Summary
At a glance This publication provides a structured set of questions organisations can use to assess how prepared their vendors are for the transition to PQC. In this publication, the term ‘vendor’ refers to third-party suppliers of products or services. It covers key areas including cryptographic dependencies, risk assessment, transition planning, implementation approaches, and communication with suppliers throughout the transition process. The guidance helps organisations understand supply chain dependencies and identify factors that could affect their ability to adopt PQC within recommended timeframes. It is intended for cyber security leaders, procurement and vendor management teams, and technical stakeholders responsible for assessing third-party products and services. This publication provides a structured set of questions organisations can use to assess how prepared their vendors are for the transition to PQC.