Post-Quantum Cryptography Vendor Questions Updated

Australia’s Cyber Security Centre has refreshed its publication Post-quantum questions to ask your vendors, working in partnership with the US Cybersecurity and Infrastructure Security Agency and the National Security Agency, the ACSC said on 5 November 2026. The update is guidance for procurement, contract renewals and ongoing vendor assurance — not a new statute, mandatory standard or enforcement action from any of the three agencies.

The November 2026 PDF is branded across ASD’s ACSC, CISA and NSA and calls the three the “authoring agencies.” ACSC said the refresh adds background, clearer explanations of the post-quantum cryptography transition and context meant to apply across a broader range of organisations. TSN could not retrieve a live nsa.gov press page for this item; the co-sealing claim here rests on the ACSC news page and the joint PDF.

In brief

Vendor-neutral question set for buying, renewing and assuring products that use cryptography.
Co-authored by ACSC with CISA and NSA (as shown on ACSC materials).
Update to an existing publication — no new legal duties announced.

What the questions are for

The PDF frames the audience as cyber leaders, procurement and vendor-management teams, and technical staff who must judge third-party readiness for post-quantum cryptography. It walks through phases aligned to ACSC’s LATICE construct in Planning for post-quantum cryptography: locate cryptographic dependencies; assess risk; triage and prioritise; implement PQC algorithms; then communicate and educate.

Concrete prompts cover cryptographic bills of materials, where crypto sits across application and hardware layers, hardcoded or hardware-bound cryptography, firmware signing, harvest-now-decrypt-later data lifespans, temporary post-quantum/traditional hybrid modes, licensing of PQC features, and whether roadmaps support customer transition before the end of 2030 — a planning milestone the PDF ties to ACSC’s information-security guidance, with a note to align to the reader’s own jurisdiction.

That last point matters for UK buyers. The document is Australian-led with US co-authors; it is not an NCSC mandate. Still, the question list is usable wherever a board already expects supply-chain crypto diligence: ask for inventories, ask what cannot be patched without hardware swap, and ask when hybrid modes will be retired.

How this fits other PQC moves TSN has tracked

National and sector plans have been stacking up. NIST’s IR 8547 post-quantum transition plan set a US standards-body path that deprecates classical public-key algorithms on a long runway after 2030. Spain and Portugal’s central banks published a three-phase PQC programme for their own systems. Singapore’s CSA set quantum-safe milestones and a kickstarter grant, while the HKMA PQC toolkit with HKUST aimed bank-ready tooling at Hong Kong’s financial sector. The ACSC–CISA–NSA refresh sits on the buyer side of that stack: instead of another algorithm shortlist, it is a script for interrogating the vendors who actually ship the TLS stacks, HSMs, IoT firmware and cloud identity planes most organisations cannot rewrite themselves.

Vendor questions beat another algorithm FAQ

The strategic shift in this refresh is procedural. Organisations that already understand CRQC risk still fail transitions when a SaaS provider, OT vendor or smartcard fleet cannot move on the buyer’s calendar. By publishing shared questions — and by saying some vendors will only be able to give partial answers at first — the authoring agencies are treating transparency and roadmap honesty as the maturity signal, not a claim that every supplier is PQC-ready today.

For regulated UK firms, that maps cleanly onto existing third-party risk files: the same evidence packs used for operational resilience can absorb CBOM-style crypto inventories and explicit hardware-replacement lead times. The compliance risk is not that ACSC wrote a longer PDF; it is signing multi-year contracts in 2026 that lock in classical-only cryptography with no exit. Watch whether major cloud and network vendors start answering these questions in customer trust centres, and whether UK NCSC or EU guidance reprints a similar interrogatory. Until then, the confirmed change is narrower and useful: a joint ACSC–CISA–NSA update to post-quantum cryptography vendor questions, aimed at procurement and assurance, without creating new rules of its own.