As reported by CISA, the agency—alongside NSA and the Australian Signals Directorate's Australian Cyber Security Centre—has released joint guidance providing organizations with a structured set of questions to evaluate vendor readiness for post-quantum cryptography (PQC) transition. This is a significant development not because it introduces new technical standards, but because it correctly identifies the real bottleneck in PQC migration: the supply chain.

Key Insight: As reported by CISA, the agency—alongside NSA and the Australian Signals Directorate's Australian Cyber Security Centre—has released joint guidance providing organizations with a structured set of questions to evaluate vendor readiness for post-quantum cryptography (PQC) transition.

Shield53 has been tracking PQC readiness across enterprise environments, and the pattern is consistent. Organizations focus on algorithm selection, NIST standardization timelines, and internal cryptographic inventories. These matter, but they represent the easy part. The hard truth is that most organizations depend on third-party vendors for the cryptography that actually protects their data—managed services, cloud platforms, VPN concentrators, HSMs, and especially embedded systems with long lifecycles. When a vendor isn't ready, your readiness is an illusion.

Why This Guidance Matters Now

The threat model driving urgency is well-established: harvest now, decrypt later (HNDL). Adversaries are already capturing encrypted traffic with the expectation that cryptographically relevant quantum computers (CRQCs) will eventually render current public-key cryptography trivially breakable. Data with long-term intelligence value—state secrets, intellectual property, health records, financial data—is being stored today for decryption tomorrow.

This means the PQC transition is not a future problem. The risk accumulation is happening now, and every day organizations delay extends the window of exposure for data that must remain confidential for years or decades.

The Supply Chain Problem

The organizations most exposed to PQC transition risk are not those with weak internal crypto programs—they're those with deep vendor dependencies and limited visibility into how those vendors implement cryptography.

The joint guidance highlights several categories of concern that defenders should pay close attention to:

Why This Guidance Matters Now
Embedded and IoT systems: Cryptography baked into firmware that may lack remote update capability or vendor support beyond a few years. Industrial control systems are particularly vulnerable.
Cloud and SaaS dependencies: Organizations have no visibility into the cryptographic primitives underlying cloud services. Vendor transparency is essential but rarely contractually mandated today.
Long-lifecycle assets: Hardware with 10-15 year deployment horizons (medical devices, OT equipment, telecom infrastructure) will outlive current cryptographic standards.
Managed service providers: Organizations outsourcing security operations may have zero insight into the cryptographic posture of their MSSP's tooling.

What the Guidance Gets Right

The vendor-neutral question set is a practical tool. Rather than prescribing specific algorithms or timelines, CISA's approach focuses on assessing whether a vendor understands the problem, maintains transparency about its cryptographic implementations, and has a concrete transition plan. This is the right framing. A vendor that cannot articulate its cryptographic inventory or PQC roadmap is a vendor that will become a liability.

The international collaboration signal is also important. NSA's involvement ensures alignment with national security requirements, and ASD's ACSC participation means allied nations are coordinating on supply chain pressure—a unified demand signal will move vendors faster than fragmented requests.

Shield53 Recommendations

Organizations should treat this guidance as a procurement and contract management weapon, not just a planning document. Here's how to operationalize it:

  • Conduct a cryptographic dependency audit: Map every vendor relationship where cryptography underpins data protection, authentication, or integrity. Prioritize by data sensitivity and asset lifecycle length.
  • Issue the CISA question set to all Tier 1 and Tier 2 vendors now: Don't wait for contract renewals. Use responses to create a PQC readiness scorecard and factor it into vendor risk ratings.
  • Update procurement language: Contract templates should require vendors to disclose cryptographic primitives, commit to PQC transition timelines, and provide migration support. Include sunset clauses for legacy algorithms.
  • Identify unupdatable assets: Catalog devices and systems where cryptographic firmware cannot be patched. Begin replacement planning for assets with lifecycles extending beyond 2030.
  • Engage MSSPs and cloud providers specifically: Demand transparency reports on their PQC roadmaps. If a provider cannot answer, that's a risk decision you need to document explicitly.
  • Run a targeted HNDL risk assessment: Identify which data flows, if captured today, would cause material harm if decrypted 5-10 years from now. Prioritize PQC migration for those channels first.

The PQC transition will be one of the most logistically complex cryptographic migrations in history. CISA's guidance correctly frames it as a supply chain problem first and an algorithm problem second. Organizations that start vendor conversations now will be positioned to migrate deliberately. Those that wait will migrate under crisis conditions—or not at all.