How do we answer an RFP question about post-quantum readiness?
With facts about your plan, not slogans. Evaluators usually look for four things: that you know where you use quantum-vulnerable cryptography, that you have prioritised it, that you have a timeline, and that someone owns it. A strong answer names the inventory and its date; the method of prioritisation, for example Mosca's inequality applied to data retention periods; the steps already taken, such as hybrid key exchange enabled on public services and VPN and SSH versions checked; the dependencies on suppliers, with their stated plans; and milestones aligned with the EU's coordinated roadmap: first steps by the end of 2026 and high-risk use cases by the end of 2030. Refer to the NIST standards FIPS 203, 204 and 205 by name. Do not claim that your service is immune to quantum attacks, which an informed evaluator will mark down. If your inventory comes partly from network observation, say so and say what it does not cover. An honest partial answer with dates scores better than a confident blank.