Your firewalls, VPNs, cloud services, login systems, operational technology and business software all use encryption that you did not choose and cannot change yourself.
Your vendors decide when those products will support post-quantum cryptography. A list of your systems shows where the risk is, but only your vendors can say when it will be fixed. Each new purchase can add to the problem.
The Australian Signals Directorate (ASD) has published questions to ask vendors. Our white paper, Quantum-safe supply chains, shows where they fall short: they don’t say what evidence proves an answer, name the algorithms you need, give you a way to compare vendors, turn plans into commitments, or ask who controls the cryptography. We close those gaps for your three most critical products.
ASD recommends organisations to have a refined cryptographic transition plan by the end of 2026, to have started moving critical systems by 2028, and to finish by 2030. It says the plan should account for your dependencies, which for most operators means your vendors. If you don’t have a plan yet, you’re behind that timetable. This offer gives you a draft in six weeks, so you can show your board and regulator that work has started.
Since 1 July 2026, the Protective Security Policy Framework (PSPF) has required Commonwealth agencies to keep a post-quantum transition plan (Requirement 0223) and to buy products that support approved post-quantum encryption (Requirement 0212). Agencies must also pass relevant requirements on to their suppliers through contracts (Requirements 0040 and 0041). If you supply government, expect these terms to reach you.
WHAT YOU GET
01 · YOUR VENDORS
For each product: answers to the ASD questions that apply, each with its source and a rating of how well it is backed by evidence, a maturity level, a check of the algorithms it supports, who controls its cryptography, the dates the vendor has committed to, a risk rating, and any answers still to be confirmed. You also get a pack to send the vendor.
02 · YOUR PLAN
It starts with a one-page summary for your board. It ranks the systems that rely on the three products by risk, names an owner for each, sets dates against ASD’s milestones, and lists actions for the first 30, 90 and 180 days. It also sets out what to require in future purchases, with contract wording that turns vendor dates into commitments. It follows the steps the PSPF sets out and stays a draft until vendors confirm their answers.
HOW WE ASSESS EACH PRODUCT
STEP 1
A core set of ASD’s questions for every product, plus the others that apply to the type of product and how critical it is. We note which questions we used, and why we left any out.
ASD, Post-quantum questions to ask your vendors
STEP 2
We look for evidence for each answer, such as the exact algorithms supported, a list of the cryptography in the product, release notes and test certificates. Each answer is rated by the strength of its evidence, and the product gets a maturity level from 0 to 5.
PKI Consortium, Post-Quantum Cryptography Maturity Model
STEP 3
Does the product support the algorithms ASD will require by 2030 (ML-KEM-1024, ML-DSA-87, SHA-384 or SHA-512 and AES-256), or have a dated plan to?
ASD, Information Security Manual
STEP 4
Where your data is, who can access it, and who holds the keys.
ASD, Choosing secure and verifiable technologies
STEP 5
Dates for post-quantum releases and for removing older algorithms, marked as either a plan or a contractual commitment.
PKI Consortium procurement guidance
STEP 6
Any answer the vendor can’t support becomes a risk in your plan, with an owner and a date to check it again.
Our white paper, Quantum-safe supply chains
HOW IT WORKS
Your team’s time is two short meetings, plus sending the vendor packs if you choose. There are no interviews or questionnaires for your staff.
If you can, you send each vendor a pack to complete, and they have four weeks to reply. Otherwise, or for anything they don’t answer, we use what the vendor publishes and mark it “to be confirmed”. Using public sources only, we can finish in three weeks.
PRICE
The price covers three vendor products and the systems that rely on them, and doesn’t change once we start. Half is invoiced when you sign and half when we deliver the draft plan.
WHO CAN TAKE IT UP
WHO DOES THE WORK
Every engagement is delivered by our founders, Stephen Chey and Narayana Madineni, who wrote Quantum-safe supply chains. Both are members of the PKI Consortium working group that develops the PQC Maturity Model. Narayana helped add post-quantum algorithms to the cryptographic libraries behind IBM products, and Stephen has been trialling the maturity model with Australian clients.
WHAT THE DRAFT PLAN DOESN’T COVER
It covers three vendor products and the systems that rely on them, not all the encryption across your organisation; our Quantum Readiness Assessment goes further. Answers from public sources stay unconfirmed until the vendor confirms them. Maturity levels are our assessment, not a PKI Consortium certification. The draft plan supports compliance and risk management but isn’t legal advice. ASD and the Department of Home Affairs do not endorse Southern Quantum.
Links open the official source.
