Crypto agility starts with inventory

You cannot change what you cannot find.

The first task in any cryptographic migration is discovering where cryptography is used at all: which libraries, which protocols, which certificates, which hardcoded assumptions about key length. Most organisations have never produced that list, which is why migration timelines are consistently underestimated.