CISA, NSA, and ASD Release Joint Guidance on Post-Quantum Cryptography Vendor Readiness

CISA, the Australian Signals Directorate's Australian Cyber Security Centre (ASD's ACSC), and the National Security Agency (NSA) have released joint guidance and an accompanying quick-reference list designed to help organizations assess vendor readiness for transitioning to post-quantum cryptography (PQC). As quantum computing advances, widely used public-key cryptography will become vulnerable to compromise from cryptographically relevant quantum computers (CRQCs). To protect their systems and data, organizations must plan for and transition to PQC — algorithms capable of withstanding both classical computing and quantum-enabled threats — before CRQCs become available.

Many organizations rely on third-party vendors for managed services, cloud capabilities, and other cryptography-dependent products and services. Cryptography is also embedded in systems and devices that are difficult to update, tied to long asset lifecycles, and require vendor support or replacement — such as industrial control systems and Internet of Things (IoT) devices. Reliance on vendors means that effective PQC transition depends on vendor readiness, and early, structured engagement with these vendors is critical to planning efforts.

Organizations can use the vendor-neutral questions outlined in this guidance to determine whether a vendor understands quantum-related risks, maintains transparency over its cryptographic implementations, and supports a secure, cost-effective and timely transition to PQC. The advisory does not release any software patch; instead, it recommends that organizations use the provided questions to engage vendors, assess their PQC roadmaps, and demand transparency and support for post-quantum cryptographic algorithms. Organizations should monitor CISA's PQC Initiative page for additional resources.