The quantum transition enters ordinary procurement
On November 4, the U.S. National Security Agency joined Australia’s Cyber Security Centre and the U.S. Cybersecurity and Infrastructure Security Agency in releasing practical, vendor-neutral questions for post-quantum readiness. The guidance is designed for procurement, contract renewal, vendor assurance, cybersecurity, and technical teams.
That framing matters. Post-quantum cryptography is no longer only a research or architecture topic. Organizations increasingly need to know where a supplier uses cryptography, how long protected data must remain confidential, and whether a vendor can change algorithms without replacing an entire service or device.
Inventory dependencies before debating algorithms
The guidance starts with locating and inventorying cryptographic dependencies. Those dependencies can sit in cloud platforms, managed services, on-premises products, legacy systems, operational technology, Internet of Things devices, building systems, and physical-access controls.
Ask for a transparent cryptographic inventory or cryptographic bill of materials. The evidence should identify algorithms, libraries, certificates, protocols, key-management dependencies, product versions, and owners. A usable inventory maps each dependency to data sensitivity, expected service life, and the operational consequence of changing it.
Judge the roadmap by evidence and ownership
A credible vendor should be able to describe its transition phases, supported products, test approach, compatibility plan, customer responsibilities, and dates. The Australian guidance also flags warning signs such as general assurances, unclear timelines, opaque cryptographic components, and post-quantum capability offered only as a premium feature.
Tailor the depth of review to the vendor’s risk, the sensitivity and lifespan of the data, and the stage of the transition. A low-risk commodity service does not need the same evidence as a long-lived platform holding sensitive records or controlling critical operations.
Build a repeatable vendor-control loop
Add post-quantum questions to requests for proposal, security questionnaires, architecture review, renewal, and change management. Record the vendor’s evidence, gaps, named owner, target dates, dependencies, and any contractual commitments. Then revisit the record when a product, service, regulation, or threat assumption changes.
The practical goal is crypto agility: the ability to discover, prioritize, test, and replace cryptographic components without losing control of availability or interoperability. Procurement can accelerate that outcome by making visibility and migration evidence part of the buying decision today.