9.2 The policy and procedures referred to in point 9.1 shall establish: (a) in accordance with the …

Requirement

The policy and procedures referred to in point 9.1 shall establish: (a) in accordance with the relevant entities’ classification of assets, the type, strength and quality of the cryptographic measures required to protect the relevant entities’ assets, including data at rest and data in transit; (b) based on point (a), the protocols or families of protocols to be adopted, as well as cryptographic algorithms, cipher strength, cryptographic solutions and usage practices to be approved and required for use in the relevant entities, following, where appropriate, a cryptographic agility approach; (c) the relevant entities’ approach to key management, including, where appropriate, methods for the following: (i) generating different keys for cryptographic systems and applications; (ii) issuing and obtaining public key certificates; (iii) distributing keys to intended entities, including how to activate keys when received; (iv) storing keys, including how authorised users obtain access to keys; (v) changing or updating keys, including rules on when and how to change keys; (vi) dealing with compromised keys; (vii) revoking keys including how to withdraw or deactivate keys; (viii) recovering lost or corrupted keys; (ix) backing up or archiving keys; (x) destroying keys; (xi) logging and auditing of key management-related activities; (xii) setting activation and deactivation dates for keys ensuring that the keys can only be used for the specified period of time according to the organization's rules on key management.

Guidance

• Ensure that the policy and procedures cover cryptographic mechanisms, such as digital signatures (84) and hashes (85), to:
  • protect the confidentiality and integrity of data in transit and at rest;
  • detect unauthorized changes to data at rest marked as critical; and
  • ensure secure disposal of the data after its lawful use.
• Set up a mechanism (either manual or automated) for the selection, establishment and management (including updating) of cryptographic keys.
• Apply encryption in sensitive information transfer (e.g. key generation and key management).
• Consider the encryption of electronic media that contain confidential/sensitive information.
• Ensure the confidentiality and integrity of the data with cryptographic mechanisms, when, for example (indicative, non-exhaustive list):
  • sharing information;
  • scanning network traffic;
  • using secure online (e.g. client-side cloud encryption) and offline storage; and
  • removing sensitive data from storage media.
• Maintain availability of information in the event of the loss of cryptographic keys, for example by escrowing encryption keys.
• Produce, control and distribute symmetric and asymmetric cryptographic keys using key management technology and processes.
• Consider automated cryptographic key management mechanisms to:
  • generate keys for different cryptographic systems and different applications;
  • generate and obtaining public key certificates;
  • distribute keys to intended users; and
  • deal with compromised keys.
• Keep logs of cryptographic key management activities to ensure accountability, traceability and support for incident response and audit activities. As a minimum, logging should include key generation or renewal, key transmission and key destruction or revocation.
• Where applicable, key retrieval, archiving and storage activities should also be logged, particularly in environments where manual handling or high-assurance key protection is required.
• Ensure the protection of cryptographic keys against modification and loss.
• Ensure the protection of secret and private keys against unauthorized use and disclosure.
• Ensure the authenticity of public keys.
• Physically protect equipment used to generate, store and archive keys.
• Limit the use of ad hoc cryptographic processes.
• Consider, where appropriate, a cryptographic agility approach (86). Key features of this approach are:
  • flexibility in algorithm selection;
  • modular design of the architecture whereby cryptographic components can be changed or updated independently without affecting the entire system;
  • regular updates and patching;
  • compliance with the legislative frameworks and governance of the use of cryptography within the entity’s networks and information systems;
  • future-proofing by considering quantum cryptographic algorithms.
• Consider evaluating the chosen encryption methods to verify that they meet industry standards for secure methods (87).

Examples of evidence

• Documented policy on cryptography in line with relevant regulations and state-of-the-art standards.
• Documented guidelines for encryption.
• Acceptable encryption algorithms, key lengths, protocols (88) or family of protocols (89) in line with the state of the art.
• Safeguards to protect the secrecy of secret (private) key(s) in place.
• Evidence of the existence of cryptographic mechanisms that support ensuring the confidentiality and integrity of the data at rest and in transit.
• Evidence of the existence of a mechanism (either manual or automated) for the establishment and management of cryptographic keys.
• Evidence of encryption implementation on various systems (e.g. databases, files, communications).
• Access control mechanisms for cryptographic keys and encrypted data.
• Verification that access is restricted to authorized personnel and that actions related to cryptographic keys are logged and monitored.
• Assessments of cryptographic measures for protecting data privacy.
• Evidence of secure key generation.
• Internal or external audit reports focusing on cryptographic measures.
• Evidence that the entity follows cryptographic best practices, including documentation of how new best practices are identified and incorporated.

1. Vue d’ensemble

1.1 Références

1.2 Exigences identifiées

1.3 Réglementations associées

2. Exigences identifiées

3. Réglementations associées

Tickets liés

• ENISA -