate supply chain gaps before the 2030 deployment goals.