Joint vendor readiness guidance updated November 4, 2026; MAS consultation paper P019-2026 published November 6, 2026
Ask Your Vendors About Quantum, in Writing: CISA, NSA, and ASD Turn Post-Quantum Readiness Into Procurement Questions
On November 4, Australia ASD ACSC, the US NSA, and CISA jointly published an updated edition of Post-quantum questions to ask your vendors: evaluating third-party readiness for post-quantum cryptography, a 19-page guide first published by ASD in July 2026 and now issued as a joint edition. The questions are built for three concrete moments: procurement, contract renewals, and ongoing supplier reviews, including for cloud and managed services. They follow ASD LATICE framework across five phases: locate and inventory cryptographic dependencies, assess risk, triage and prioritise systems, implement post-quantum algorithms, and communicate with vendors and educate stakeholders. The substance is inventory and commitment. Buyers are prompted to ask whether a vendor maintains a cryptographic bill of materials covering algorithms, libraries, protocols, and configurations, including dependencies inherited from third parties; whether firmware can accept post-quantum signatures without hardware replacement; and whether the vendor commits to dated post-quantum-ready releases before the end of 2030. The reasoning is the harvest now, decrypt later problem: data intercepted today can be stored and decrypted later if a capable quantum computer arrives while the data still matters, so the lifetime of the data, not a headline date, decides which systems move first. NIST FIPS 203 and its ML-KEM key establishment standard are the technical anchor the coverage cites, and the governance digest that tracked the release notes the policy frame behind it, NIST IR 8547 and the January 2027 CNSA 2.0 procurement gate for National Security Systems. A parallel move landed the same week in finance: Singapore MAS published consultation paper P019-2026 on November 6, proposing supervisory expectations and indicative timelines for quantum-safe migration by financial institutions, with comments due November 23.
Executives
Three national agencies just moved post-quantum migration out of the research file and into the purchasing file. The practical consequence is budget shape: some cryptography lives in firmware and hardware trust anchors that cannot be changed with a settings update, and finding that out at renewal time, with a vendor who has no dated plan, is how an organization ends up funding emergency replacements. Ask whether your critical suppliers have been sent these questions yet, and whether the answers, not the asking, are being tracked to dates.
CIO / CISO
Adopt the question set as a standing supplier control. Add it to procurement intake, renewals, and annual reviews for software, cloud, and managed services; require a cryptographic bill of materials as a deliverable where the product handles long-lived sensitive data; and record three fields per vendor, where traditional public-key cryptography remains, who controls its upgrade, and the committed supported release date. Prioritise by data lifetime under the harvest now, decrypt later logic: records that must stay confidential for a decade outrank data that expires in a year, whatever the vendor order happens to be.
Engineers
Start with the inventory the guidance assumes: algorithms, libraries, protocols, and configurations per system, including inherited third-party dependencies, which is where inventories usually go thin. Flag the hard cases early for planning, firmware signature verification, hardware roots of trust, and any component whose vendor support window ends before its post-quantum release arrives. Where you evaluate implementations, anchor on the published standards, FIPS 203 ML-KEM for key establishment, and test interoperability between the systems that must actually talk to each other, since an algorithm alone does not migrate a protocol.
Everyone (non-IT)
Quantum computers that can break today encryption are not here yet, and this guidance is not an emergency. It is the opposite: governments telling organizations to ask suppliers, years ahead, how their products will switch to stronger mathematics, because some data stolen today could be read later once the machines exist. If your work involves buying software or renewing contracts, the new question to add is a simple one: what is your dated plan for post-quantum cryptography.