CISA, NSA and Australia Issue Post-Quantum Vendor Checklist
CISA, the NSA and Australia’s ACSC released questions on Nov. 5 for organizations to test whether vendors are ready for post-quantum cryptography.
Featured photo: National Security Agency headquarters, Fort Meade, Maryland, 2013 (file photo). Photo: Trevor Paglen, Wikimedia Commons, CC0, cropped.
WASHINGTON — U.S. and Australian cyber agencies released joint guidance on Nov. 5, 2026, to help organizations judge vendor readiness for post-quantum cryptography. The authors were the Cybersecurity and Infrastructure Security Agency, the National Security Agency and the Australian Signals Directorate’s Australian Cyber Security Centre, CISA said.
The guidance, titled “Post-Quantum Questions to Ask Your Vendors,” comes with a quick-reference list, CISA said. It is aimed at federal, state, local, tribal and territorial governments, industry and small businesses, according to CISA’s listing.
Why the agencies issued it
Widely used public-key cryptography will become vulnerable to cryptographically relevant quantum computers as quantum computing advances, CISA said. Organizations must plan for and move to post-quantum algorithms before such computers become available, the agency said.
Many organizations rely on vendors for managed services, cloud capabilities and other cryptography-dependent products, CISA said. Cryptography is also embedded in hard-to-update systems with long lifecycles, such as industrial control systems and Internet of Things devices, the agency said.
Because of that reliance, an organization’s transition depends on vendor readiness, CISA said. The agency said early, structured engagement with vendors is critical to planning.
What the questions test
The vendor-neutral questions are meant to show whether a vendor understands quantum-related risks, CISA said. They also test whether a vendor keeps transparency over its cryptographic implementations and supports a secure, cost-effective and timely transition, the agency said.
CISA pointed readers to its post-quantum cryptography initiative page for more resources. The agency’s resource page also lists a September 2026 item, “Preparing for the Post-Quantum Era: A Call to Action.”
Related protocol changes
Software projects are already adding post-quantum options. The OpenSSH 10.6p2 release on Nov. 5 enabled the post-quantum hybrid signature scheme ssh-mldsa44-ed25519 as an allowed certificate authority signature algorithm, its release notes said.
What it means
Analysis: The guidance shifts post-quantum planning from algorithms to procurement. The core risk is often data captured now and decrypted later, so contracts signed today shape exposure years from now. Joint release by U.S. and Australian signals agencies suggests allied governments want suppliers answering the same questions.
Sources
Related coverage
- Zero trust shifts security from networks to resources
- US Intelligence Products, From the PDB to the NIC
- CISA Adds Exploited SonicWall VPN MFA Bypass to Its KEV List
