up:: The Human & Organizational Side MOC
The Crypto Center of Excellence
A crypto center of excellence (CoE) is a central, standing team that owns an organization’s cryptographic standards, its crypto-agility posture, and its migration program, so that the cryptography scattered across every application, network, and vendor product finally has one place responsible for it. It’s the durable answer to the ownership vacuum that stalls post-quantum migrations: instead of cryptography sitting in the seams between engineering, security, procurement, and governance where each assumes another one holds it, the CoE is the function that holds it on purpose. The post-quantum transition is what usually forces an organization to stand one up, and the reason it survives the transition is that the next algorithm change is coming too.
The short version:
- A crypto CoE gives cryptography a permanent owner: one team that sets the standards, keeps the estate agile, and runs the migration, instead of a task force that disbands the moment the current project ends.
- It solves the structural problem that cryptography is genuinely cross-cutting, so no single existing team’s boundary contains it and it falls into the gap between them, the same gap Cryptographic Ownership describes.
- Its remit is standards and agility and program leadership, not doing every cryptographic implementation itself. It sets the policy the rest of the organization builds to and coordinates the teams that hold the levers.
- It’s the operating model that makes the governance layer real: a named home for the risk register, the vendor pressure, the inventory, and the rollout cadence.
- It earns its permanence because crypto-agility is a continuous discipline, not a one-time migration. The team that runs this transition is the team that runs the next one cheaply.
Think of it like a building’s central engineering office rather than a one-off renovation crew. A renovation crew arrives, replaces the plumbing, and leaves, and 5 years later nobody remembers who to call when the next system needs work. A central engineering office holds the drawings, sets the standard every contractor builds to, decides which upgrade happens when, and is still there for the next project. The crypto CoE is that office for an organization’s cryptography, and the point of it is that the office outlasts any single job.
Why does cryptography need a central team?
Because cryptography is the rare capability that touches everything and belongs to no one, so the only structure that fits it is one built to span the boundaries. It lives in applications, infrastructure, networks, identity systems, vendor products, and firmware at once, which means no existing team’s mandate naturally contains the whole of it. Engineering owns implementations but not vendor contracts or the budget, security owns the risk but usually not the engineers, procurement holds the renewal leverage but doesn’t assess cryptographic risk, and governance owns the deadline but does none of the work. Cryptography falls between all of them, and diffuse responsibility behaves exactly like a vacuum.
A crypto CoE resolves that by being the function whose whole job is the cross-cutting layer. It doesn’t replace those teams. It coordinates them and sets the standard they build to, so that a decision about an algorithm, a key length, or a migration sequence has one owner instead of five partial ones. This is the same accountability problem Cryptographic Ownership frames, expressed as an operating model: ownership answers who is accountable, and the CoE answers what standing structure carries that accountability day to day. Without the structure, the accountability is a name on an org chart with no team behind it.
What does a crypto CoE actually do?
Its remit is to own the standards and the program, not to become the sole implementer of every cryptographic operation in the company. The distinction matters, because a CoE that tries to do all the cryptography itself becomes a bottleneck, while one that sets the standard and coordinates the doers scales across the whole estate. The core responsibilities:
| Responsibility | What it means in practice |
|---|---|
| Cryptographic standards | Define the approved algorithms, key lengths, and protocols, and the policy every team builds to, the substance of a cryptography policy |
| Crypto-agility | Set and maintain the architectural requirement that algorithms change by configuration, so the next swap is a setting rather than a rebuild, per Crypto-Agility |
| The inventory | Own the cryptographic bill of materials as a living artifact and the discovery process that keeps it current |
| The migration program | Run the post-quantum migration as a governed, multi-year program with a cadence and a queue |
| Vendor engagement | Drive the roadmap questions and procurement requirements that move vendor-controlled surfaces |
| Advisory and enablement | Advise product teams, review designs, and raise the cryptographic skill across the organization so agility is a shared capability |
The through-line is that the CoE owns the what and the whether-it-moves, and it enables the many teams that own the how in their own systems. It’s the home for the standards, the inventory, the risk register, and the program cadence, and it’s the standing counterpart to the accountable executive owner and the cross-functional working group.
When does a crypto CoE earn its place?
When the cryptographic surface is large and volatile enough that a one-time task force leaves the organization exposed the moment it disbands, which is most large organizations facing the post-quantum transition. A small organization with a contained estate may govern its cryptography through a working group and a policy without a dedicated standing team. A large one with cryptography spread across hundreds of applications, dozens of vendors, and long-lived firmware needs a permanent function, because the work doesn’t end when the migration does.
That permanence is the argument for the CoE over the task force. A task force is scoped to finish the post-quantum migration and dissolve, and the day it dissolves the ownership vacuum reopens: nobody keeps the inventory current, nobody watches for the next algorithm break, nobody holds vendors to their roadmaps. A CoE is scoped to the ongoing reality that crypto-agility is a continuous discipline. The estate keeps changing, new systems keep arriving, algorithms keep aging, and mandates keep evolving, so the function that manages all of that has to be standing rather than temporary. The organization that builds a CoE to run this migration is buying the capability to run every migration after it at a fraction of the cost.
How does a CoE relate to ownership and governance?
They’re three layers of the same answer to the ownership vacuum, and they fit together. Cryptographic Ownership names the accountable executive and the responsibility map, which is the who. Governance is the how a technical finding becomes a funded program with a cadence, the layer where the risk register, the board mandate, and the scoreboard live. The crypto CoE is the standing team that carries both day to day, the operating structure that turns a named owner and a governance framework into a function with staff, a remit, and a permanent seat.
Put plainly: the executive owner is accountable, the governance layer decides and funds, and the CoE executes and sustains. An organization can have the first two on paper and still stall, because a name and a framework with no standing team behind them can’t keep an inventory current or hold a multi-year queue moving. The CoE is what keeps the governance from being a document and the ownership from being a title. It’s the difference between deciding cryptography matters and running it as if it does.
Common misconceptions
- “A crypto CoE does all the cryptography itself.” It sets the standards, owns the program, and coordinates the teams that implement in their own systems. A CoE that becomes the sole implementer is a bottleneck; the point is to make cryptographic capability distributed and governed, not centralized into one team’s queue.
- “A migration task force is the same thing.” A task force disbands when the project ends, and the ownership vacuum reopens. A CoE is a standing function scoped to the continuous discipline of agility, so it survives the migration and runs the next one too.
- “We already have a crypto team, so we have a CoE.” A handful of implementers buried in engineering is capacity, not a center of excellence. A CoE holds cross-functional authority over standards, the inventory, vendor pressure, and the program, with a mandate that reaches beyond writing code.
- “Only huge organizations need one.” Large, volatile estates need the standing structure most, but the underlying function (owned standards, a living inventory, a governed program) is needed at every scale. A smaller organization may deliver it through a working group and a policy rather than a dedicated team, but the responsibilities don’t disappear.
- “The CoE replaces the CISO’s ownership.” It carries the ownership, it doesn’t replace the accountable executive. The named owner stays answerable for the outcome; the CoE is the standing team that makes the outcome achievable.
Questions people ask
What is a crypto center of excellence? A central, standing team that owns an organization’s cryptographic standards, its crypto-agility, and its migration program, giving the cross-cutting responsibility for cryptography one permanent home instead of leaving it in the gap between engineering, security, procurement, and governance.
How is a CoE different from just having a crypto team? A crypto team is usually implementation capacity. A CoE holds cross-functional authority over the standards every team builds to, the living inventory, the vendor pressure, and the multi-year program, with a mandate to coordinate rather than only to build.
Does a CoE do the cryptography, or set the rules? Mostly the rules and the program. It defines the approved algorithms and the agility requirement, owns the inventory and the migration cadence, and advises the product teams that implement in their own systems. Centralizing every operation would make it a bottleneck.
When should we stand one up? When the cryptographic estate is large and volatile enough that a temporary task force would leave you exposed the moment it disbands. The post-quantum transition is the usual trigger, and the reason to make it permanent is that crypto-agility is a continuous discipline, not a one-time project.
How does a CoE relate to naming an accountable owner? They’re complementary. Ownership names the accountable executive; the CoE is the standing team that carries that accountability day to day. The owner is answerable, the CoE executes and sustains, and together they keep the governance from being just a document.
Won’t a central team slow down product teams? Not when it’s built as standards-and-enablement rather than a gate every change has to queue behind. A good CoE makes product teams faster by giving them approved patterns, a crypto-agile foundation, and design review, so cryptographic decisions stop being reinvented and re-litigated in every project.
Everything here is the map, given freely. When your team needs a crypto center of excellence designed and stood up to carry the transition and everything after it, that’s the work I do, and there’s an alignment briefing for it.
Last verified 2026-07-12 · Maintained by Addie LaMarr, LaMarr Labs.