What it covers. NIST guidance on which cryptographic algorithms and key lengths are acceptable, deprecated or disallowed for protecting information, and on transitions to stronger ones. It covers encryption, digital signatures, hashing, key agreement and random bit generation. A revision in progress also addresses the planned retirement of algorithms vulnerable to quantum computers.
In practice. Applying it well means maintaining an inventory of cryptography in use, comparing it with current guidance and planning migration away from weak algorithms such as SHA-1 for signatures. The same inventory supports the transition to post-quantum cryptography. Evidence includes the cryptographic inventory, migration plans and configuration standards.
Common gaps. Typical gaps are no inventory of where cryptography is used, weak algorithms embedded in legacy systems and no ownership of migration. Certificates and keys issued with older parameters can also remain in use for years.