Quantum Risk Is Already Here: What Buyers Must Demand and Vendors Must Build

The quantum threat to enterprise third-party risk is not a future planning item. It is a present, compounding liability accumulating across vendor portfolios today. NIST finalized three PQC standards in August 2024 (FIPS 203, 204, 205), added a fourth HQC-based standard in March 2025, and CISA issued federal procurement guidance in January 2026 designating product categories where PQC support is non-optional. NSA’s CNSA 2.0 mandates National Security System migration by 2030 and code-signing infrastructure migration to hash-based schemes by 2025. NIST IR 8547 proposes deprecating quantum-vulnerable asymmetric algorithms after 2030 and disallowing them entirely after 2035. Migration timelines are no longer a matter of organizational preference. They are a matter of regulatory alignment.

Yet no TPRM platform has deployed a production-ready quantum encryption readiness module as of May 2026. The gap is structural. Passive external scanning tools detect classically weak cipher suites but cannot assess whether a vendor’s internal data stores, key management infrastructure, or API layers have adopted NIST PQC-compliant algorithms. The 2025 and 2026 SIG releases added DORA, NIS2, AI governance, and operational resilience domains, but neither introduced a PQC-specific domain. Enterprise buyers are already filling this void through ad hoc custom questionnaire additions, and they can’t afford to wait for vendors to catch up. TPRM platform vendors must close this gap now.

Two active threats, two independent attack surfaces

The quantum threat operates on a retroactive timeline across two distinct dimensions. Both are active today and require separate treatment in any assessment program.

Harvest Now, Decrypt Later (HNDL): Confidentiality

Nation-state adversaries are collecting encrypted data traversing public infrastructure today, including vendor API traffic, VPN sessions, and TLS-protected data flows, for retroactive decryption once quantum computers reach sufficient capability. A 2025 Federal Reserve Board research paper on this exact dynamic, focused on blockchain and distributed-ledger data, found the risk is already active rather than theoretical; the same logic extends to any data with a multi-year confidentiality requirement, encrypted or not. Any sensitive data a vendor transmits or stores under quantum-vulnerable algorithms is already at risk and cannot be re-encrypted retroactively. Mosca’s inequality makes this concrete: if the confidentiality lifetime of the data plus the vendor’s migration time exceeds the time to a capable quantum computer, the exposure window is already open.

Trust Now, Forge Later (TNFL): Authentication integrity

TNFL, introduced by IDC as the authentication-layer counterpart to HNDL, describes adversaries harvesting signed vendor artifacts today: software releases, firmware images, certificates, and audit logs. Once quantum computers can break RSA and ECDSA signing keys, those adversaries will retroactively forge provenance records that organizations and regulators cannot distinguish from authentic ones. Every artifact signed under a quantum-vulnerable key today extends the attack surface. TNFL risk compounds in real time. NSA CNSA 2.0 treats authentication migration as a separate and earlier obligation than encryption, with code-signing infrastructure preferring LMS or XMSS by 2025, five years ahead of the 2030 encryption deadline. Any assessment program that addresses only encryption is leaving the TNFL attack surface entirely unexamined.

The evidence problem: why fewer than 10% of vendors are ready

Fewer than 10% of vendors will produce documentary evidence for most of the 48 assessment questions in IDC’s Third-Party Quantum Encryption Readiness Assessment Framework. That gap is a market-wide signal of genuine program immaturity. Four structural gaps define where it shows up:

No cryptographic inventory: Most vendors have not completed a four-pillar inventory across application code, TLS configurations, digital certificates, and data at rest. Without this foundation, no subsequent assessment domain can be credibly addressed.
No board-approved road map: Fewer vendors still have a migration road map with a named executive owner, dated milestones, and allocated budget. A road map without allocated budget is aspirational, nothing more.
No fourth-party visibility: Almost no vendors have assessed the quantum readiness of open-source libraries, cloud KMS services, and HSM vendors underpinning their own stack. A vendor’s migration can only go as far as their infrastructure providers allow.
No TNFL assessment: Most programs address only encryption. The authentication infrastructure (code-signing keys, CA hierarchies, timestamping relationships, and audit log signing mechanisms) is an independent attack surface that rarely appears in any vendor’s current responses.

The most important function of the assessment questionnaire is not as a pass/fail gate but as the accountability structure that converts vendor awareness into program initiation. Deploying this framework now, accepting low initial evidence rates, and tracking year-over-year improvement is the most defensible posture available, given what regulators and threat actors have already made clear.

The IDC Third-Party Quantum Encryption Readiness Assessment Framework

IDC’s 48-question framework spans 11 domains covering the full cryptographic life cycle from program governance and cryptographic inventory through incident response and regulatory alignment. Every question is tagged by evidence collection method (questionnaire, external scan, document review, or technical verification) and vendor tier applicability. Table 1 summarizes all 11 domains.

TABLE 1: The 11 Assessment Domains, IDC Third-Party Quantum Encryption Readiness Assessment Framework

Source: IDC, 2026

Tiered deployment

Scale assessment depth to vendor risk profile. Build to Tier 1 requirements first; every lower tier is just a lighter version of that same baseline.

Tier 1 (Critical): All 48 questions, all 11 domains, full documentary evidence. Financial market infrastructure, healthcare systems, defense supply chain, and PII-at-scale processors. Require an independent third-party cryptographic audit and documented PFS as conditions of contract renewal.
Tier 2 (High): ~35 questions, Domains 1–6, 10, and 11. Regulated financial services, managed healthcare, technology companies with sensitive IP.
Tier 3 (Standard): ~20 questions, Domains 1–3 and 5. General enterprise software vendors with short-lived sensitive data.
Tier 4 (Low Risk): Five baseline questions: cryptographic inventory, vulnerable algorithm identification, NIST PQC migration road map, HNDL acknowledgment, and crypto agility.

Five-level maturity model

Score each vendor across all 11 domains against Table 2. A maturity level supported by domain-level evidence is materially more informative than 48 individual answers, and it’s what produces the year-over-year improvement signal boards want to see.

TABLE 2: Five-Level Vendor Quantum Readiness Maturity Model

Source: IDC, 2026

Beyond the questionnaire: The continuous operating model

Quantum readiness is positioned to become the first TPRM domain that is born continuous. Hybrid KEM deployment on production TLS endpoints is externally observable without vendor participation, meaning ratings platforms will convert it into a continuously monitored control once adoption reaches detectable scale. Cryptographic inventories also go stale within months, making an annual questionnaire a poor instrument for this domain. Three converging capabilities define the direction:

Quantum Security Posture Management (Q-SPM): Continuous measurement, benchmarking, and remediation of cryptographic exposure across cloud, applications, infrastructure, and third parties, extending point-in-time assessment with automated discovery and runtime posture visibility.
Quantum Risk Operations Center (Q-ROC): The operational layer translating continuous telemetry into active risk management: crypto drift detection, certificate monitoring, weak algorithm alerting, vendor quantum exposure tracking, and HNDL dataflow surveillance.
Continuous Quantum Control Assurance (Q-CCA): Automated evidence collection, policy validation, and control telemetry replacing periodic manual attestation. Vendors demonstrating Q-CCA represent a qualitatively different assurance tier that Tier 1 and Tier 2 buyers should begin requiring as a contract condition.

What buyers must demand

Your most exposed vendor relationships are accumulating quantum risk today. The following actions are immediate:

Deploy the 48-question framework now through your existing TPRM questionnaire builder, applying the tiered model to your vendor portfolio. Accept low initial evidence rates, record them as your baseline, and track year-over-year improvement. Vendors who cannot improve over successive cycles reveal program immaturity.
Require a tool-generated Cryptographic Bill of Materials (CBOM) in CycloneDX 1.6 format from Tier 1 and Tier 2 vendors, covering all four inventory pillars plus signing infrastructure. Ingest it directly into your GRC platform for automated maturity scoring.
Apply Mosca’s inequality per vendor and per data class to produce a data-driven HNDL exposure register for your board. Score vendor road maps against the 2030 encryption and 2025 code-signing CNSA 2.0 deadlines. A road map with a completion date beyond 2035 commits the vendor to operating disallowed cryptography.
Make perfect forward secrecy (Q42) and code-signing migration to hash-based schemes (Q39) near-term contractual requirements for all Tier 1 and Tier 2 vendors. PFS is the single most actionable HNDL mitigation today. A vendor with PFS implemented but no code-signing migration has mitigated HNDL while leaving the TNFL surface fully open.
Incorporate four contract elements for Tier 1 and Tier 2 vendors: (1) PQC milestone commitments aligned to NIST IR 8547 with specific dates; (2) PFS across all customer-facing TLS with confirmation that session keys are not retained; (3) HNDL notification triggers obligating vendors to notify you if your data has been subject to collection; (4) documentary audit rights over the cryptographic inventory. Translate the framework into contract language now; vendors will otherwise present you with their version first.
Brief your board using five quantum trust KPIs: Quantum Readiness Index, HNDL Exposure Score, Crypto-Agility Score, Quantum Trust Score, and Migration Velocity. These transform quantum readiness from a qualitative narrative into a quantifiable governance instrument.

What vendors must build

The structural tooling gap in the TPRM market is not a warning signal. It is a market opportunity with a closing window. The following priorities are immediate for both TPRM platform vendors and technology and service providers:

TPRM platform vendors: Build a production-ready quantum encryption readiness module now. The IDC 48-question framework is the baseline that standardization will converge toward. No platform has shipped this capability. The first-mover position is open and uncontested. Design for continuous cryptographic posture monitoring: hybrid KEM detection, certificate algorithm currency, weak cipher alerting, running in the background rather than surfacing once a year in a questionnaire. Integrate Q-SPM and Q-ROC capabilities into your product roadmap. Build CBOM ingestion in CycloneDX 1.6 format as a standard evidence intake workflow.
Technology and service providers: Build your response program to Tier 1 standards proactively. Your most sophisticated customers are already asking PQC questions through ad hoc TPRM additions. Year-one evidence providers will win procurement decisions. Responding with documentary evidence in 2026 is a genuine competitive differentiator. Establish a board-approved migration road map with named executive ownership, dated milestones, and budget before your customers ask. Findings discovered internally are far less damaging than those surfaced in customer due diligence.
On AI governance positioning: Avoid feature-washing. Buyers with even moderate sophistication now distinguish genuine AI risk governance from relabeled existing capabilities. Map your platform’s capabilities to the NIST Cyber AI Profile’s three risk areas and publish a roadmap commitment. That window narrows fast once a competitor ships first.
On PQC advisory services: Develop a repeatable cryptographic inventory methodology as the entry-point engagement. A scoped inventory producing a CBOM is comprehensible to a non-technical buyer, has a clear deliverable, and creates a multi-year upsell path to migration services across financial services, healthcare, defense supply chain, and critical infrastructure.
Product roadmap horizons: Now (2026): native 48-question module, tiered deployment tooling, DORA compliance modules, unified cross-framework mapping. Near-term (2027): Q-SPM benchmarking, CBOM ingestion, Cyber AI Profile alignment, agentic AI governance workflows. Medium-term (2028–2030): full Q-ROC capabilities, continuous vendor posture monitoring, hybrid cryptography management, EU CRA compliance modules.