NSA and partners refresh post-quantum vendor-assessment guidance

NSA announced joint guidance on November 4 for evaluating suppliers’ readiness for post-quantum cryptography. Australia’s ASD’s ACSC confirmed the refreshed publication on November 5, describing added background, clearer transition explanations and broader international context. The underlying Australian publication dates to July; this is an update, not a newly created cryptographic standard.

The questions cover cryptographic inventories, inherited dependencies, hardware constraints, data lifetimes and product-specific migration roadmaps. They also examine production support, library validation, licensing and communication about changes. Customers are encouraged to seek evidence matched to the product and its risks rather than rely on general assurances.

For contractors supporting federal ISSO, RMF and security assessment work, the practical use is to organize supplier evidence during acquisitions, renewals and continuing assurance reviews. Teams can document where authentication, signing or data protection depends on a vendor, identify components that may require replacement, and raise testing or support gaps with the responsible system and acquisition owners. These are editorial implementation considerations, not additional contract requirements.

The guidance’s references to readiness before the end of 2030 reflect Australian transition objectives. U.S. teams should apply the requirements and timelines governing their particular agency, system and contract, rather than treat that date as a universal federal deadline. The publication does not certify a supplier, grant an Authority to Operate or announce a procurement opportunity.