VISTA — PQC VENDOR QUESTIONNAIRE
Version 1 • 31 October 2026

Identify supplier, product, version, deployment and response owner. Answer separately for each configuration. Do not include secrets or private keys.

1. Scope
Which exact products, editions, versions, and deployment modes does your PQC statement cover?
Evidence requested: A versioned support matrix and named exclusions.
Response:
Evidence reference:
Follow-up:

2. Use cases
Which functions use PQC: transport key agreement, certificate authentication, signing, key wrapping, or something else?
Evidence requested: A mapping from each use case to implemented algorithms.
Response:
Evidence reference:
Follow-up:

3. Algorithms
Which standardized algorithms, parameter sets, and protocol identifiers are implemented?
Evidence requested: Exact identifiers; distinguish final standards from pre-standard variants.
Response:
Evidence reference:
Follow-up:

4. Availability
Is the capability generally available, preview-only, or planned?
Evidence requested: Release notes and an availability date; roadmap items separated.
Response:
Evidence reference:
Follow-up:

5. Configuration
Is it enabled by default? What configuration, license, or hardware is required?
Evidence requested: An administrator guide and a repeatable configuration example.
Response:
Evidence reference:
Follow-up:

6. Interoperability
Which client and server combinations have you tested?
Evidence requested: Versioned interoperability results, including unsupported combinations.
Response:
Evidence reference:
Follow-up:

7. Fallback
When negotiation fails, can the connection fall back to classical cryptography? Can policy prevent that?
Evidence requested: Documented fallback behavior and observable events.
Response:
Evidence reference:
Follow-up:

8. Dependencies
Which libraries, firmware, services, or upstream suppliers must also change?
Evidence requested: Dependency versions, ownership, and blockers.
Response:
Evidence reference:
Follow-up:

9. Evidence
Can you provide a scoped CBOM and test evidence for the supplied release?
Evidence requested: Machine-readable inventory, collection date, scope, and limitations.
Response:
Evidence reference:
Follow-up:

10. Validation
What algorithm or module validation applies to this exact configuration?
Evidence requested: Official certificate identifiers and the associated security policy; no company-wide badge.
Response:
Evidence reference:
Follow-up:

11. Operations
How do operators monitor negotiated algorithms and detect configuration drift?
Evidence requested: Logs, metrics, APIs, and sample evidence.
Response:
Evidence reference:
Follow-up:

12. Performance
What changes to latency, handshake size, memory, and capacity should we test?
Evidence requested: Measurements with environment, workload, and comparison baseline.
Response:
Evidence reference:
Follow-up:

13. Lifecycle
How will you update algorithms, roll back safely, and support long-lived signed artifacts?
Evidence requested: Support policy, recovery procedure, and compatibility constraints.
Response:
Evidence reference:
Follow-up:

14. Delivery
Who owns your response and when will you supply missing evidence?
Evidence requested: Named contact, dated commitments, and a follow-up date.
Response:
Evidence reference:
Follow-up: