Manage the Dependencies You Do Not Control
Organizations depend on vendors for most of their cryptographic functionality. Your migration cannot finish before your slowest critical vendor is ready. This course covers the vendor dependency problem directly. You learn how to assess vendor PQC readiness, what contractual language to use, and how to tier vendors by criticality. You also learn the bridge patterns available when a critical vendor’s timeline slips. In the 2025 IBM Institute for Business Value and Cloud Security Alliance study, 62% of executives said they expect vendors to handle the quantum-safe transition for them. That expectation is the “62% problem” covered in Module 1.
Course Outline
Module 1 The Vendor Dependency Problem
Why vendor dependencies are the binding constraint in most migrations. Mapping cryptographic dependencies across the supply chain. The “62% problem”: the gap between expecting vendors to handle PQC and verifying that they will. Software supply chain and the role of SBOM/CBOM.
Module 2 Assessing Vendor Readiness
Structured assessment of vendor PQC plans. Questions that reveal genuine readiness versus marketing. Evaluating vendor roadmaps and timeline credibility. Technical validation of vendor PQC claims. Building a vendor readiness scoring model.
Module 3 Contractual and Procurement Mechanisms
Contractual language for cryptographic migration obligations. Requirements for new contracts and amendments to existing agreements. Procurement criteria for PQC readiness. Service-level agreements for cryptographic transition. Managing the legal and commercial dimensions of vendor PQC requirements.
Module 4 Criticality Tiering and Bridge Patterns
Tiering vendors by criticality and migration impact. Bridge patterns for when a critical vendor’s timeline slips: gateway-based protection, compensating controls, and contingency planning. Managing the residual risk of vendor dependencies that cannot migrate on schedule.
Prerequisites
A working understanding of PQC fundamentals is recommended. Consider Post-Quantum Foundation or PQCS certification for background.
Certificate of Completion
Upon completion, you receive a Quantum Academy certificate of completion. It is separate from our professional certifications and states your CPE credits, one for each 60 minutes of teaching. CISSP, CISM, CRISC and CISA holders can claim them with their certifying body. The credits also count toward renewing a Quantum Academy certification. Our CPE credits page explains how to claim them.
Who this course is for
Third-party risk managers, procurement and vendor management, security architects who set supplier requirements, and the GRC staff who verify them. Suppliers can also take it to see what their customers will ask of them.
If you are focused on your own estate, take the discovery and migration courses first.
What you’ll be able to do afterward
- Set post-quantum requirements for suppliers in terms you can verify
- Assess a vendor’s PQC roadmap critically and separate shipped capability from intent
- Map cryptographic dependencies across the supply chain, including the ones your vendors inherit
- Close the gap between expecting vendors to handle PQC and verifying that they do
- Build bridge plans for the critical vendor whose timeline slips
What you leave with
When you finish, we email you the course handbook, a PDF of every slide with notes that explain it in full. We also include a PDF copy of Quantum Ready. The handbook is yours to keep.
Enrollment includes 180 days of access to the online on-demand course. Where that course is not yet published, the 180 days start on the day it is.
Where this course fits
Post-Quantum Foundation or PQCS Specialist Training provides the background for this course. You can take this course without either. PQC for GRC covers the assurance side, and PQCV Validator Training leads to the credential.
Why we teach this
The course is built on the Applied Quantum PQC Migration Framework. Its author, Marin Ivezic, is one of the practitioners who teach here. The framework is published openly under Creative Commons at pqcframework.org. The people who teach this course run migration programs inside organizations today. The course covers the problems they meet in that work.
About this program
Quantum Academy credentials are private professional credentials issued by Quantum Academy, a trade name of Post-Quantum Institute. They are not government-issued licenses, accredited degrees, or academic credit, and earning one does not guarantee employment, promotion, regulatory approval, or any other specific outcome.
Quantum Academy programs are educational and informational only, and are not legal, compliance, or engineering advice.
