Questions to ask a vendor
Use this before a renewal or a purchase. The questions come from the CISA, NSA, and NIST fact sheet, as of 17 August 2023, and from the UK NCSC split between commodity IT and systems you choose an approach for.
Questions
- Which product and version does the answer cover?
- What is the key-establishment construction, and what is the signature construction? Do not accept one phrase for both.
- What is the date, and what is still not in that release?
- What is the vendor's published roadmap? Store the page, not the call.
- What happens to hardware or firmware that cannot be updated?
- How will a later algorithm change be delivered?
The fact sheet urges organisations to ask vendors for a quantum-readiness roadmap that describes how they will migrate, including timelines for testing and integration, for both on-premises and cloud products, and to plan contract changes so new products arrive with PQC and older products can be upgraded. The NCSC timelines say that where you rely entirely on commodity platforms, the provider delivers the upgrade, and your work is the timely refresh. Where you do not, you choose an approach per system.
Tracking sheet
| Vendor | Question | Answer | Date | Source |
|---|---|---|---|---|
"They told us on a call" is a weak record. Vista Security, a vendor blog of 13 October 2026, is used here only as a sizing of that point. It is not an authority. Store the page you were shown.
Sources
- CISA, NSA, and NIST, Quantum-Readiness fact sheet, as of 17 August 2023. Fact sheet
- UK NCSC, Timelines for migration to post-quantum cryptography, modified 3 August 2026. Timelines
- Vista Security, a vendor blog, 13 October 2026. Vendor blog