How crypto-agile is your organization? (quick version)

Inventory 1/3 — We maintain an up-to-date inventory of the cryptographic algorithms in use across the organization (a CBOM).

Inventory 2/3 — Cryptographic discovery is automated — built into vulnerability management or development tooling — rather than a manual, one-off effort.

Inventory 3/3 — Inventory ownership is a defined, documented responsibility — assigned to a role or team — not something that depends informally on one person's knowledge.

Architecture 1/3 — Cryptography is implemented behind a crypto API that separates application logic from the underlying algorithm.

Architecture 2/3 — In the past two years, we've actually swapped or patched a cryptographic algorithm or library in response to a real vulnerability — not just believe we theoretically could.

Architecture 3/3 — We've tested, piloted, or deployed hybrid (classical + post-quantum) algorithms in at least one system.

Risk & Prioritization 1/3 — We have a defined internal deadline for retiring 112-bit-security-strength algorithms (e.g., RSA-2048), aligned with NIST's disallowance timeline.

Risk & Prioritization 2/3 — We've identified which systems handle long-lived, confidentiality-sensitive data and prioritized those for earlier migration, given the risk that encrypted data collected today could be decrypted once quantum computers arrive.

Risk & Prioritization 3/3 — For our most sensitive data, we've compared how long it must stay confidential against how long migration would take and current quantum timeline estimates — i.e., we know whether we're already behind.

Governance 1/3 — Executive leadership is aware of our post-quantum migration timeline, and crypto-agility shows up in the organization's risk register.

Governance 2/3 — We have a documented, organization-wide cryptographic policy — not just informal, team-by-team practices.

Governance 3/3 — We can demonstrate our crypto-agility practices to external auditors, customers, or regulators when asked.