Cloud & managed services
KMS, HSM, TLS, identity and certificate capabilities may be provider-controlled.
Why it matters
Your migration path may be controlled by someone else.
Cryptography is embedded in SaaS, cloud, managed PKI, identity platforms, libraries, hardware and other supplied technology.
The organisation may not control the algorithm, certificate hierarchy, key-management mechanism, component or migration schedule. Supplier capability and transparency therefore become part of organisational resilience.
What to understand
Follow dependency beyond the contract boundary.
SaaS
Customers may have limited visibility into algorithms, keys and migration roadmaps.
Libraries & components
Applications inherit capabilities and constraints from software dependencies.
Commercial technology
Products constrain supported protocols, algorithms and key types.
PKI & identity providers
External trust services introduce certificate, signing and key-management dependencies.
Supplier supply chains
The real constraint may sit with a supplier's own provider or component.
Risk lens
A supplier dependency becomes material when the organisation lacks sufficient visibility, influence, alternatives or transition capability if cryptography must change.
What good governance looks like
Critical supplier dependencies are segmented and monitored.
SegmentationDeeper oversight is focused where dependency is material.
Defined requirementsSecurity and transition expectations are proportionate to impact.
Due diligenceRelevant supplier capability and technology dependencies are assessed.
Contractual coverageResponsibilities, notification and evidence expectations are explicit where appropriate.
Ongoing monitoringMaterial standards changes and supplier roadmaps trigger reassessment.
Exit & contingencyPortability, alternatives and concentration are understood.
What to do next
Manage dependencies that can block your own treatment plan.
Identify critical external dependenciesStart with suppliers supporting critical services and sensitive data.
Ask decision-relevant questionsFocus on capability, ownership, roadmap and transition constraints.
Set proportionate requirementsMatch assurance expectations to business impact.
Track roadmap dependencyMake supplier-controlled dates visible in internal plans.
Plan alternativesUnderstand portability and exit before urgency removes options.
Quantum readiness
Your PQC timeline may depend on someone else's roadmap.
Post-quantum migration depends on products and external services supporting suitable transition paths.
Early supplier engagement is therefore part of managing the organisation's own readiness.
Authoritative sources