Agencies are being encouraged to factor post-quantum encryption requirements into the acquisition process, as CISA works on a products list.