Your data outlives your cryptography by decades.
Most sectors cannot say that.
Most sectors cannot say that.
Patient records, clinical trial data and formulation IP stay valuable for thirty years or more. The cryptography protecting them has a published expiry date. That gap is what makes harvest-now-decrypt-later concrete here rather than theoretical.
Retention obligations versus cryptographic viability
Put the two timelines side by side and the prioritization argument makes itself.
In most industries the harvest-now-decrypt-later argument requires a hypothetical. Here it does not. Data encrypted today under RSA-2048 will still be commercially and clinically sensitive when the standards that permit RSA-2048 have expired. Data classification and retention become the primary input to migration sequencing.
Validated systems resist cryptographic change by design
GxP and validated environments are engineered for stability. That is a feature for patient safety and a genuine obstacle for crypto-agility.
Revalidation cost
Changing a cryptographic library inside a validated system can trigger requalification. The cost is not the code change, it is the documentation and testing burden that follows.
Long-lived signed records
Electronic records and signatures under 21 CFR Part 11 must stay verifiable long after they were created. What happens to signature validity when the signing algorithm is disallowed is a question few programmes have answered.
Change control windows
Manufacturing and clinical systems have narrow, scheduled change windows. Cryptographic migration competes with every other change on the same calendar.
Connected medical devices are a cryptographic estate you did not write
Infusion pumps, imaging systems, patient monitors and lab analyzers carry embedded cryptography, ship on vendor firmware cycles, and often cannot be patched on your schedule. Discovery here is a vendor-management problem as much as a technical one.
HIPAA, Part 11, the FDA and MDR: where the proof requests come from
Start where the retention horizon is longest
Pick one data class with a decades-long obligation and map the cryptography protecting it end to end.
