PQC Ready · practical transition guidance
Crypto-agility: planning for cryptographic change
Build the ability to change cryptography through inventory, ownership, supplier support, testing and controlled deployment.
Published and reviewed 15 September 2026 · PQC Ready, a brand of SDTC Solutions Ltd
A capability, not a switch
Crypto-agility is the ability to change cryptographic mechanisms in a controlled way as requirements evolve. It depends on architecture and implementation, but also on ownership, procurement, testing and operational procedures.
Find the barriers
Hard-coded algorithm assumptions, certificate dependencies, constrained devices and inflexible supplier contracts can delay change. A configurable cipher list is not sufficient if the organisation cannot assess the effect of using it.
Create a testable route
Document the cryptographic role and the service it supports. Establish supported alternatives, configuration control, interoperability tests and an approved deployment path. Include monitoring and recovery decisions.
A useful demonstration is a scoped change in a representative environment with retained results. Check failure paths and dependencies, not just a successful connection between two new components.
Keep the capability current
Track cryptographic implementation versions and refresh supplier evidence. Review new acquisitions for lifecycle support and the ability to change key establishment and signatures.
Use the migration roadmap to turn barriers into owned work items. Measure whether the organisation can execute and verify changes, rather than simply counting products described as agile.
Continue exploring
- PQCEMM: enterprise post-quantum maturity
- NIST post-quantum standards: FIPS 203, 204 and 205
- What is a cryptographic bill of materials?