In June, the White House issued an urgent directive to federal agencies: the window to adopt post-quantum cryptography is narrowing. Q-Day is closer than we think, and quantum readiness deadlines have tightened to keep the pace.
While the executive order targets government institutions and contractors, the private sector is often quick to mirror federal practices to maintain the utmost security. This means leaders must prepare for the acceleration of quantum risk now, before their current practices become substandard.
After all, attackers are already racing ahead. Nation state actors are employing “harvest now, decrypt later” tactics, amassing swaths of sensitive data to unlock once quantum decryption is possible. While some data loses value or becomes irrelevant over time, other records can be decades old and still have devastating consequences if leaked.
Procurement is the nexus of this kind of sensitive data: each transaction creates banking information, invoices, tax records, and risk assessments that accumulate into a broad potential attack surface, if not diligently secured. The manufacturing industry, with supply chains encompassing vast webs of commercial vendors and suppliers, faces increased exposure risk.
Fortunately, the steps that manufacturers take to build resilience today can help to prepare them for Q-Day and beyond. There is no “harvest now, decrypt later” if bad actors can’t get their hands on the data in the first place.
Evolving the Risk Evaluation Process
A single weak point in a supplier poses systemic risk, potentially costing organizations up to 40 percent of their revenue. With quantum decryption, the risk scales from systemic to industry-wide.
Supply chain risk is already complex; most organizations’ risk management processes aren’t ready for today’s emerging security challenges, let alone next-gen quantum threats. If they have not already, manufacturers will need to completely reevaluate their entire supplier network, including any technology they use in the procurement lifecycle, for quantum readiness.
This starts by reprioritizing quantum risk within the larger risk management function. Quantum readiness assessments should be a routine part of the supplier evaluation process, examined alongside factors such as financial stability, cyber resilience, and compliance posture. Each potential partner should be subject to a full survey of their cryptographic standards and crypto-agility posture, and they should be able to prove they can protect their clients’ most critical data before any contract advances.
Risk is only the beginning. Evaluation for quantum readiness requires simulating the business impacts of disruption. How much would it cost if this channel were compromised? What are the costs of remediation? Understanding the downstream effects not only helps manufacturers make better decisions, but enables them to prioritize their most urgent quantum readiness initiatives and set a sustainable timeline.
Building a Golden Record of Data
With each potential supplier, manufacturers must operate on the idea that any uncertainty is a potential risk, and make decisions accordingly. The goal of building a quantum-ready supply chain is to minimize such uncertainty—or eliminate it entirely.
Accurate, real-time supplier data is the bedrock of modern enterprise risk management, and it will be manufacturers’ primary shield against quantum risk—including harvest now, decrypt later tactics. With a so-called “golden record” of data aggregated by trusted third parties, it becomes easier to bring quantum readiness into enterprise buying decisions.
Consider a scenario where a manufacturer contracts a supplier without an updated record of its cyber risk exposure. After the contract period has started and the manufacturer has shared sensitive information, the manufacturer’s procurement team discovers their new supplier was recently the target of multiple successful supply chain attacks, including one that led to a data breach at several of its enterprise-level partners.
Had the manufacturer’s due diligence process been backed by trusted data, they would have avoided a relationship with an untrustworthy partner. Now, they must rush to remediate any exposure, knowing their information could be vulnerable to a harvest now, decrypt later attack.
Data accuracy matters far beyond the initial RFP. Continuous risk monitoring is vital to ensuring quantum readiness. When manufacturers have risk management and procurement solutions that allow real-time visibility into supplier data, they can get ahead of emerging risks that could expose them to quantum decryption in the future. At the same time, they’ll have an advantage in solving their current supply chain problems.
The Quantum Roadmap: Playing Defense and Offense
Even though new advancements in quantum computing seem to make headlines every day, the reality isn’t sinking in: 91 percent of businesses in the U.S. and Europe still have no quantum roadmap.
A strong quantum roadmap has deadline-bound milestones for adopting quantum-resistant encryption across the organization’s entire technology ecosystem. But simply meeting PQC encryption standards at each milestone is insufficient.
Manufacturers need the crypto-agility to counteract evolving threats, without completely overhauling core business processes. This is another area where consistent access to accurate, real-time data remains critical: the earlier they can identify a potential vulnerability, the more time they have to develop a targeted, resource-efficient approach.
That’s the defensive side. To play offense, manufacturers should also explore how building their own quantum capabilities offers an advantage.
Quantum algorithms could greatly accelerate supplier risk management, especially across mutli-tier supply networks. By rooting out dependencies and concentration risks hiding beneath presumed tier-one stability, quantum-powered risk management will allow for assessment and remediation across broader swaths of the supplier network, at unprecedented speed.
Additionally, quantum algorithms could unlock accelerated machine learning and more complex pattern recognition, thereby enhancing fraud detection, transaction analysis and overall supply chain optimization.
None of this is possible without a bulletproof data foundation. Otherwise, advanced computing will only amplify errors. Secure, validated golden records of data protect them from decryption threats while bolstering their own quantum strategies. Quantum readiness is not merely a protective measure, but a crucial competitive advantage.
Right now, quantum still straddles the threshold of theory and reality. But preparing for quantum won’t distract businesses from present-day challenges. Rather, it will strengthen their day-to-day risk management practices and build real operational resilience, giving them greater confidence to face the quantum future.
