Post-Quantum Readiness Becomes a Procurement Question

On November 4, three government cybersecurity agencies published a document containing nineteen pages of targeted questions aimed at a specific conversation: the one between a buyer and a vendor at contract renewal time.

Entitled "Post-quantum questions to ask your vendors: Evaluating third-party readiness for post-quantum cryptography," the document follows Australia's initial release in July. This November update arrives just a week after NIST published its final transition plan, deprecating RSA and elliptic-curve cryptography after 2030 and disallowing them entirely by 2035.

This timing is deliberate now that official policies and deadlines are established. The guiding question is whether third-party software and service providers can actually reach post-quantum compliance, especially since most organizations rely on purchased products, cloud services, and proprietary firmware rather than building their own encryption stacks.

Stock photo for illustration only, not from the actual event

The centerpiece of the guidance is the Cryptographic Bill of Materials, or CBOM. Extending beyond standard software bills of materials, a CBOM lists every algorithm, library, protocol, and configuration a product depends on. Vendors unable to produce a CBOM effectively demonstrate that they do not understand their own products well enough to migrate them.