Summary
Use these questions to assess vendor readiness for post-quantum cryptography (PQC) • Is any cryptography hardcoded, across the key phases of a PQC transition, fixed or hardware bound? aligned to ASD’s ACSC’s LATICE framework. Organisations do not need to ask every introduce cryptography? question of every vendor. Instead, apply the questions based on the vendor’s risk level, data sensitivity and longevity, and the • Do your products rely on organisation’s current stage of PQC transition. hardware roots of trust? processes be updated to support traditional asymmetric cryptography? support, and when will support be generally available to customers? or service make about the lifespan • Is your PQC implementation production of the data it processes or stores, ready and available for customer use? and how can customers configure service-specific assessment of CRQC risks? and lifecycle processes change under PQC? encryption and authentication risks? traditional asymmetric cryptography? rollout before the end of 2030? replacement or re-architecture? (PQ/T) hybrid modes as a temporary deprecated, including any temporary transition mechanism, and how and use of PQ/T hybrid approaches? when will you transition to PQC-only? prioritising PQC transition activities? relevant guidance and support PQC transition by the end of 2030? does this influence your roadmap?