La NSA, la CISA et l'ACSC de l'ASD publient les questions post-quantiques à poser à vos fournisseurs

The three agencies have published a joint guide, Post-quantum questions to ask your vendors: Evaluating third-party readiness for post-quantum cryptography, together with a quick reference list. It is written for the people who buy and renew technology rather than the people who build it, and it is deliberately vendor neutral. The questions follow five phases: locate and inventory cryptographic dependencies, assess the risk to individual systems, triage and prioritize systems for transition, implement post-quantum algorithms, and communicate with vendors and educate stakeholders.

The agencies say early and structured engagement reduces the likelihood of late stage surprises, and they urge organizations, their vendors and other stakeholders to put the questions to work now. For a Canadian operator the context is the same as it was last month: NIST has fixed 2030 and 2035 as the deprecation and disallowance dates for quantum vulnerable public key algorithms, the NSA's own procurement gates for national security systems begin in 2027, and ITSM.40.001 sets the Government of Canada's own migration path.

Our take

This is the document to attach to your next network refresh RFP. Ask every supplier whether their firmware can accept post-quantum signatures without a hardware swap, whether they will give you a cryptographic bill of materials, and which dated release makes their product quantum-safe. Observed on the wire, not asserted on a data sheet: the answers are only useful if you can verify them against your own inventory. The hardware stays. The keys change. Start your Discovery Program and you will have the inventory the questions assume you already hold.