EN|FREN|FROrganizations rely on cloud, SaaS, managed services, external processors, embedded crypto. Encryption and crypto choices are often outside direct control; long-term protection depends on third-party decisions. An organization can be ready internally yet exposed through its ecosystem. Post-quantum risk is systemic.
Exposure types: data processing (external store/transmit/process encrypted data), cryptographic services (encryption, key management), product-embedded crypto (hardware/software not directly configurable), interconnection (secure channels between organizations). Each creates different visibility and control constraints.
Direct audits of suppliers are often impossible or disproportionate. Assessment relies on vendor roadmaps, public statements, contractual commitments, questionnaires. Dimensions: awareness of PQC risk, roadmap existence, crypto agility, dependency transparency. Goal is informed risk classification, not certification.
Add PQC questions to vendor assessments, tag suppliers with long-term data exposure, align with procurement and contract reviews. Integration uses existing governance, supports audit traceability and proportional response.
Most vendors are in assessment and planning phases. Unrealistic demands (e.g. immediate PQC deployment) cause friction or misleading commitments. Reasonable expectations: acknowledgment of PQC risk, commitment to crypto agility, periodic updates. Governance focuses on direction and intent, not deadlines.