What happened

On 5 November 2026, CISA announced guidance developed jointly with the NSA and the Australian Cyber Security Centre (ACSC), part of the Australian Signals Directorate (ASD). The publication outlines questions organizations should ask vendors about post-quantum cryptography and includes a quick-reference list to support those discussions. [1]

The guidance specifically addresses industrial control systems and IoT devices, which may remain in service for many years and can be difficult to update. It recommends engaging suppliers early to discuss cryptographic implementations and migration plans, before cryptographically relevant quantum computers become available. [1]

Why it matters for manufacturers

A device may remain in service through several changes in cryptographic requirements. Its TLS library is only part of the picture. SSH access, firmware signatures, certificate handling, secure boot, and trust anchors may each impose different update constraints.

Planning a migration requires understanding those technical constraints as well as the product’s support period. A library upgrade may affect memory use, timing, message sizes, or compatibility with an existing server. Hardware-backed keys and secure boot mechanisms may need a different migration approach from user-space network software.

A credible plan identifies which cryptography is present, where it is used, and which components can be updated. It should also define the tests needed to verify compatibility, performance, and recovery.

What to include in your roadmap

  • Inventory cryptographic libraries, protocols, signing mechanisms, and trust anchors across the product.
  • Ask suppliers whether their support periods and update capabilities cover the device’s expected service life.
  • Plan tests for resource use, interoperability, and recovery before committing to a cryptographic migration.

The engineering takeaway

Maintained firmware, a complete cryptographic inventory, and reliable updates provide the foundation for a manageable transition. Set migration milestones that can be verified through testing.

Primary source

  1. CISA: Post-Quantum Questions to Ask Your Vendors5 November 2026. Announces joint guidance from CISA, the NSA, and ASD’s ACSC, with a link to the full publication.

Source reviewed on . The manufacturer guidance and engineering takeaway reflect Firmdura’s analysis.