Crypto-Agility as an Organizational Capability: A Conceptual Reframing of Post-Quantum Readiness

The standardization of post-quantum cryptography has shifted the central question of migration from which algorithms to adopt toward whether organizations can change cryptography at all. Prevailing treatments describe crypto-agility as a technical property of protocols and software, an abstraction layer that lets algorithms be swapped; that framing explains part of the problem and understates the rest. Drawing on organizational-capability theory, information-technology governance scholarship, and sociotechnical systems thinking, this paper reframes crypto-agility as a sociotechnical organizational capability: the coordinated capacity of people, process, architecture, and governance to detect cryptographic change, decide on a response, and reconfigure cryptographic mechanisms across the estate while preserving security and operations. The paper specifies the capability construct and its four dimensions and proposes a five-level maturity model that folds the standardization, agility, and hybridization pillars into its indicators. A preliminary application to three organizations that document their migration publicly shows the model can be applied and discriminates among them, while revealing that public evidence under-observes the people and governance dimensions. The model is presented as a theoretically grounded artifact for future validation, not as observed data; implications for governance, procurement, and assurance are developed.