Summary
Evaluating third-party readiness for Post-quantum questions to ask your vendors This publication provides vendor-neutral questions that organisations can use during procurement activities, contract renewals or ongoing vendor assurance processes to assess post-quantum cryptography (PQC) readiness. Key topics covered in this publication include: Aimed at cyber security leaders, procurement and vendor management teams, and technical stakeholders responsible for assessing third-party PQC preparedness, these questions help organisations evaluate whether a vendor: The Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC) authored this publication in partnership with the United States’ Cybersecurity and Infrastructure Security Agency (CISA) and National Security Agency (NSA). Throughout this publication, these organisations are referred to as the ‘authoring agencies’. Advances in quantum computing will change the security landscape for digital communications. Traditional asymmetric cryptography, which protects sensitive data, will be vulnerable to attacks from a cryptographically relevant quantum computer (CRQC). These quantum systems can break widely deployed public-key cryptography.