tech · quantum risk
Is RFP PQC requirements Quantum Proof? Cyber Program & PQC
Verdict
RFPs should demand crypto transparency, hybrid/PQC roadmaps, CBOM/crypto disclosures, and update mechanisms. Buying classical-only without residual risk acceptance is a program failure mode.
Overview
Procurement is a quantum control. Weak RFP language produces weak products in your estate for years.
Program inventory focus: Purchases lock classical-only products for a decade. Typical classical surfaces: Contractual algorithm and roadmap clauses. Cross-read /security/program and /assessment. Educational only—not compliance advice.
Cryptographic profile
- Signatures: Contractual algorithm and roadmap clauses
- Hash: N/A
- Public-key exposure: Purchases lock classical-only products for a decade.
What breaks
- Security questionnaire bolted on after vendor selection
- No scoring weight for crypto
Mitigations
- Standard PQC schedule in RFP templates
- Must-answer algorithm tables
- Acceptance tests for claimed modes
FAQ
Small purchases?
Tier by risk; still ask basic algorithm questions for security tools.
Open source procurement?
Still review crypto libs and maintenance.
Key concepts (technical dictionary)
Terms used on this page — open a definition: