Crypto-Agility as an Organizational Capability: A Conceptual Reframing of Post-Quantum Readiness
Year: 2026
Type: article
Abstract: The standardization of post-quantum cryptography has shifted the central question of migration from which algorithms to adopt toward whether organizations can change cryptography at all. Prevailing treatments describe crypto-agility as a technical property of protocols and software, an abstraction layer that lets algorithms be swapped; that framing explains part of the problem and understates the rest. Drawing on organizational-capability theory, information-technology governance scholarship, and sociotechnical systems thinking, this paper reframes crypto-agility as a sociotechnical organizational capability: the coordinated capacity of people, process, architecture, and governance to detect cryptographic change, decide on a response, and reconfigure cryptographic mechanisms across the estate while preserving security and operations. The paper specifies the capability construct and its four dimensions and proposes a five-level maturity model that folds the standardization, agility, and hybridization pillars into its indicators. A preliminary application to three organizations that document their migration publicly shows the model can be applied and discriminates among them, while revealing that public evidence under-observes the people and governance dimensions. The model is presented as a theoretically grounded artifact for future validation, not as observed data; implications for governance, procurement, and assurance are developed.
DOI: 10.3390/jcp6050150
Author: Simon Baradziej
Institution: UiT The Arctic University of Norway
Language: English
Subfield: Information Systems
Field: Computer Science
Domain: Physical Sciences
Open Access status: gold
Estimated APC paid: $1,207
OpenAlex ID: W7204897148