The Current Challenge
This isn't about a past breach. It's about a widespread issue unfolding now: a slow-motion control failure as cryptographic standards evolve faster than infrastructure can keep up. Organizations are struggling to answer basic questions about their encryption status. Where are certificates deployed? Which systems still use outdated algorithms? What happens when certificate lifecycles drop from 398 days to 90? This is an operational problem creating compliance gaps today.
Timeline of Changes
2023-2024: The Certificate Authority Browser Forum reduces TLS certificate validity to 398 days. Organizations rush to implement automated renewal processes they should have established earlier.
Current state: NIST is finalizing post-quantum cryptography standards. Migration timelines are tightening, yet organizations are still figuring out where encryption exists in their environments.
Near term: Certificate lifecycles will continue to shrink. Trust models are changing. Without crypto-agility, your team risks service disruptions, failed audits, and emergency remediation cycles.
Control Failures and Missing Elements
The failures here are systemic, not isolated incidents:
Asset inventory breakdown: Many organizations lack accurate inventories of cryptographic assets. Without cataloging, management is impossible, violating asset management controls.
Change management gaps: There's no systematic process to identify affected systems, prioritize updates, or validate changes when cryptographic standards evolve. Dependencies are often discovered during incidents.
Monitoring and measurement failures: There's no ongoing assessment of cryptographic risk exposure, no metrics tracking algorithm deprecation timelines, and no alerts for certificate expiration across distributed systems.
Risk assessment blindness: Cryptographic dependencies aren't evaluated in risk assessments. Teams can't determine which encryption failures would have the greatest business impact because relationships aren't mapped.
Supplier management oversights: Third-party services use encryption you don't control. When they need to migrate cryptographic standards, you're dependent on their timeline and competence. Most organizations can't even list which suppliers handle their encrypted data.
Relevant Standards Requirements
ISO/IEC 27001:2022
Annex A 5.9 (Inventory of information and other associated assets): You must maintain an inventory of assets related to information processing facilities. Cryptographic assets, certificates, keys, encryption implementations, are information assets. If you can't enumerate them, you're not compliant.
Annex A 8.24 (Use of cryptography): Requires rules for effective cryptography use, including key management. It's not just about having encryption; it's about knowing where it's deployed, which algorithms you're using, and having a process to update them as standards evolve.
Annex A 5.22 (Monitoring, review and change management of supplier services): When suppliers control cryptographic implementations, you need processes to monitor their compliance with your security requirements, including their ability to migrate to new standards on acceptable timelines.
SOC 2
CC6.1 (Logical and physical access controls): Logical access security software, infrastructure, and architectures protect information assets from security events. Encryption is a core component. If your strategy can't adapt to changing standards, your access controls will fail.
CC6.6 (Encryption of confidential and sensitive information): Protects confidential and sensitive information during transmission and storage. Auditors will ask: what happens when your current encryption algorithms are deprecated? Do you have a plan? Can you execute it without service disruption?
CC7.1 (Detection of security events): Identifies anomalous conditions. If you're not monitoring certificate expiration, deprecated algorithm usage, or cryptographic implementation drift, you're not detecting conditions that will become security events.
Action Items for Your Team
Start with Cryptographic Asset Discovery
You can't build crypto-agility without knowing what you're working with. Map every certificate, encryption implementation, and key management system. Include:
- TLS certificates across all domains and subdomains
- Code-signing certificates
- API authentication certificates
- Encryption at rest implementations (algorithms, key lengths)
- Hardware security modules and key management services
- Third-party services that encrypt your data
Document ownership for each asset. Who's responsible when it needs updating?
Prioritize Based on Exposure, Not Ease
Don't start with easy migrations. Begin with cryptographic dependencies that pose the greatest risk if they fail. Ask:
- Which encrypted channels protect our most sensitive data?
- Which certificate failures would cause customer-facing service disruptions?
- Which systems would be hardest to update in an emergency?
- Which third-party dependencies do we control least?
This prioritization belongs in your risk register with assigned treatment plans.
Build Crypto-Agility into Your ISMS
Crypto-agility isn't a project. It's a capability. That means:
- Documented procedures for cryptographic standard updates (who decides, who implements, who validates)
- Defined roles for cryptographic risk management
- Regular reviews of algorithm deprecation timelines and organizational readiness
- Automated monitoring for certificate expiration and deprecated algorithm usage
- Supplier requirements that address cryptographic agility in contracts and SLAs
These procedures should reference specific ISO/IEC 27001 controls and map to your SOC 2 trust services criteria.
Prepare for Post-Quantum Migration Now
Post-quantum cryptography isn't speculative anymore. NIST has published standards. The question is when, not if. Your preparation includes:
- Identifying systems that will require quantum-resistant algorithms
- Understanding which vendor products support or will support post-quantum cryptography
- Estimating migration effort and timeline
- Documenting dependencies that could block migration
You don't need to migrate today. You need to know what migration will require.
Test Your Ability to Respond
Run a tabletop exercise: a critical cryptographic standard is deprecated with 90 days notice. Can you:
- Identify all affected systems within one week?
- Assign ownership and prioritize updates within two weeks?
- Execute changes without service disruption?
- Validate successful migration across your environment?
If the answer is no, you've identified your control gaps. Document them as nonconformities and build treatment plans.
Organizations that will struggle aren't those facing new cryptographic standards. They're the ones who built rigid infrastructure and called it secure. Crypto-agility is the difference between controlled updates and emergency remediation.
