meta_id 3329204

On July 16, 2026, the Australian Signals Directorate (ASD), which operates under the Australian Cyber Security Centre, released a "post-quantum questions to ask your vendors" list, which is new guidance designed to help organisations assess third-party supplier readiness for the transition to post-quantum cryptography (PQC). Advances in quantum computing are expected to undermine widely used traditional public-key cryptographic algorithms. PQC comprises cryptographic algorithms designed to remain secure against attacks from both classical and quantum computers. As organisations prepare for this transition, third-party products and services will play a critical role in supporting the adoption of quantum-resistant cryptography. ASD recommends these questions as part of the checklist: Locate cryptographic dependencies: Organisations should ask vendors to identify where cryptography is used across their products, including in applications, operating systems, hardware, firmware and third-party libraries.Vendors should ideally maintain an up-to-date cryptographic bill of materials, identifying the algorithms, protocols, libraries, keys, parameters and embedded components used by their products. Organisations should also determine whether cryptography is hardcoded, hardware-bound or capable of being updated through patches and firmware upgrades. Assess quantum-related risks: Organisations should understand which customer data flows depend on traditional asymmetric cryptography and whether the data must remain confidential for many years. Vendors should have documented assessments covering: encryption, authentication and digital-signature risks; the sensitivity and expected lifetime of protected data; “harvest now, decrypt later” exposure; certificates, smartcards, tokens and authentication systems; and the impact of a future quantum computer on individual products and services. Prioritise systems for transition: Organisations should establish when each vendor product will become PQC-ready and whether that timetable supports customer migration before the end of 2030. Vendors should disclose: products requiring hardware replacement or major redesign; constraints that could delay migration; how higher-risk customers and sensitive systems will be prioritised; whether temporary hybrid traditional/PQC solutions will be used; and which executives or governance bodies are accountable for the transition. Implement PQC securely: Organisations should ask which standardised PQC algorithms vendors intend to support and when those capabilities will be available in production. Vendors should demonstrate that: their implementation uses recognised, ASD-approved algorithms; cryptographic libraries are reputable and actively maintained; PQC functionality is production-ready rather than experimental; key sizes, certificate sizes and performance implications have been assessed; customers receive clear configuration and deployment instructions; rollback and compatibility risks are managed; and PQC is included in standard licensing rather than sold as an optional premium feature. Communicate and educate: Vendors should provide customers with advance notice of cryptographic changes, transition guidance, testing documentation and clear deprecation schedules for older encryption methods. ASD also expects vendors to train support and engineering staff, maintain updated operational procedures and align their product roadmaps with ASD’s proposed transition timetable. Vendors should also monitor or participate in relevant PQC standards-development bodies. ASD also identifies several responses that may indicate weak PQC preparedness: the vendor cannot identify where cryptography is used; it provides general assurances without product-specific evidence; migration dates are unclear or repeatedly deferred; it relies on proprietary or opaque cryptographic systems; PQC is offered only as a paid premium feature; it relies heavily on temporary compensating controls; or responsibility for the transition has not been assigned internally.