CISA, the Australian Signals Directorate’s Australian Cyber Security Centre, and the National Security Agency jointly issued guidance outlining questions organizations should ask their third-party vendors about post-quantum cryptography (PQC) readiness. The agencies highlight that a successful transition to PQC, essential as quantum computing advances and threatens current encryption, is heavily dependent on these external providers of managed services and cloud capabilities.
Industrial control systems and Internet of Things devices are flagged as particularly vulnerable due to long lifecycles and reliance on vendor support. Organizations can use the vendor-neutral questions to assess vendor understanding of quantum-related risks and their plans for a secure transition.
Vendor Readiness for Post-Quantum Cryptography Transition
Reliance on external suppliers presents a key challenge for organizations preparing for post-quantum cryptography, as many depend on them for essential services like cloud computing and managed security. Organizations are now urged to proactively assess their suppliers’ preparedness, ensuring transparency regarding cryptographic implementations and a clear path toward secure, cost-effective updates. These systems often lack the flexibility for rapid cryptographic updates, creating a significant security gap as quantum computing capabilities advance. Early and structured engagement with vendors is critical for effective planning, given the dependence on third parties for cryptographic functionality.
See today’s quantum computing news on Quantum Zeitgeist for the latest breakthroughs in qubits, hardware, algorithms, and industry deals.
