What the Post-Quantum Vendor Questions Ask, and Why Answer Them Before a Buyer Does
The post-quantum vendor questions are a 31-question set. A buyer uses them to judge whether a supplier understands quantum risk, tracks its own cryptography, and can move to post-quantum cryptography (PQC) on a timeline the buyer can plan around. The Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC) wrote it with the Cybersecurity and Infrastructure Security Agency (CISA) and the National Security Agency (NSA). It is built for use “during procurement activities, contract renewals or ongoing vendor assurance processes.” The stake for a contractor is delivery friction. A prime or program office that adopts these questions will ask for answers the contractor should already hold.
This is currently a regulatory or requirements signal, not yet a validated federal contracting opportunity; the near-term commercial signal is vendor-assurance work for contractors being asked these questions, not government spend. No contract, evaluation factor or recompete date names this guidance, so no retention-risk claim attaches to it.
| Field | Answer |
|---|---|
| Signal | Joint guidance with 31 vendor-neutral questions, dated Nov. 5, 2026 by CISA |
| BD implication | Buyers may use the questions in procurement, renewal or ongoing vendor-assurance reviews, including any a prime runs on its subcontractors, so contractors with answers ready lose less time |
| Customer | Any organization buying products or services that use cryptography. A defense industrial base (DIB) prime or a Department of War component is a plausible adopter for a federal contractor; no adopter is publicly named |
| Buyer | Not identified. The guidance is not a purchase and names no buying office |
| Funding | None. No dollar figure of any status attaches |
| Vehicle / path | Not identified. The guidance cites procurement activities, contract renewals and vendor assurance in general terms |
| Incumbents / ecosystem | Not applicable. No contract or competitive set is tied to this guidance |
| Access strategy | Answer the five phases for your own product and hold the answers ready for prime and program-office questionnaires |
| Timing | Early engagement is the guidance’s own advice. 2030 is ASD’s planning milestone, not a U.S. rule |
| Confidence | Moderate |
| Pursuit posture | WATCH |
| Upgrade triggers | A FAR or DFARS action, CMMC rulemaking attaching PQC requirements, or a solicitation or prime flowdown that cites this question set |
| Downgrade triggers | Two to three quarters pass with no clause, questionnaire or flowdown citing it |
The guidance is laid out as a working tool:
- Five phases follow ASD’s LATICE framework for PQC transition: locate, assess, triage, implement and communicate.
- Each question carries a “why it matters” note and a column of key response considerations for judging the answer.
- Depth varies with the risk level of the product, the degree of cryptographic control the vendor exercises, data sensitivity and longevity, and the buyer’s stage of transition.
ASD Authored the Guidance, So the 2030 Date Is a Planning Milestone, Not a U.S. Rule
ASD’s ACSC authored the publication and names CISA and NSA as partners. A footnote says the 2030 reference reflects objectives in ASD’s Information security manual and its PQC planning advice. The footnote calls it “a planning milestone for vendor readiness discussions.” The text also tells readers to “Align transition activities with guidance applicable to your organisation’s jurisdiction, sector and risk environment.” For a U.S. contractor, I treat the 2030 date in this guidance as a discussion anchor with no compliance force.
U.S. defense dates sit in a separate instrument. The Department of War’s Post Quantum Cryptography Strategy requires systems to support PQC or be phased out no later than Dec. 31, 2030, and to use it no later than Dec. 31, 2031. These are policy deadlines set in a signed strategy. Neither is an appropriated program milestone. The shared year does not make one document a source for the other. A contractor should track each date against its own instrument.
CISA’s Post-Quantum Cryptography Initiative page cites Executive Order 14412 and OMB Memoranda M-26-15 and M-23-02 as governing references. Those instruments direct federal agencies. A U.S. contractor obligation would arrive through a FAR or DFARS clause, a CMMC rule or a contract term. The question set itself creates no such obligation.
| Phase | Questions | Example question | Strong answer, per the guidance |
|---|---|---|---|
| Locate | 8 | Do you maintain a current inventory of cryptographic dependencies, such as cryptographic bills of materials (CBOM) or equivalent artefacts? | A complete, current inventory that includes third-party and embedded components, actively maintained |
| Assess | 6 | Do you distinguish between signing, encryption and authentication risks? | Separate use cases with distinct risk assessments, transition timelines and mitigations |
| Triage | 5 | Which products or services will be PQC-ready early enough to support customer rollout before the end of 2030? | Product- or service-specific and versioned commitments for PQC-ready releases |
| Implement | 6 | Is PQC included in base licensing? | Standard licensing terms, “without additional licensing fees or premium add-ons” |
| Communicate | 6 | How will traditional cryptography be deprecated, including any temporary use of PQ/T hybrid approaches? | Clear deprecation timelines, with a defined path from post-quantum/traditional (PQ/T) hybrid use to PQC-only operation |
Hardware-Bound Cryptography and Firmware Signing Are the Long-Lead Answers
Two answers are hard to produce quickly. In the guidance’s words, “Hardware changes are long-lead items and can significantly affect timelines, cost and interoperability.” It warns as well that “Firmware signing mechanisms are long-lived and difficult to change.” For hardware roots of trust, the guidance asks the vendor to name the trust anchors and their role in cryptographic operations. It also asks for any constraints and a fix: patching, firmware upgrades or replacement. For firmware and boot, it asks for evidence that both can be updated without hardware replacement. If they cannot, it asks for a roadmap to PQC-compatible signature schemes.
I would rank those two as the slowest to produce, so I would answer them before the licensing and communication questions. A transition guide is a writing task. A firmware or hardware answer can depend on hardware replacement or re-architecture, which the guidance calls long-lead. A vague reply there gives the buyer nothing to plan around, though the guidance still credits a vendor that explains its constraints openly.
A sensible order of work for a product vendor:
- Inventory every place the product uses cryptography across application, operating system, middleware, hardware and firmware layers.
- Flag any hardcoded, fixed or hardware-bound cryptography and any hardware root of trust, then write the remediation path: patch, firmware upgrade or replacement.
- Separate signing, encryption and authentication use cases and give each its own timeline.
- Commit to product-specific, versioned PQC-ready release dates, or state plainly that dates are not yet set.
- Write the PQ/T hybrid plan with a de-hybridization date, and settle whether PQC sits in base licensing.
A Weak Answer Does Not Disqualify a Vendor, but Silence Can Read as Low Maturity
The guidance lists seven common concerns in vendor responses and says they “do not necessarily indicate unacceptable risk.” Buyers should weigh them against the vendor’s risk level, the sensitivity and lifetime of the data, and the vendor’s openness. Openness counts on its own merits: “a vendor’s willingness to engage transparently, discuss constraints and demonstrate progress can indicate maturity in both PQC and broader cyber security practices.” A contractor without PQC-ready releases can still answer well.
The seven concerns:
- Limited visibility of cryptographic use.
- Reliance on general assurances.
- Unclear or deferred transition timelines.
- Use of proprietary or opaque cryptography.
- Treatment of PQC as an optional or premium function.
- Over-reliance on compensating controls.
- Lack of governance or ownership.
Each concern has a counter a contractor can prepare. An inventory answers general assurances. A dated release answers a deferred timeline. A named executive owner answers lack of governance, and the Triage phase asks for “executive ownership, documented decision forums, and regular review cycles.” Which preparation matters depends on who is answering.
- Product vendor, small business or DIB sub: list every hardcoded or hardware-bound cryptographic component with its remediation path.
- FedRAMP-pursuing SaaS or managed-service vendor: state whether PQC is in base licensing and give versioned PQC-ready dates.
- Any vendor: name an executive owner and a review cadence for PQC transition.
- MSSP, governance-risk-compliance (GRC) vendor or systems integrator: build a CBOM-based intake questionnaire from the five tables as a service input. This is a commercial signal only; no federal vehicle attaches.
- Agency-side security or acquisition reader: adopt the tables as a questionnaire only where your own program chooses to.
Where the Vendor Questions Meet CMMC and Flowdowns, and Where They Stop
The Department of War’s strategy commits the Department to updating the Cybersecurity Maturity Model Certification (CMMC) to include requirements for PQC. That commitment is directional and carries no compliance date. For DIB compliance planning, CMMC is the channel to watch. The Department’s software-only encryption notice is a separate, market-research-stage signal on the same problem. The vendor questions do not touch that pathway.
The post-quantum vendor questions sit one step earlier than any clause. They give a prime or program office a way to ask about cryptography before a requirement exists. Where a buyer adopts them, the effect arrives as a questionnaire. The guidance itself is not a clause or a rule.
No competitive set applies here. The guidance is not a purchase, so no incumbent, vehicle or buying office attaches to it, and no pipeline claim follows.
For a small or mid-market DIB contractor, the near-term action is to hold written answers for the Locate and Triage tables, with hardware-bound cryptography first. Three events would move this from preparation to a pursuit-level priority:
- A Department of War or CMMC rulemaking that attaches PQC requirements with a compliance date.
- A solicitation or prime flowdown that cites this question set.
- Follow-on guidance from CISA or NSA that ties vendor readiness to acquisition.
I would keep this on WATCH until one of those appears. If two to three quarters pass with none, the work drops to routine upkeep.
FAQ
Do I need to ask or answer all 31 questions?
No. The guidance tells buyers to tailor depth to the risk level of the product or service, the degree of cryptographic control the vendor exercises, data sensitivity and longevity, and the buyer’s current stage of transition. It also says to prioritize the Locate questions early in vendor engagement, and the Triage questions once dependencies and risks are understood.
What is a CBOM, and how does it differ from an SBOM?
A cryptographic bill of materials (CBOM) extends a software bill of materials (SBOM) with elements that document the algorithms implemented by cryptographic libraries and configurations. According to the guidance, those additions go beyond CISA’s 2026 Minimum Elements for a Software Bill of Materials. A vendor with an SBOM still needs the cryptographic layer added.
Does using larger classical key sizes count as post-quantum readiness?
No. Per the guidance, stronger traditional settings such as larger key sizes “may offer only marginal, short-term risk reduction” and are “not a substitute for transitioning to PQC.” Offering them as a supported, documented configuration is still a better answer than a bespoke one-off.
Is a PQ/T hybrid mode an acceptable end state?
No. The guidance calls hybrid schemes useful for short-term interoperability or resiliency but “not recommended as a long-term solution,” because a cryptographically relevant quantum computer would make the traditional elements obsolete. A vendor that offers hybrid mode should attach a documented plan and timeline for moving to PQC-only operation.
Who owns the budget for answering these questions?
No budget line attaches to the guidance. The cost sits inside the contractor’s own engineering and compliance spending. That is contractor-internal compliance cost, and it does not count as federal acquisition spending. A buyer that adopts the questions would run them through its own procurement or vendor-assurance staff.
What would turn this from preparation into a pursuit?
Any of the three events listed in the section above: a compliance-dated rulemaking, a solicitation or flowdown citing this question set, or follow-on CISA or NSA guidance. Until one appears, prepare answers and hold off on a pursuit plan.
