Post-Quantum Cryptography: 5 Questions to Ask Your IT Vendor

Why a future computer creates work today

A sufficiently capable future quantum computer could threaten widely used public-key cryptography. That does not mean such a machine has already broken your business systems. Preparation matters because changing cryptographic systems can take years, and information collected today might remain valuable long enough to face a future decryption threat.

On 27 October 2026, NIST announced its final transition report, NISTIR 8547. It identifies vulnerable standards and their post-quantum replacements, and describes migration activities and timelines. Treat the report as a planning resource; an article about it cannot determine the exact obligations of your organisation.

Separate ordinary software from systems you own

The UK National Cyber Security Centre makes a useful distinction. Small businesses relying on standard browsers, operating systems and other commodity services will generally receive changes through vendors. Businesses using custom or specialised systems need to identify suitable updates or replacements.

For example, a design studio using a maintained cloud email service has a different job from a manufacturer relying on a bespoke device that sends signed maintenance instructions. The studio needs to understand its provider’s plans. The manufacturer may need coordination between the device supplier, software maintainer and the people running the equipment. Neither should assume that one purchase fixes every dependency.

Ask five questions before buying a solution

1. Which of our services or products depend on cryptography, and which company maintains each one?
2. Does your roadmap cover the versions we actually use, including older supported devices?
3. Will the change arrive through routine updates, a configuration change or a replacement product?
4. What compatibility testing will be needed with our other systems and partners?
5. What evidence and support will you provide when the change is ready?

Ask for a dated answer and a named contact. “Quantum-ready” on a sales slide is less useful than a plan tied to your product version and support period. If a supplier cannot yet give a final date, record the uncertainty and agree when you will review it again.

Consider the lifetime of the information

A café’s public opening hours and a company’s confidential product designs do not have the same secrecy requirements. Make a simple list of important information, where it travels and how long disclosure would matter. That gives a technical adviser context for prioritising work without putting passwords, private keys or customer records into an inventory document.

NCSC’s guidance uses milestones for discovery and planning by 2028, priority work by 2031 and completion by 2035. These are UK migration targets with stated scope and exceptions, not a universal statutory deadline for every small business worldwide. Sector rules, contracts and local requirements need separate assessment.

Keep today’s security work moving

Australia’s small-business cyber security handbook, reviewed in October 2026, places multi-factor authentication, software updates, backups and access controls first while encouraging awareness and planning for post-quantum changes. A future migration should not become a reason to postpone those practical protections.

Give one person responsibility for the vendor questions, record the answers and include them in your next technology review. The immediate outcome should be a clearer understanding of ownership and upgrade dependencies. Any implementation should use supported products and qualified advice, with testing before changes reach important business systems.

Sources

• NIST: Final post-quantum transition report announcement, 27 October 2026
• NCSC: Timelines for migration to post-quantum cryptography
• Australian Signals Directorate: Small business handbook—post-quantum cryptography, reviewed 7 October 2026