Your PQC migration plan is only as strong as your weakest vendor — and three governments just handed you a script to prove it.
On November 4, NSA joined the U.S.’s CISA and Australia’s ASD’s ACSC in publishing “Post-quantum questions to ask your vendors,” updating ACSC’s July guide into a tri-agency standard built for procurement, contract renewals, and ongoing vendor assurance.
**The structure:** 31 vendor-neutral questions mapped to a five-phase framework — Locate, Assess, Triage, Implement, Communicate.
**The questions that bite:** Do you maintain a CBOM? Is any cryptography hardcoded or hardware-bound? Which products will be PQC-ready before the end of 2030? How and when do you retire hybrid mode for PQC-only? Is PQC in base licensing, or a paid tier?
**Seven red flags to listen for:** vague “we’re monitoring PQC” assurances, deferred roadmap language, proprietary or opaque cryptography, PQC sold as a premium add-on, reliance on compensating controls instead of fixing the algorithm, and no named owner for the program.
Bottom Line: EO 14412 and OMB M-26-15 put the Dec 31, 2030 key-establishment deadline on federal agencies — but your real exposure runs through every vendor’s roadmap, not just your own inventory. A security questionnaire that skips these questions is a blind spot waiting for renewal day.
How is your team building vendor PQC assurance into procurement and renewal cycles?
Discovering where cryptography actually lives — including inside vendor-supplied components — is exactly what QuantVision’s CBOM maps against FIPS 203/204/205 and CNSA 2.0, giving you an internal answer to check vendor claims against.
#PostQuantumCryptography #PQC #CISO #CryptoAgility #VendorRiskManagement #CNSA2 #NIST #Cybersecurity #SupplyChainSecurity #RiskManagement