CISA, NSA, and ASD Issue Advisory on Vendor Post‑Quantum Cryptography Readiness

ما الذي حدث

The Cybersecurity and Infrastructure Security Agency (CISA), together with the Australian Signals Directorate’s Australian Cyber Security Centre (ASCS) and the U.S. National Security Agency (NSA), published joint guidance to help organizations assess whether their third‑party vendors are prepared to transition to post‑quantum cryptography (PQC). The advisory provides a vendor‑neutral quick‑reference list of questions that probe a supplier’s understanding of quantum‑related risks, transparency over cryptographic implementations, and roadmap for migrating to quantum‑resistant algorithms. It stresses that many critical systems—cloud services, managed platforms, industrial control systems, and IoT devices—embed cryptography that may be difficult to update, making early, structured vendor engagement essential for a secure transition.

لماذا يهم ذلك للثقة والامتثال

• Assessing vendor PQC readiness directly tests the control objective of third‑party risk oversight, a key element of audit‑ready security programs across frameworks.
• Integrate the CISA question set into third‑party risk assessments to demonstrate due diligence on cryptographic resilience.
• Collect vendor attestations and roadmaps on PQC migration as defensible evidence for audit frameworks.

Who is affected

Recommended actions

1. Adopt the CISA quick‑reference checklist and embed it in your vendor risk assessment process.
2. Require documented PQC transition plans from critical suppliers and track progress regularly.