(TLP:CLEAR) CISA, NSA, and Australian Partners Release Questions to Assess Vendor Post-Quantum Readiness

Summary: CISA, NSA, and the Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC) released joint guidance, “Post-Quantum Questions to Ask Your Vendors,” along with a quick-reference list. The guidance gives organizations a vendor-neutral set of questions to use during procurement, contract renewals, and ongoing vendor assurance to gauge how prepared suppliers are for the move to post-quantum cryptography (PQC). PQC refers to encryption algorithms designed to withstand attacks from both conventional computers and future cryptographically relevant quantum computers (CRQCs), which are expected to break the public-key cryptography in wide use today.

The questions follow five transition phases: locating cryptographic dependencies, assessing risk, prioritizing systems, implementing PQC algorithms, and communicating with vendors and stakeholders. Each question includes why it matters and what a strong vendor response looks like. Topics include whether a vendor maintains a cryptographic bill of materials (CBOM), whether any cryptography is hardcoded or hardware-bound, whether firmware signing can be updated to support PQC, and whether PQC features are included in base licensing rather than sold as a premium add-on. The guidance also lists common warning signs in vendor responses, such as vague assurances, unclear timelines, and proprietary cryptography. Its 2030 readiness milestone reflects Australian timeframes, and the authors advise aligning with guidance applicable to each organization’s jurisdiction and sector.

Analyst Note: This guidance is especially relevant to water and wastewater utilities because the hardest PQC problems sit in operational technology (OT). The authors specifically call out industrial control systems and other devices where cryptography is embedded, difficult to update, and tied to long asset lifecycles. Programmable Logic Controllers (PLCs), Remote Terminal Units (RTUs), and telemetry equipment often stay in service for 15 to 20 years, so equipment a utility buys today may still be running when CRQCs become available. If a device’s firmware signing or secure boot process cannot be updated, the eventual fix may be hardware replacement, a long-lead cost that is far easier to plan for now than to absorb later.

For OT environments, the integrity and authentication questions may matter more than confidentiality. Forged firmware signatures or compromised remote access authentication pose a greater operational risk to a treatment process than decryption of historical data. Members do not need to ask every vendor every question. WaterISAC suggests a practical starting point:

• Add a few PQC questions to upcoming RFPs and contract renewals, particularly for SCADA platforms, remote access solutions, and managed or cloud-hosted services.
• Prioritize vendors whose products handle firmware signing, device authentication, or remote connectivity into the control system.
• Treat a vendor’s willingness to engage openly as a useful signal, even if detailed answers are not yet available.

The questions pair well with CISA’s Secure by Demand guidance for OT owners and operators, which many utilities may already use in procurement.

Original Source: https://www.cisa.gov/resources-tools/resources/post-quantum-questions-ask-your-vendors

Additional Reading:

• CISA Post-Quantum Cryptography Initiative
• Quantum-Readiness: Migration to Post-Quantum Cryptography
• Secure by Demand: Priority Considerations for Operational Technology Owners and Operators when Selecting Digital Products
• Preparing for the Post-Quantum Era: A Call to Action

Related WaterISAC PIRs: 6, 10.1, 11, 12