Vista resources / Downloadable kit
PQC vendor questionnaire
Ask suppliers which product version supports PQC, which cryptographic function it covers, how to enable it and what evidence you can verify. Use the 14-question template to record answers for your deployment.
The working edition / Excel workbook
Supplier conversations, ready to run.
14 structured questions, response tracking, a review dashboard and official-record lookups.
Questions · Example response · Dashboard · Official checks · Field guide
Download Excel workbook ↓What’s inside & how to use it
Start on the “Start here” tab. Blue input cells are editable; gray columns calculate automatically. Filterable tables, frozen headings, dropdowns and date-based review flags help you work through the records. Examples are kept separate from your working data.
On “Official checks,” enter a CMVP certificate number to generate a link to the official NIST record, or use an HTTPS evidence URL. Open the source, review the actual scope and status, then record the result and review date. Status is not fetched automatically. No macros or automatic network requests are included.
Open in Excel or LibreOffice for formula recalculation. The prepared ranges contain up to 100 rows; extend formulas, validation and dashboard ranges for larger inventories. CSV alternatives below are plain data files without formatting or formulas.
How to use this questionnaire
- Set the boundary. Name the product, version, hosting model, and intended use before sending questions.
- Request evidence. Ask the supplier to link release notes, configuration guidance, tests, and applicable official records.
- Review with the owner. Have an infrastructure or application owner assess whether the answers apply to your installed configuration.
- Track unresolved items. Record an owner and next review date in the supplier response tracker.
Copy the plain-text version into your procurement process or open the CSV in Excel, LibreOffice, or Google Sheets. Blank response fields are intentional. Keep completed responses in your organization’s approved storage.
Questions that make claims reviewable
On a narrow screen, scroll the table horizontally to read every column.
| Topic | Ask your supplier | Look for |
|---|---|---|
| Scope | Which exact products, editions, versions, and deployment modes does your PQC statement cover? | A versioned support matrix and named exclusions. |
| Use cases | Which functions use PQC: transport key agreement, certificate authentication, signing, key wrapping, or something else? | A mapping from each use case to implemented algorithms. |
| Algorithms | Which standardized algorithms, parameter sets, and protocol identifiers are implemented? | Exact identifiers; distinguish final standards from pre-standard variants. |
| Availability | Is the capability generally available, preview-only, or planned? | Release notes and an availability date; roadmap items separated. |
| Configuration | Is it enabled by default? What configuration, license, or hardware is required? | An administrator guide and a repeatable configuration example. |
| Interoperability | Which client and server combinations have you tested? | Versioned interoperability results, including unsupported combinations. |
| Fallback | When negotiation fails, can the connection fall back to classical cryptography? Can policy prevent that? | Documented fallback behavior and observable events. |
| Dependencies | Which libraries, firmware, services, or upstream suppliers must also change? | Dependency versions, ownership, and blockers. |
| Evidence | Can you provide a scoped CBOM and test evidence for the supplied release? | Machine-readable inventory, collection date, scope, and limitations. |
| Validation | What algorithm or module validation applies to this exact configuration? | Official certificate identifiers and the associated security policy; no company-wide badge. |
| Operations | How do operators monitor negotiated algorithms and detect configuration drift? | Logs, metrics, APIs, and sample evidence. |
| Performance | What changes to latency, handshake size, memory, and capacity should we test? | Measurements with environment, workload, and comparison baseline. |
| Lifecycle | How will you update algorithms, roll back safely, and support long-lived signed artifacts? | Support policy, recovery procedure, and compatibility constraints. |
| Delivery | Who owns your response and when will you supply missing evidence? | Named contact, dated commitments, and a follow-up date. |
Review answers without inventing a score
Classify each answer as supported by evidence, awaiting evidence, not applicable with rationale, or unresolved. “We support quantum-safe encryption” is incomplete until the product version, function, configuration, and evidence are identified. A dated roadmap is useful planning information but does not establish present capability.
For a rollout decision, test your own client/server combination and operating conditions. Record accepted exceptions and who approved them. This questionnaire is a diligence aid, not an attestation of compliance.
Sources and further reading
Continue in Vista
Turn an answer into an evidence-backed next step
Keep the supplier’s exact product, version and limitations with your review. Identify the affected assets in Vista, then use Remediation → Queue to create a follow-up with an assignee and due date. Link relevant assets or findings and record the evidence reference in the work item. Group related work in Remediation → Plans.
Vista keeps follow-up work connected to the infrastructure it concerns. A supplier’s answer remains a claim to review; it does not become a measured configuration automatically.