SUPPLIER RESOURCES · INITIAL ENQUIRY

Ask your supplier about post-quantum readiness.

A starting point for portfolio oversight and acquisition due diligence. Request answers about the specific product or service you use.

How to use this template

Replace the fields in square brackets. You can edit the email below before copying it. Send it through your usual email application.

Edits stay in this page while it is open. They are not saved by PQCPrep and may be lost on refresh. Use your approved channels for confidential information.

Email template

Subject: Post-quantum readiness enquiry — [product/service]

Dear [supplier contact],

We are reviewing the post-quantum cryptography preparedness of the products and services used by [company].

Please provide information specifically for [product/service, version and deployment], covering:

1. Responsibility
Who owns your post-quantum migration programme, and who should we contact for technical questions?

2. Current capability
What post-quantum capabilities are available today? Please distinguish production releases from trials, previews and planned features, and identify the algorithms and standards supported.

3. Coverage
Which components and uses of cryptography are covered, and which remain outside scope?

4. Roadmap
What milestones and target dates apply to this product or service? Please distinguish committed dates from indicative plans.

5. Customer implications
What upgrades, configuration changes, hardware replacements, testing or additional charges might we need?

6. Dependencies
What depends on other suppliers or platforms, and how are those dependencies being managed?

Please include supporting documentation or links, the date of your response, and any known limitations or uncertainties. Where information is unavailable, please state this explicitly.

We would appreciate a response by [date]. If detailed information requires an NDA, please explain how we can obtain it.

Kind regards,
[name]
[role]
[company]

How to read the reply

These are prompts for further review, not a scoring system.

Check specificity. Does the answer identify your product, version, deployment and the capabilities covered?
Separate delivery from intention. Record what is available now separately from previews and roadmap promises.
Request evidence. Ask for dated technical documentation or release notes supporting material claims.
Record gaps. “Unknown” or “not disclosed” describes an evidence gap; it does not establish that a supplier is unprepared.
Clarify broad claims. Ask what “quantum safe” means for this product and what remains outside scope.
Identify your actions. Note customer work, costs, dependencies and questions requiring specialist review.

A supplier response is one input to due diligence. It does not independently verify implementation or establish overall business readiness.

Supporting guidance

This template is an original PQCPrep resource. It is not issued or endorsed by the NCSC.

NCSC: Timelines for migration to post-quantum cryptography

NCSC: Next steps in preparing for post-quantum cryptography

Template version 1.0 · 7 October 2026