9.3 The relevant entities shall review and, where appropriate, update their policy and procedures at …

Requirement

The relevant entities shall review and, where appropriate, update their policy and procedures at planned intervals, taking into account the state of the art in cryptography.

Guidance

• Ensure the cryptography policy aligns with relevant industry standards and with advancements in the field.
• Review the cryptography policy and procedures a t least annually.
• Maintain a procedure that specifies how reviews of the cryptography policy and procedures are conducted, including responsible personnel and review intervals.
• Ensure that changes to the cryptographic measures are tested before being applied.
• Ensure that changes to the cryptographic measures are communicated to employees.

Examples of evidence

• Logs of changes made to the cryptography policy and procedures
• Test plans and results that demonstrate the implementation and effectiveness of updated cryptographic measures.
• Records of notifications or reminders sent to relevant personnel about upcoming reviews of the cryptography policy and procedures.
• Communication records informing personnel about updates to the cryptography policy following advancements in the field or significant changes.
• Evidence that the entity remains up to date with the latest developments in cryptography (e.g. member of cryptographic bodies or consortia (e.g. Internet Engineering Task Force and cryptographic research groups) and subscriptions to cryptographic journals/feeds, mailing lists or news feeds).

Tips: guidance

• Train employees and make them aware of the use of cryptographic measures in the entity.
• Make sure network and information systems automatically encrypt and secure all portable and removable media.
• Where appropriate, consider implementing a key management system to ensure the secure handling of cryptographic keys.

Tips: examples of evidence

• Records of training programmes related to cryptography for employees.
• Employees aware of the confidentiality and integrity of data, communications and procedures and what they imply for their work.
• Employees handling sensitive information aware of and understanding the cryptography policies and procedures.
• Key management system in place.

1. Преглед

1.1 Препратки

1.2 Идентифицирани изисквания

1.3 Свързани регулации

2. Идентифицирани изисквания

3. Свързани регулации

Свързани задачи

• ENISA -