Last reviewed 10 November 2026
Vendor response log
When to use it
Use this log when you prepare a supplier question, receive an answer, and need a decision-ready row before procurement or deployment work proceeds.
The CISA, NSA, and NIST fact sheet, as of 17 August 2023, is the short official starting point for what to ask. Group your question list by the five LATICE phases from the Post-quantum questions to ask your vendors guide, updated 5 November 2026.
Locate
- Which products in the estate use public-key cryptography?
- Which upstream dependencies affect each cryptographic component?
Assess
- What is the data confidentiality period for each asset?
- What operational constraints limit how quickly each system can change?
Triage
- Which assets should move first given impact and supplier readiness?
- Which answers are still vague, missing, or concerning?
Implement
- What post-quantum key-establishment construction will ship, and on what date?
- What interoperability and performance tests will run before production?
Communicate and educate
- Who receives the cutover communication and the rollback plan?
- When is the subsequent review of this supplier answer?
Minimum fields
supplier, product and version, question, answer, date, source, judgement, follow-up, decision
A cell you cannot fill is the word unknown. Handbook practice: judgement is complete, vague, missing, or concerning.
Filled example
| supplier | product and version | question | answer | date | source | judgement | follow-up | decision |
|---|---|---|---|---|---|---|---|---|
| Clinic software supplier | named in the supplier letter | What key-establishment construction and release date apply to the health-records platform? | The letter names the product and version, the key-establishment construction, and a date, and states that signatures are not in that release. | unknown | supplier letter | complete | none | record key-establishment date and open signatures follow-up |
Blank template
| supplier | product and version | question | answer | date | source | judgement | follow-up | decision |
|---|
Download a blank CSV: vendor-response-log.csv.
Keep a real inventory off a public ticket and off an unlocked shared drive, and store it with the same care as the asset list it describes.
Sources
- ASD and ACSC, with CISA and NSA, Post-quantum questions to ask your vendors, updated 5 November 2026. Vendor guide
- CISA, NSA, and NIST, Quantum-Readiness fact sheet, as of 17 August 2023. Fact sheet