New post-quantum guidance puts supplier readiness on the procurement agenda
Share
Published
Cybersecurity agencies in the United States and Australia have released questions organisations can use to assess whether their technology suppliers are preparing for post-quantum cryptography. The guidance puts procurement, contract renewals and supplier assurance alongside the technical work of changing cryptographic systems.
The US National Security Agency announced the joint release with Australia’s Australian Cyber Security Centre and the US Cybersecurity and Infrastructure Security Agency on 4 November 2026. Its central point is that an organisation’s transition can depend on products and services whose cryptography is controlled by vendors.
The questions reach beyond an encryption claim
The guidance and November quick-reference material cover dependencies, risk, transition priorities, implementation and supplier communication. They ask for product-specific information rather than a general assurance that a company is quantum-ready.
The practical distinction is between a supplier promising future support and identifying which version, component and customer deployment will receive it. A cloud service, a hardware trust component and a supported application can have different replacement paths.
Why procurement teams have a role
A business choosing a long-lived service needs to know whether a later change requires an upgrade, a different product or replacement equipment. That question affects testing and continuity as well as security. It belongs in a supplier discussion while the business still has time to plan.
For a first review, create a short dependency record: the service, business owner, information or trust decision it protects, supplier contact and evidence requested. Ask the supplier to identify the scope and limits of its answer. Record uncertainty rather than turning an incomplete response into a pass.
This is an operational starting point, not a recommendation to replace systems immediately or deploy experimental cryptography. Technical choices need assessment by the people responsible for the affected environment.
Do not mistake one planning date for a global rule
The Australian publication explains that references to a 2030 timeframe reflect Australian guidance and should be aligned with the organisation’s applicable jurisdiction and risk environment. It is not a blanket deadline imposed on every Nigerian business by this release.
Similarly, a readiness claim does not establish that a product is already available, deployed or independently tested in the customer’s environment. Keep the supplier’s roadmap separate from the organisation’s observed implementation.
A useful next supplier conversation
Ask what cryptography the service depends on, which parts the supplier controls, what change is planned and what the customer will need to test. Request a named route for updates. If the service cannot meet a material requirement, identify the business impact and possible alternatives before renewal.
Our vendor exit guide explains the related questions about continuity, exports and access. The SaaS export-test checklist helps a team establish whether moving away from a service would be operationally possible.
Does the release mean current encryption has already failed?
No such conclusion follows from this guidance. It is a preparation and supplier-assessment resource addressing future quantum-related risks. Avoid treating a planning document as evidence of a current breach or a reason to make untested changes to production systems.
Featured image: AI-generated conceptual illustration.
