Quantum Risk Is Already Here: An Enterprise Buyer's Guide to Assessing Third-Party Cryptographic Readiness Before Q-Day, Part 1 - Situation and Strategic Guidance

This IDC Perspective discusses the need for third-party post-quantum readiness. The quantum threat to enterprise data security is not a future risk - it is a present liability that is compounding across your third-party vendor portfolio. Harvest now, decrypt later (HNDL) attacks are collecting data that your vendors encrypt today for retroactive decryption once quantum computers mature. Trust now, forge later (TNFL) - introduced by IDC as the authentication-layer counterpart to HNDL - describes adversaries harvesting signed vendor artifacts currently to retroactively forge provenance records that your organization and your regulators cannot distinguish from authentic ones. With NIST finalizing three PQC standards in August 2024, CISA issuing federal procurement guidance in January 2026, and NIST IR 8547 proposing to deprecate quantum-vulnerable asymmetric algorithms after 2030 and disallow them after 2035, the regulatory landscape has converted PQC migration from a planning exercise into a third-party compliance obligation you cannot defer to your vendors.This document is part 1 of a two-part IDC Perspective series for enterprise buyers. It establishes the strategic and threat context for deploying a PQC readiness assessment program across your third-party vendor portfolio - including the HNDL and TNFL threat dimensions, Mosca's inequality vendor prioritization framework, emerging Quantum Security Posture Management and Quantum TRiSCM operating models, and the five quantum governance dimensions and trust KPIs that mature buyer programs are adopting. Quantum Risk Is Already Here: An Enterprise Buyer's Guide to Assessing Third-Party Cryptographic Readiness Before Q-Day, Part 2 - Assessment Framework and Deployment Guide (IDC #, forthcoming) delivers the complete 48-question Third-Party Quantum Encryption Readiness Assessment Framework. Vendors that cannot demonstrate a credible migration posture across both encryption and authentication represent material, unquantified risk in your third-party portfolio - risk that regulators and boards will increasingly require you to account for before formal mandates arrive."Two clocks are running simultaneously across your third-party vendor portfolio. The first is the HNDL clock: Data your vendors encrypt currently under quantum-vulnerable algorithms is potentially readable within a decade, and it cannot be re-encrypted retroactively. The second is the TNFL clock: Every artifact your vendors sign currently under a quantum-vulnerable key extends the attack surface adversaries will exploit once quantum computing reaches cryptographic relevance. Neither clock can be paused, and neither is your vendor's problem alone - because the data at risk is yours, and the regulatory accountability is yours. The only rational response is to treat third-party PQC assessment not as a future program but as the most time-sensitive addition to your vendor risk management framework - and to build the governance, assessment infrastructure, and continuous monitoring foundations before your regulators ask you to explain why you did not," says Philip D. Harris, CISSP, CCSK, research director, Governance, Risk, and Compliance Solutions at IDC.