An initial evaluation of CAMM was conducted by Julian Hohm as part of his master’s thesis together with a partner company.
Semi-structured interviews were conducted with two inhouse-experts (one Security Officer and one Consultant Systemsoftware Architect) with regard to the comprehensibility of CAMM. Both experts confirmed its comprehensibility and appreciated the sound structure. On the other hand, both assume that CAMM must be brought into use so that more experience can be gained with the model. They assume that especially level 4 requirements may be be extended or modified.
Another evaluation of CAMM was carried out by Leonie Wolf et al. (2026): Wolf, L., Umezulike, S., Öndarö, G., Schinzel, S., Ising, F. (2026). Practical Evaluation of the Crypto-Agility Maturity Model. In: Foundations and Practice of Security. FPS 2025. LNCS, vol 16402. Springer. In their work, they evaluate CAMM against common design principles for maturity models. In addition, they applied it to a simple, fictitious scenario in which an organization hosts an internal website on a standard TLS server, and employees access it with a standard browser. Using this scenario, four researchers independently sorted each CAMM requirement into one of three categories: (1) fulfillable through an organizational decision, (2) outside the organization’s control, or (3) not applicable. They then reconciled their disagreements through discussion.
Wolf et al. found that requirements up to Level 3 (Practiced) were satisfiable in the scenario, but some Level 4 (Sophisticated) requirements were classified as not applicable. They argue that some Level 4 requirements may not be desirable or even applicable to certain use cases. Based on these results, their experience applying CAMM, and the design evaluation, they proposed improvement recommendations for CAMM. We will review the findings together with Leonie Wolf et al. and incorporate them into a CAMM model update.
We want to hear about your experiences using CAMM in practice.
Updated: 13.07.2026