NSA Joins ASD’s ACSC and CISA to Provide Practical Questions to Evaluate Third-Party Readiness for Post-Quantum Cryptography

FORT MEADE, Md. - The National Security Agency (NSA) is joining the Australian Signals Directorate's Australian Cyber Security Centre (ASD's ACSC), and the U.S. Cybersecurity and Infrastructure Security Agency (CISA) in releasing, "Post-quantum questions to ask your vendors: Evaluating third-party readiness for post-quantum cryptography."

This guidance outlines practical and effective ways to mitigate risks posed by a cryptographically relevant quantum computer. It provides vendor-neutral questions for use during procurement activities, contract renewals, or ongoing vendor assurance processes to assess post-quantum cryptography (PQC) readiness.

Many organizations rely on third-party vendor products, managed services, and cloud services where the vendors choose and implement cryptographic mechanisms. As a result, reliance on vendors means that an organization's transition to PQC will depend on its vendors' readiness, transparency, and roadmaps. Even where an organization has strong cryptographic expertise and a refined PQC transition plan, weaknesses or delays within the supply chain can undermine these efforts and introduce residual risk.

The guidance structures engagement across different vendor types and risk profiles by aligning to the high-level phases of an organization's PQC transition:

• Locate and inventory cryptographic dependencies
• Assess risk to individual systems
• Triage and prioritize systems for transition
• Implement PQC algorithms
• Communicate with vendors and educate relevant stakeholders

Early and structured engagement also reduces the likelihood of late-stage surprises, such as discovering a critical product, service, or dependency cannot support PQC within required timeframes.

The authoring agencies urge organizations, third-party vendors, and other stakeholders to use this guidance to help assess how well a vendor understands quantum-related risks; maintains transparency over its cryptographic implementations; and supports a secure, cost-effective and timely transition to PQC.

Additional Resources

• Read the full report.
• Read the Quick-reference list.
• Visit our Post-Quantum Cryptography page for additional PQC resources.
• Visit our full library for more cybersecurity information and technical guidance.
• Visit the Zero Trust Implementation Guidelines page for adaptable, interactive cybersecurity frameworks.
• Visit the Cybersecurity Collaboration Center to explore free resources for Defense Industrial Base contractors.
  

NSA Media Relations
[email protected]
443-634-0721

About the National Security Agency

The National Security Agency leads the U.S. Government in cryptology that encompasses both foreign signals intelligence (SIGINT) insights and cybersecurity products and services and provides the Nation decision advantage in competition, crisis, and conflict.

###