capacity for an information security system to adopt an alternative to the original encryption method or cryptographic primitive without significant change to system infrastructure