Crypto-Agility
The ability to swap out a cryptographic algorithm, key length, or protocol without redesigning the surrounding system, so a future algorithm break or standards update does not require a ground-up rebuild.
Crypto-agility is a design property, not an algorithm. A system is crypto-agile when its cryptographic choices, such as which key-exchange algorithm, signature scheme, or key length it uses, are configuration rather than something wired into the application's architecture. Replacing one algorithm with another should be a deployment change, not a rewrite.
Why PQC migration made this urgent
Most regulators and standards bodies pushing post-quantum migration are explicit that this will not be the last cryptographic transition an organization goes through. NIST's own guidance treats the current RSA and ECC to PQC shift as a case study for a capability every organization needs going forward: today's PQC algorithms could themselves need replacing if a weakness is found in lattice-based cryptography before it has been in production as long as RSA has.
A system without crypto-agility treats this as a one-time, painful migration project. A system with it treats a future algorithm swap as routine maintenance.
What it looks like in practice
- Algorithm parameters in configuration, not hardcoded into application logic or compiled into firmware that cannot be updated remotely.
- Protocol version negotiation that can add a new algorithm option without breaking compatibility with systems that have not yet upgraded.
- Centralized cryptographic libraries rather than each service or team implementing its own cryptographic calls, so an update happens in one place.
- An accurate, current cryptographic inventory, which is exactly what a CBOM provides. You cannot assess how agile a system is, or plan an algorithm swap, without first knowing what is in use and where.
Why it appears on country pages here
Several primary sources cited on this tracker use "crypto-agility" as a named requirement or objective, distinct from a specific PQC migration deadline. A regulator asking organizations to demonstrate crypto-agility is asking for a capability, not a one-time compliance action, which this tracker's scope-of-coverage and inventory-requirement axes both account for.