Australia’s Quantum Supply Chain Risk: Why Vendor Readiness Determines PQC Success

The Dependency Dilemma

No Australian organisation is an island. Most businesses and government agencies rely on third-party vendors, cloud platforms, managed service providers, and external tools for their cryptographic infrastructure. This means that the risk of quantum vulnerability is not confined to the organisation’s own systems; it is embedded in the supply chain. If a critical vendor is slow to transition, or lacks visibility into its own cryptographic dependencies, the organisation’s data remains exposed regardless of its internal preparedness.

The ASD has identified vendor readiness as one of the most significant factors influencing an organisation’s ability to transition to PQC within the recommended timeframes. This recognition has led to the release of Post-quantum questions to ask your vendors, a practical, vendor-neutral guide designed to help organisations assess third-party readiness during procurement, contract renewals, and assurance processes.

The LATICE Framework for Vendor Assessment

The guidance aligns with the ASD’s LATICE framework, which structures the transition into five phases: Locate cryptographic dependencies, Assess risk and sensitivity, Triage and prioritise systems, Implement PQC algorithms, and Communicate with vendors and Educate stakeholders. For vendor assessment specifically, the framework encourages organisations to ask vendors how they are prioritising updates, whether they are migrating to internationally recognised standards, and how transparent they are about constraints and roadmaps.

The questions are intentionally accessible. Organisations do not need to become cryptography experts to use them; they need to be willing to ask uncomfortable questions during contract negotiations and vendor reviews. The resource is designed for cybersecurity leaders, procurement teams, and vendor management functions, reflecting the reality that quantum readiness is a cross-functional business issue, not a narrow IT concern.

The Cost of Supply Chain Opacity

The consequences of vendor blindness are becoming tangible. The SOCI Act’s classification of data storage as critical infrastructure means that directors can face personal liability for supply chain cryptographic hazards. APRA CPS 230, enforceable from July 2026, further holds entities accountable for provider vulnerabilities. Vendor readiness is no longer a procurement checkbox; it is a board-level risk management obligation.

A practical step is to commission a Cryptographic Bill of Materials (CBOM) that extends to third-party dependencies, mapping where vulnerable algorithms are used across the supply chain. This visibility enables organisations to prioritise engagement with the vendors that pose the greatest risk to long-lived sensitive data.