Why it matters
Algorithms weaken, standards change, implementations fail, certificates expire, keys are compromised, and new computing capabilities alter planning assumptions.
Capabilities
- Inventory algorithms, protocols, certificates, keys, and dependencies
- Separate cryptographic policy from application logic where feasible
- Support controlled configuration and version change
- Test interoperability and fallback behavior
- Rotate keys and certificates reliably
- Track vendor roadmaps and data-lifetime requirements
Post-quantum planning
Post-quantum migration is one reason to improve agility, but the capability also reduces risk from ordinary expiration, compromise, deprecation, and platform change.
Common obstacle
Cryptography becomes difficult to change when it is embedded in devices, proprietary formats, long-lived data, hard-coded application logic, identity systems, and supplier contracts.
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: