CRY-01—Policy for the use of encryption procedures and key management
>Control Description
Policies and instructions with technical and organisational safeguards for encryption procedures and key management are documented, communicated and provided according to SP-01, in which the following aspects are described:
• Usage of strong encryption procedures and secure network protocols that correspond to the state-of-the-art;
• Risk-based provisions for the use of encryption which are aligned with the information classification schemes (cf. AM-06) and consider the communication channel, type, strength and quality of the encryption;
• Requirements for the secure generation, storage, archiving, retrieval, distribution, withdrawal and deletion of the keys; and
• Consideration of relevant legal and regulatory obligations and requirements.
Additional criteria: -
Ask AI
Configure your API key to use AI features.