Supplier resources · Evidence request

Ask for evidence behind the answers.

Follow up an initial supplier response with a request for product-specific documentation, migration plans and customer implications.

How to use this template

Replace the fields in square brackets and adapt the questions to the supplier’s initial response. Remove questions already answered adequately.

You can edit the email below before copying it. Edits are not saved by PQCPrep and may be lost on refresh. Send the email through your usual application and use approved channels for confidential documents.

Email template

Subject: Post-quantum readiness — supporting evidence for [product/service]

Dear [supplier contact],

Thank you for your response dated [date].

To support our review of [product/service, version and deployment] used by [company], please provide the following evidence where available:

1. Available capabilities
Technical documentation and release notes identifying supported post-quantum algorithms, relevant standards, versions and required configuration. Please distinguish production capabilities from trials and previews.

2. Coverage and limitations
Which components, connections and uses of cryptography are covered? Please identify exclusions and any remaining reliance on cryptography vulnerable to quantum attack.

3. Migration roadmap
Product-specific milestones, target dates and support arrangements. Please distinguish committed delivery dates from indicative plans.

4. Customer actions and costs
Required upgrades, configuration changes, hardware replacements, licence charges and testing, including compatibility and service interruption considerations.

5. Testing and assurance
Relevant test results or independent assessments, with their scope, date and limitations. Please explain how these apply to our deployment.

6. Dependencies
Outstanding dependencies on other suppliers, platforms or standards, and their effect on delivery.

Please date the information and identify the technical contact responsible for answering follow-up questions. Where evidence is unavailable, please state this explicitly and indicate when it may become available.

We would appreciate a response by [response deadline]. If documents require an NDA or secure sharing arrangements, please advise how we can access them.

Kind regards,
[name]
[role]
[company]

What to check in the evidence

Match your deployment. Check that documents apply to your product, version and configuration.
Check dates. Record when evidence was issued and whether it has been superseded.
Separate delivery from plans. Release notes and available features answer a different question from roadmap commitments.
Read the scope. Testing or certification may cover only particular components or configurations.
Record customer work. Identify actions, costs, owners and dependencies that your business must manage.
Track unanswered questions. Missing evidence is an information gap; it does not by itself establish that a supplier is unprepared.

Supplier documentation is one input to due diligence. Specialist review may be needed to evaluate technical claims and their relevance to your systems.

Related template

Starting the conversation with a supplier?

Use the initial supplier enquiry →

This is an original PQCPrep resource.

Template version 1.0 · 7 October 2026