Quantum computing: Australia, the NSA and CISA list the questions to ask your vendors

Your firewall, your cloud-hosted email, your payroll software: none of them was chosen for its encryption. Yet encryption is what will protect you the day a quantum computer can break today's algorithms, such as RSA. On November 4, the NSA, the US signals intelligence agency, and CISA, the US cybersecurity agency, joined their Australian counterpart, the Australian Signals Directorate (ASD), to release a document with an explicit title: Post-quantum questions to ask your vendors.

The text is not entirely new: the ASD had published it alone on July 16. But the backing of the two US agencies gives it a different reach. The starting point is simple. Many organizations use products, managed services and cloud offerings whose vendor chooses and implements the cryptography. Their move to post-quantum cryptography, designed to withstand quantum computers, therefore depends on those vendors' preparation, transparency and roadmap, the agencies stress. Even an expert organization with a well-developed transition plan can see its efforts undermined by weaknesses or delays in its supply chain.

Five steps for questioning a vendor

The questions follow the five phases of Australia's planning framework, called LATICE: identify and inventory uses of cryptography, assess the risk of each system, sort and prioritize those to migrate, deploy post-quantum algorithms, then engage with vendors and raise awareness among stakeholders. They target no vendor in particular and are meant for three moments: purchase, contract renewal and regular follow-up of providers.

In the version the ASD published in July, as summarized by the Australian site HG, the questions include the following. Does the vendor keep an inventory of the cryptography used in its products, a “cryptographic bill of materials”? Which products will be ready early enough for deployment before the end of 2030, the horizon set by Australia? Is post-quantum cryptography included in the base license? If the product offers a hybrid mode, which combines a classical algorithm and a post-quantum one, when will it move to post-quantum only?

Not a checklist to send in bulk

The agencies are clear: there is no need to send every question to every provider. Choose them according to the product's risk level, how much of the cryptography the vendor controls, the sensitivity and lifespan of the data, and how far along your own transition is. An internal tool with no sensitive data does not call for the same requirements as a service that stores data that must stay secret for years.

The point is to ask early. According to the agencies, opening a dialogue upstream reduces the risk of discovering too late that a critical product or service will not be able to move to post-quantum in time.

How to use them in France

These questions do not replace internal work. They extend it. Inventorying your own uses of cryptography remains the first step, as detailed in our six-step migration guide. Nor do the Australian dates apply to a European organization: in Europe, the coordinated timeline targets 2030 for the most sensitive systems, then 2035, and Germany has just aligned its own migration with these deadlines.

In practice, the next contract renewal with a critical vendor is the right time to slip in a few of these questions. The answer, or the lack of one, will already be valuable information.