Updated guidance turns quantum readiness into a procurement question, asking suppliers to identify embedded cryptography and show how products can be upgraded.
Cybersecurity agencies in the United States and Australia have updated their guidance on assessing vendors’ readiness for post-quantum cryptography. The NSA, CISA and the Australian Signals Directorate’s Australian Cyber Security Centre published questions for organisations buying software, renewing contracts or reviewing cloud and managed services.
A sufficiently capable quantum computer could undermine some of the public-key methods in use today. The risk arrives sooner for sensitive data that can be intercepted now and would still be valuable if it could be decrypted years later. The agencies recommend taking that lifetime into account when deciding which systems should move first.
The inventory goes beyond encryption settings
A vendor may choose the algorithms used for signing software updates, setting up secure connections or authenticating users. The guidance asks whether the supplier can identify which cryptography is in use and where it sits. A cryptographic bill of materials can record algorithms, libraries, protocols and configurations, including dependencies inherited from third parties.
Some dependencies sit in firmware or hardware and can be harder to change than an application setting. An example is the key a device uses to verify that its firmware came from the manufacturer. An upgrade plan for that device needs to explain how the existing trust mechanism can transition and whether older units require replacement.
An algorithm is only one part of the migration
NIST’s FIPS 203 standard specifies ML-KEM, a way for two parties to establish a shared secret over a public channel. Putting it into service also requires compatible protocol implementations, supported product versions and deployment across the systems that communicate with each other.
The guidance distinguishes technical readiness from a supplier’s ability to deliver it. Buyers can ask which products or versions are covered, how upgrades are distributed and what happens to equipment that will stay in service beyond a vendor’s support window. The answers can shape renewal dates and replacement budgets.
Dates need a defined scope
The Australian guidance refers to 2030 as a planning milestone drawn from its own transition objectives. It asks organisations to align their work with the rules and risk in their jurisdiction and sector. A cloud provider, an industrial equipment maker and a software vendor may all use the same cryptographic standards while facing different upgrade cycles.
One practical result of the guidance is a more specific conversation at contract renewal. A customer can ask where traditional public-key cryptography remains in a product, who controls the upgrade and when the relevant version will be supported. That gives security and purchasing teams evidence they can compare across suppliers.
Sources
Australian Signals Directorate — post-quantum questions to ask vendors
Australian Cyber Security Centre — release of the updated guidance
