CISA, NSA and Australian Cyber Agency Release PQC Vendor Readiness Guidance
Summary
CISA, the NSA and ASD’s ACSC released vendor-neutral guidance to help organizations assess vendors’ readiness for the transition to post-quantum cryptography.
Key points
- The joint guidance includes a quick-reference list for assessing vendor readiness for post-quantum cryptography.
- It encourages organizations to assess vendors’ understanding of quantum risks, transparency about cryptographic implementations, and support for a secure, timely and cost-effective transition.
- The guidance highlights vendor dependence and long-lived or difficult-to-update systems, including industrial control systems and IoT devices, as planning considerations.
Article Details
- Event Type
- Joint guidance release on assessing vendor readiness for the transition to post-quantum cryptography (PQC).
- Impact
- The guidance provides vendor-neutral questions to help organizations assess vendors’ understanding of quantum-related risks, transparency about cryptographic implementations, and support for a secure, cost-effective, and timely PQC transition. It highlights that widely used public-key cryptography could become vulnerable to cryptographically relevant quantum computers and that vendor readiness matters for managed services, cloud capabilities, industrial control systems, and IoT devices.
Industries
Industrial control systemsto update, tied to long asset lifecycles, and require vendor support or replacement—such as industrial control systems and Internet of Things (IoT) devices.Information and communications technologyInformation and Communications Technology Supply Chain SecurityInternet of Thingsasset lifecycles, and require vendor support or replacement—such as industrial control systems and Internet of Things (IoT) devices.