Your Vendor May Own Your Quantum Deadline

Yesterday we asked a difficult question: which critical dependency has the power to delay your quantum transition?

Today, three national cybersecurity agencies effectively told organizations to start asking that question of their vendors. CISA, the National Security Agency, and the Australian Signals Directorate’s Australian Cyber Security Centre have released joint guidance titled Post-Quantum Questions to Ask Your Vendors. The message is clear. Even if an organization has internal expertise, a good inventory, and an approved migration plan, it can still fail to transition on time if the vendors it depends on are not ready.

That shifts the conversation in an important way. For years, most post-quantum discussions have focused on what an organization must do for itself. Build a cryptographic inventory. Understand exposure. Identify what is vulnerable. Create a roadmap. Those steps remain essential, but they are no longer sufficient. Much of modern cryptography is embedded inside platforms and products that the organization does not directly control. It lives inside cloud services, identity systems, network equipment, software libraries, managed services, hardware devices, and third-party applications.

That means the central question is no longer simply whether your organization can migrate. It is whether the ecosystem you depend on can migrate with you. In other words, your quantum-readiness timeline may not actually be your own.

The strongest signal is the new joint vendor guidance itself, because it moves third-party post-quantum readiness from a vague concern into an operational discipline. The guidance encourages organizations to ask vendors what cryptography they rely on, what products are affected, how they are prioritizing transition, what support they will offer, and how they will communicate their plans. That is not academic. It is procurement, governance, and risk management.

This is remarkably close to the concept we have been calling cryptographic sovereignty. An organization may understand its own risks and still be unable to act because the systems it depends on are owned, operated, or controlled by someone else. If a critical vendor cannot support post-quantum migration on the timetable your risk requires, then that vendor effectively owns part of your transition clock.

A second signal comes from emerging attempts to measure supplier readiness. 

Black Kite recently reported that about 21 percent of the roughly 330,000 companies it monitors show at least one internet-facing system supporting hybrid post-quantum key exchange. At first glance, that sounds encouraging. But the more important detail is the caveat. Some of those organizations may not have made a deliberate strategic move at all. They may simply be inheriting that capability because a cloud provider or CDN enabled it for them.

That distinction matters. Post-quantum capability is not the same thing as post-quantum readiness. A company might appear modern at the edge while lacking a cryptographic inventory, lacking a transition owner, lacking a supplier roadmap, and lacking any tested implementation plan. In other words, the lights may be on, but nobody is actually driving the migration.

A third signal is the continuing move from standards into implementation. NIST’s final IR 8547 makes it plain that the transition to post-quantum cryptography is no longer just about standardizing algorithms. The algorithms exist. The next challenge is implementation across the entire cryptographic supply chain. NIST emphasizes visibility, prioritization, hybrid approaches, and crypto-agility. That means the transition is no longer mainly a technical standards discussion. It is becoming an operating model.

Put together, these signals are telling a consistent story. NIST defines the transition. Government deadlines create urgency. Organizations inventory exposure. Vendors are expected to provide roadmaps and evidence. Procurement begins enforcing requirements. Management tracks progress. Boards oversee the risk. That is how a cryptographic transition becomes a governance issue.

There is also an interesting parallel in the crypto market. BitGo now offers a Quantum Resistance Score that evaluates Bitcoin addresses for public-key exposure without requiring private keys or wallet access. The point is not that those keys can be broken today. They cannot. The point is that quantum exposure is increasingly becoming measurable instead of hypothetical. Across both enterprise infrastructure and digital assets, the direction is the same. Measure the risk. Identify the dependency. Prioritize the migration. Do not wait for the break.

The practical implication is that management can no longer get away with saying, “We have a post-quantum roadmap.” The next question is whether the organization’s critical suppliers have one too, and whether they can prove it.

That means organizations need better questions. Which products contain vulnerable cryptography? Which suppliers support hybrid deployments? Which certificate authorities and identity providers have published transition plans. Which hardware platforms can be upgraded, and which will need replacement. Which managed-service providers can support post-quantum signatures and key establishment on the required timetable. Which suppliers have a credible roadmap, and which have marketing slides and crossed fingers.

The hardest question, of course, is what happens if the answer is unacceptable. Can the supplier be replaced? Can the organization tolerate delay? Can the dependency be isolated? Can the risk be mitigated by architecture, contract terms, or compensating controls? Or is the organization now hostage to someone else’s roadmap?

That is why supplier readiness is not just a procurement issue. It is a board-level issue. Two organizations can look equally prepared on paper. Both may have completed inventories. Both may have approved strategies. Both may have executive support. But if one organization depends on suppliers with tested roadmaps and the other depends on suppliers that cannot say when they will be ready, those two organizations are not equally resilient. One controls its transition. The other is borrowing confidence from outside parties.

This is precisely why QCI-QS1 v2.3 places such emphasis on cryptographic inventory, third-party readiness, migration planning, evidence, and crypto-agility. A real assessment should not only determine whether the organization knows what needs to change. It should determine whether the organization actually has the authority and technical ability to change it.

That leads to the sharper boardroom question. Not, “Do we have a post-quantum strategy?” but, “Which supplier has the power to make us miss our quantum deadline?” If management cannot answer that question, then the organization does not yet understand its quantum risk. If management can answer it, but cannot influence the outcome, then the organization has identified a material dependency risk. And if that supplier cannot realistically be replaced, then the timeline is not truly the organization’s own.

The post-quantum transition is forcing an uncomfortable but necessary realization. You do not control your migration simply because you approved it internally. You control it only if the dependencies required to complete it can move when you need them to move.

That is today’s boardroom question.

Which vendor has the power to delay our quantum transition?