Official websites use .gov
A .gov website belongs to an official government organization in the United States.
Secure .gov websites use HTTPS
A lock (
) or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.
NIST Publishes CSWP 39: Considerations for Achieving Crypto Agility
The final version of Cybersecurity White Paper (CSWP) 39, Considerations for Achieving Crypto Agility: Strategies and Practices, has been published on December 19, 2025.
Cryptographic (crypto) agility refers to the capabilities needed to replace and adapt cryptographic algorithms in protocols, applications, software, hardware, firmware, and infrastructures while preserving security and ongoing operations. The transition to post-quantum cryptography (PQC) has highlighted significant challenges to adapting applications to new algorithms.
This final version of Cybersecurity White Paper (CSWP) 39, Considerations for Achieving Crypto Agility: Strategies and Practices, describes current approaches to operational mechanisms for crypto agility, challenges, trade-offs, and working areas for future consideration. The invaluable comments received on the initial and second public drafts helped improve many aspects of this document. Additionally, stakeholder discussions during the Crypto Agility Workshop in April 2025 helped identify strategies, frameworks, requirements, and metrics for various sectors and environments.
This publication is intended to be a new starting point to pursue crypto agility by developing environment-specific and actionable mechanisms. NIST remains committed to supporting collaboration and continued progress in this space.