NSA and partners refresh post-quantum vendor-assessment guidance
Updated joint guidance gives federal security and acquisition teams practical questions for evaluating suppliers’ cryptographic dependencies and transition plans.
Source: Cyber Defense Group. Original reporting and dates are preserved.
NERSC server rack, October 14, 2011. Archival illustrative infrastructure for vendor-dependency assessment; not a post-quantum implementation, a vendor under review or an agency-endorsed product. Resized for presentation. No endorsement implied.
Derrick Coetzee / Wikimedia Commons · CC0 1.0 Universal Public Domain Dedication · LicenseThe photograph above has its own source and credit. Image references in the original reporting below may describe a different image on the source publication.
Cyber Defense Group update
NSA announced joint guidance on November 4 for evaluating suppliers’ readiness for post-quantum cryptography. Australia’s ASD’s ACSC confirmed the refreshed publication on November 5, describing added background, clearer transition explanations and broader international context. The underlying Australian publication dates to July; this is an update, not a newly created cryptographic standard.
The questions cover cryptographic inventories, inherited dependencies, hardware constraints, data lifetimes and product-specific migration roadmaps. They also examine production support, library validation, licensing and communication about changes. Customers are encouraged to seek evidence matched to the product and its risks rather than rely on general assurances.
For contractors supporting federal ISSO, RMF and security assessment work, the practical use is to organize supplier evidence during acquisitions, renewals and continuing assurance reviews. Teams can document where authentication, signing or data protection depends on a vendor, identify components that may require replacement, and raise testing or support gaps with the responsible system and acquisition owners. These are editorial implementation considerations, not additional contract requirements.
The guidance’s references to readiness before the end of 2030 reflect Australian transition objectives. U.S. teams should apply the requirements and timelines governing their particular agency, system and contract, rather than treat that date as a universal federal deadline. The publication does not certify a supplier, grant an Authority to Operate or announce a procurement opportunity.
Sources and references
Source publication notes
Updated vendor-assessment guidance, not a new cryptographic standard or solicitation.
The Australian publication originated July 16, 2026; NSA announced the joint release November 4 and ASD’s ACSC announced the refresh November 5.
The 2030 references reflect Australian objectives; jurisdiction, agency, system and contract applicability must be reviewed.
Vendor responses support risk assessment; they do not establish certification, compliance or an agency ATO.
Educational information, not legal advice. Current official program guidance and the instructions for your application control. Registration, certification, or consulting does not guarantee an award.