9.1 For the purpose of Article 21(2), point (h) of Directive (EU) 2022/2555, the relevant entities …

Requirement

For the purpose of Article 21(2), point (h) of Directive (EU) 2022/2555, the relevant entities shall establish, implement and apply a policy and procedures related to cryptography, with a view to ensuring adequate and effective use of cryptography to protect the confidentiality, authenticity and integrity of data in line with the relevant entities’ asset classification and the results of the risk assessment carried out pursuant to point 2.1.

Guidance

• Ensure that the comprehensive policy and procedures related to cryptography are in line with relevant regulations and state-of-the-art standards (83).

Examples of evidence

• Documented policy on cryptography and procedures related to cryptography.

Mapping to standards and frameworks

1. Resumen

1.1 Referencias

• PR.DS-01 The confidentiality, integrity, and availability of data-at-rest are protected
• PR.DS-02 The confidentiality, integrity, and availability of data-in-transit are protected
• ID.IM-01 Improvements are identified from evaluations
• ID.IM-02 Improvements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third parties
• ID.IM-03 Improvements are identified from execution of operational processes, procedures, and activities
• ID.IM-04 Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved

1.2 Requisitos identificados

1.3 Regulaciones relacionadas

2. Requisitos identificados

3. Regulaciones relacionadas

Incidencias vinculadas

• ENISA -