--- title: "Cryptographic Agility, Definition | MedTech Terms" description: "The designed-in ability to replace cryptographic primitives over a device's supported lifetime. Plain-English Cybersecurity definition for MedTech teams, with e" lang: en json-ld: | { "@context": "https://schema.org", "@graph": [ { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/crypto-agility#term", "name": "Cryptographic Agility", "description": "Cryptographic agility is the architectural property that lets a system replace its cryptographic primitives - algorithms, key sizes, protocol versions - without redesign. For medical devices fielded for 10–20 years, crypto agility is essential because algorithms (e.g., SHA-1, RSA-1024, TLS 1.0) become deprecated long before the device is retired. NIST's Post-Quantum Cryptography (PQC) program (FIPS 203/204/205, 2024) makes crypto agility newly urgent for any device whose data must remain confidential into the post-quantum era.", "url": "https://medtechterms.com/terms/crypto-agility", "termCode": "crypto-agility", "inDefinedTermSet": { "@type": "DefinedTermSet", "name": "MedTech Terms", "url": "https://medtechterms.com/terms" } }, { "@type": "Article", "@id": "https://medtechterms.com/terms/crypto-agility#article", "headline": "Cryptographic Agility", "description": "The designed-in ability to replace cryptographic primitives over a device's supported lifetime.", "url": "https://medtechterms.com/terms/crypto-agility", "mainEntityOfPage": { "@type": "WebPage", "@id": "https://medtechterms.com/terms/crypto-agility" }, "about": { "@id": "https://medtechterms.com/terms/crypto-agility#term" }, "articleSection": "Cybersecurity", "inLanguage": "en", "keywords": "Cryptographic Agility, Cybersecurity, medical device, MedTech", "author": { "@type": "Person", "name": "Christian Espinosa", "jobTitle": "Founder, Blue Goat Cyber", "url": "https://bluegoatcyber.com" }, "publisher": { "@type": "Organization", "name": "MedTech Terms", "url": "https://medtechterms.com" }, "isPartOf": { "@type": "WebSite", "name": "MedTech Terms", "url": "https://medtechterms.com" }, "datePublished": "2026-05-05", "dateModified": "2026-05-05", "citation": [ { "@type": "CreativeWork", "name": "NIST Post-Quantum Cryptography", "url": "https://csrc.nist.gov/projects/post-quantum-cryptography", "publisher": { "@type": "Organization", "name": "NIST" } }, { "@type": "CreativeWork", "name": "NIST IR 8547 PQC Migration Guidance", "url": "https://csrc.nist.gov/pubs/ir/8547/ipd", "publisher": { "@type": "Organization", "name": "NIST" } }, { "@type": "CreativeWork", "name": "FDA Cybersecurity Guidance (Sept 2023)", "url": "https://www.fda.gov/regulatory-information/search-fda-guidance-documents/cybersecurity-medical-devices-quality-system-considerations-and-content-premarket-submissions", "publisher": { "@type": "Organization", "name": "FDA" } } ], "mentions": [ { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/section-524b#term", "name": "Section 524B of the FD&C Act", "alternateName": "524B", "url": "https://medtechterms.com/terms/section-524b" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/ota-updates#term", "name": "Over-the-Air Updates", "alternateName": "OTA", "url": "https://medtechterms.com/terms/ota-updates" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/premarket-cybersecurity#term", "name": "Premarket Cybersecurity Submission", "url": "https://medtechterms.com/terms/premarket-cybersecurity" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/secure-boot#term", "name": "Secure Boot", "url": "https://medtechterms.com/terms/secure-boot" } ] }, { "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://medtechterms.com/" }, { "@type": "ListItem", "position": 2, "name": "Terms", "item": "https://medtechterms.com/terms" }, { "@type": "ListItem", "position": 3, "name": "Cybersecurity", "item": "https://medtechterms.com/terms?cat=Cybersecurity" }, { "@type": "ListItem", "position": 4, "name": "Cryptographic Agility", "item": "https://medtechterms.com/terms/crypto-agility" } ] }, { "@type": "FAQPage", "@id": "https://medtechterms.com/terms/crypto-agility#faq", "mainEntity": [ { "@type": "Question", "name": "Do we need post-quantum crypto today?", "acceptedAnswer": { "@type": "Answer", "text": "For most current MedTech devices, not yet - but 'harvest now, decrypt later' attacks make data with long confidentiality requirements vulnerable. Crypto agility is the prerequisite to PQC migration when the time comes." } }, { "@type": "Question", "name": "How do we measure crypto agility?", "acceptedAnswer": { "@type": "Answer", "text": "Test it: can you ship an OTA update that changes the TLS version, signature algorithm, and KDF without firmware rebuild? If not, you don't have agility." } } ] } ] } --- [ MedTech Terms The authoritative reference ](/) Browse Learn [Latest](/latest) About 1. [Home](/) 2. / 3. [Terms](/terms) 4. / 5. [Cybersecurity](/terms?cat=Cybersecurity) 6. / 7. Cryptographic Agility [All terms](/terms) Cybersecurity [Connected & Cyber-Physical Devices](/ecosystems/connected-devices) # Cryptographic Agility The designed-in ability to replace cryptographic primitives over a device's supported lifetime. Reviewed by [Christian Espinosa, Founder, Blue Goat Cyber](/authors/christian-espinosa) Last reviewed May 5, 2026 ## Definition Cryptographic agility is the architectural property that lets a system replace its cryptographic primitives - algorithms, key sizes, protocol versions - without redesign. For medical devices fielded for 10–20 years, crypto agility is essential because algorithms (e.g., SHA-1, RSA-1024, TLS 1.0) become deprecated long before the device is retired. NIST's Post-Quantum Cryptography (PQC) program (FIPS 203/204/205, 2024) makes crypto agility newly urgent for any device whose data must remain confidential into the post-quantum era. What the regulation says FDA's 2023 cybersecurity guidance expects manufacturers to plan for cryptographic upgrades over the device's supported lifetime. NIST IR 8547 (2024) provides PQC migration guidance. CISA and the NSA have issued joint advisories pushing federal systems toward PQC by 2035; commercial healthcare follows behind. ## What this means in practice Achieving crypto agility means abstracting algorithms behind interfaces, supporting algorithm negotiation at every protocol layer, planning [OTA](/terms/ota-updates) updates that can deliver new crypto, and budgeting compute headroom for PQC algorithms (which have larger keys/signatures than ECC). Common pitfalls - • Hardcoding cipher suites in firmware that cannot be updated. - • Choosing a hardware crypto accelerator that cannot be augmented with PQC algorithms. - • Treating crypto as 'set and forget' for a 15-year device lifetime. ## Frequently asked questions Do we need post-quantum crypto today? For most current MedTech devices, not yet - but 'harvest now, decrypt later' attacks make data with long confidentiality requirements vulnerable. Crypto agility is the prerequisite to PQC migration when the time comes. How do we measure crypto agility? ## Related terms Grouped by theme ### Editor's picks · Hand-selected related concepts [ Cybersecurity Over-the-Air Updates(OTA) Remote, network-delivered software or firmware updates to a fielded medical device. ](/terms/ota-updates)[ Cybersecurity Premarket Cybersecurity Submission The bundle of cybersecurity artifacts a sponsor includes in a 510(k), De Novo, PMA, or HDE submission for a cyber device. ](/terms/premarket-cybersecurity)[ Cybersecurity Section 524B of the FD&C Act(524B) The federal statute that gives FDA explicit premarket authority over cybersecurity for cyber devices. ](/terms/section-524b)[ Cybersecurity Secure Boot A chain-of-trust mechanism that ensures only cryptographically signed firmware and software can run on a device. ](/terms/secure-boot) ### More in Cybersecurity · Same category [ Cybersecurity AAMI SW96 AAMI/ANSI standard establishing requirements for medical-device cybersecurity activities throughout the lifecycle. ](/terms/aami-sw96)[ Cybersecurity AAMI TIR57 AAMI Technical Information Report providing MedTech-specific guidance on cybersecurity risk management. ](/terms/aami-tir57)[ Cybersecurity AAMI TIR97(TIR97) AAMI Technical Information Report on post-market security risk management for medical device manufacturers, the operational companion to TIR57. ](/terms/aami-tir97)[ Cybersecurity Brainjacking Unauthorized remote control of an implanted neurostimulator (e.g., DBS) to alter stimulation parameters and harm a patient. ](/terms/brainjacking) Cited by Where this term appears across MedTech Terms. Ecosystems (1) - [Connected & Cyber-Physical Devices](/ecosystems/connected-devices) ## Primary references 3 sources Link health: 3 verified · last checked 2026-06-20 NIST· 2 FDA· 1 1. [1 NIST Post-Quantum Cryptography Verified NIST · csrc.nist.gov ](https://csrc.nist.gov/projects/post-quantum-cryptography) 2. [2 NIST IR 8547 PQC Migration Guidance Verified NIST · csrc.nist.gov ](https://csrc.nist.gov/pubs/ir/8547/ipd) 3. [3 FDA Cybersecurity Guidance (Sept 2023) Verified FDA · fda.gov ](https://www.fda.gov/regulatory-information/search-fda-guidance-documents/cybersecurity-medical-devices-quality-system-considerations-and-content-premarket-submissions) Inline markers like \[1\] jump to the matching reference above. Sponsor note ### Working on medical device cybersecurity? Blue Goat Cyber specializes in MedTech cybersecurity - threat modeling, SBOMs, penetration testing, and FDA premarket submissions. [Book a 30-minute discovery session](https://go.bluegoatcyber.com/meetings/blue-goat-cyber/discovery-session) - No obligation - Expert-led from minute one - NDA available on request MedTech Terms is a community resource sponsored by [Blue Goat Cyber](https://bluegoatcyber.com). Definitions are independent of any vendor. On this term Category Cybersecurity Sources 3 Updated 5/5/2026 [Compare with another term](/compare?a=crypto-agility) Learn in 60 seconds Card Lesson Quiz The designed-in ability to replace cryptographic primitives over a device's supported lifetime. - · For medical devices fielded for 10–20 years, crypto agility is essential because algorithms (e.g., SHA-1, RSA-1024, TLS 1.0) become deprecated long before the device is retired. - · NIST's Post-Quantum Cryptography (PQC) program (FIPS 203/204/205, 2024) makes crypto agility newly urgent for any device whose data must remain confidential into the post-quantum era. Remember this Watch out: Hardcoding cipher suites in firmware that cannot be updated. Related terms - [Section 524B of the FD&C Act(524B) ](/terms/section-524b) - [Over-the-Air Updates(OTA) ](/terms/ota-updates) - [Premarket Cybersecurity Submission ](/terms/premarket-cybersecurity) - [Secure Boot ](/terms/secure-boot) You may also need Auto-suggested from Cybersecurity and shared keywords. - [Patchability ](/terms/patchability) - [Algorithm Change Protocol(ACP) ](/terms/algorithm-change-protocol) - [Modular PMA ](/terms/pma-modular) - [Brainjacking ](/terms/brainjacking) - [Hardware Root of Trust(HRoT) ](/terms/hardware-root-of-trust) - [Side-Channel Attack ](/terms/side-channel) [All Cybersecurity terms](/terms?cat=Cybersecurity) From the Blue Goat network Related resources and services on this topic. - [ MedTech Cybersecurity Standards Authoritative reference for the standards and guidances behind medical device cybersecurity. ](https://medtechcyberstandards.com) - [ MedTech Cyber Tips Practical, organized tips for medical device cybersecurity teams. ](https://medtechcybertips.com) - [ MedTech Cybersecurity Crosswalk International crosswalk of medical device cybersecurity requirements across regulators. ](https://mdccrosswalk.com) - [ Code Blue Real medical device cybersecurity incidents and their lessons. ](https://codebluechart.com) MedTech Terms An authoritative, plain-language reference for the regulatory, quality, cybersecurity, and software terms that shape modern medical devices. Browse - [All terms](/terms) - [A–Z index](/a-z) - [Categories](/categories) - [Ecosystems](/ecosystems) - [Learning paths](/paths) - [Compare terms](/compare) - [Quiz](/quiz) Resources - [FDA Medical Devices](https://www.fda.gov/medical-devices) - [EU MDR](https://eur-lex.europa.eu/eli/reg/2017/745/oj) - [IMDRF](https://www.imdrf.org/) - [Methodology](/methodology) - [Changelog](/changelog) - [Editor: Christian Espinosa](/authors/christian-espinosa) - [About this site](/about) © 2026 MedTech Terms. Reference content for educational purposes - not regulatory advice. A community resource sponsored by [Blue Goat Cyber](https://bluegoatcyber.com)