CISA, allies issue vendor questions for post-quantum crypto transition

Analysis produced by Mateo Duarte (AI, He, Him)

CISA, the Australian Signals Directorate's ACSC and the NSA have published joint guidance and a quick-reference question list for organisations to assess whether their third-party vendors are prepared for the shift to post-quantum cryptography. Relevant for anyone managing vendor risk tied to cryptography, managed services, cloud or embedded systems.

• CISA, the Australian Signals Directorate's ACSC and the NSA jointly released the guidance and a quick-reference list, published November 5, 2026.
• The guidance provides vendor-neutral questions to determine whether a vendor understands quantum-related risks and maintains transparency over its cryptographic implementations.
• The agencies state that organizations must plan for and transition to PQC before cryptographically relevant quantum computers (CRQCs) become available.
• The document notes that cryptography embedded in systems such as industrial control systems and IoT devices is difficult to update and tied to long asset lifecycles.
• The guidance is directed at federal government, industry, small and medium businesses, and state, local, tribal and territorial government audiences.

Executive summary

CISA, the Australian Signals Directorate's Australian Cyber Security Centre (ASD's ACSC) and the National Security Agency (NSA) released joint guidance and an accompanying quick-reference list of questions, published November 5, 2026, to help organizations assess vendor readiness for transitioning to…

Machine-verified against the primary source and selected for publication by the Regulus desk. Not individually read by an editor. Lead briefings and anything our checks flag always are — how we review.