Back to DashboardExecutivePhase 7 · Vendor & Supply Chainintermediate30 min

Vendor & Supply Chain Risk

Assess vendor PQC readiness, build scorecards, and manage supply chain cryptographic risk.

Why this matters: A vendor's PQC roadmap claim is only as good as the product data behind it — scoring readiness from real data, not marketing pages, is what actually protects a supply chain.

Start here: Select your products in step 1, then score two vendors on the same PQC readiness dimensions in the Vendor Scorecard and compare the totals.

For your role

Executive / Business Leader: Select the products you run from the Migrate catalogue, score the vendors on PQC readiness from real product data, and read the three scenarios: a critical vendor without a roadmap is the one to act on.
GRC / Risk & Compliance: Score vendors from product data rather than marketing pages, generate the contract clauses, and map dependencies across infrastructure layers; the FIPS-validation-gap scenario is the audit finding to look for.
Researcher / Academic: The scoring uses the migrate catalogue's product records, so every score can be traced to a row with its evidence.
IT Ops / DevOps: Map vendor dependencies across your infrastructure layers in Step 4: the appliance vendors on your critical path are the ones whose roadmaps decide your cutover dates.

Practice in the Simulation

Why Vendor PQC Risk Matters

Your organization's quantum readiness is only as strong as your weakest vendor. Third-party software, hardware, and cloud services form the backbone of enterprise cryptographic infrastructure. If a critical vendor lacks support, your entire migration timeline is at risk.

“Supply chain risks are among the most significant challenges for PQC migration. Organizations must evaluate vendors' cryptographic capabilities and ensure contractual commitments to post-quantum readiness.”

— NIST SP 1800-38 (Draft), PQC Migration Handbook

Harvest Now, Decrypt Later

Vendors handling sensitive data in transit are immediate HNDL targets. Every unpatched vendor extends your exposure window. For the full HNDL risk quantification framework, see PQC Risk Management.

Compliance Cascade

Regulatory deadlines (CNSA 2.0, FIPS 140-3) apply to your full supply chain, not just your own code.

Single Points of Failure

A single vendor dependency on classical-only crypto can block your entire PQC migration program.

Vendor PQC Scorecards

A vendor scorecard provides a structured, repeatable method for evaluating how well-prepared each vendor is for the post-quantum transition. Scores are weighted across dimensions that map to real migration risk factors.

Key Dimensions

• PQC algorithm support (ML-KEM/FIPS 203, ML-DSA/FIPS 204, SLH-DSA/FIPS 205)
• FIPS 140-3 validation status
• Published PQC migration roadmap
• Crypto agility capability
• SBOM/CBOM delivery
• Hybrid mode support

Scoring Methodology

• Each dimension scored 0–100
• Weights reflect migration impact
• FIPS dimension auto-scored from product data
• Composite score drives risk tier
• Exportable for procurement reviews

CBOM: Crypto Bill of Materials

A CBOM (Cryptographic Bill of Materials) extends the SBOM concept to track every cryptographic algorithm, key, certificate, and protocol used by a software product. Demanding CBOMs from vendors is the single most impactful step toward supply chain quantum readiness.

What a CBOM Reveals

Algorithm inventory, key sizes, protocol versions, certificate types, and quantum vulnerability status per component.

Standard Format

CycloneDX 1.7 includes a crypto extension for machine-readable CBOM data. The CycloneDX community (cyclonedx.org) maintains the specification, originally an OWASP project.

Vendor Requirement

Include CBOM delivery requirements in vendor contracts with defined frequency, format, and scope expectations.

FIPS Validation Tiers

Not all “FIPS compliance” claims are equal. Understanding the tiers helps you assess real vendor cryptographic maturity.

FIPS 140-3 Validated

Module has an active CMVP certificate. Check its overall level, operational environments, caveats and approved-algorithm list, and that the product uses that module in that configuration.

FIPS 140-3 In Process (MIP)

Module is on the CMVP Modules in Process list. That is a queue position, not evidence of the outcome: a submission can stall, be withdrawn or fail. Treat it as a roadmap statement until a certificate is issued.

FIPS 140-2 Validated

Legacy validation. FIPS 140-2 certificates moved to the CMVP Historical list in September 2026: usable in existing systems, not for new procurement.

FIPS Mode / Self-Claim

Vendor claims FIPS-mode operation but has no CMVP certificate. Lowest assurance.

Vendor Assessment Framework

A structured approach to evaluating vendors ensures consistent, auditable assessments across your supply chain. Follow this framework when engaging vendors on PQC readiness.

Inventory

Catalog all vendor products that handle cryptographic operations

Request CBOM

Ask vendors for Crypto Bill of Materials (CycloneDX format)

Score Readiness

Apply the PQC readiness scorecard across 6 dimensions

Contract Requirements

Embed PQC migration clauses in vendor agreements

Monitor & Reassess

Track vendor progress quarterly; escalate non-compliance