Requirement
Cybersecurity requirements for cryptography must be defined, documented and approved.
Control Implementation Guidelines
- Develop and document cybersecurity policy for cryptography in the organization, including the following:
- Standard controls of approved cryptography solutions and applicable restrictions (technically and regulatorily)
- Secure management of cryptographic keys during their lifecycle
- Information must be encrypted in transit and storage based on classification as well as the relevant laws and regulations
- Support the organization's policy by the Executive Management. This must be done through the approval of the organization head or his/her deputy
Relevant Cybersecurity Tools
- Cryptography Policy Template
Expected Deliverables
- Cybersecurity policy that covers all the requirements of cryptography in the organization (e.g., electronic copy or official hard copy)
- Formal approval by the head of the organization or his/her deputy on the policy (e.g., via the organization's official e-mail, paper or electronic signature)
