QCBRIEF
The Australian Signals Directorate (ASD) published a vendor neutral questionnaire organized as Locate–Assess–Triage–Implement–Communicate, anchored to an end 2030 transition deadline.
Australia's national signals intelligence and cyber agency, the Australian Signals Directorate (ASD), on July 16, 2026, published a vendor-neutral questionnaire that gives security and procurement teams a structured way to pressure-test suppliers on post-quantum cryptography (PQC) readiness.
The document organizes its questions around a five-phase framework called LATICE: Locate, Assess, Triage, Implement, Communicate. Each phase maps to a buyer-side ask.
Locate centers on building a cryptographic bill of materials, a CBOM, to surface hardcoded or hardware-bound algorithms. Assess requires mapping data flows that depend on traditional asymmetric crypto, flagging "harvest now, decrypt later" exposure, and confirming a vendor CRQC, or cryptographically relevant quantum computer, risk assessment. Triage forces vendors to disclose which products will be PQC-ready before end-2030, which need hardware replacement, and when hybrid modes count as transitional rather than permanent. Implement confirms standards-based, ASD-approved PQC algorithms and migration mechanics.
ASD frames the end-2030 transition as the practical horizon for retiring traditional asymmetric algorithms, four years out and already inside most planning cycles.
A questionnaire is not enforcement. CBOM inventories remain immature across many SMB suppliers, and "hybrid mode as a temporary measure" can stretch in practice. Procurement teams that treat the LATICE list as a rubric, rather than a checklist to wave at vendors, will get more honest answers.