+CON.1.A7 Drawing Up a Security Policy for the Use of Cryptographic Methods and Products (H)

CON.1.A7 Drawing Up a Security Policy for the Use of Cryptographic Methods and Products (H)

Based on its general security policy, an organisation SHOULD draw up a specific policy for the use of crypto products. In this security policy, the person responsible for the secure operation of cryptographic products SHOULD be specified. There SHOULD be deputising rules in connection with the crypto products used.

Necessary training and awareness safeguards SHOULD be defined for users, along with codes of conduct and reporting channels for potential problems or security incidents. Furthermore, the policy SHOULD define the methods used to ensure that crypto modules are configured securely, used properly, and maintained at regular intervals.

The policy SHOULD be known to all the relevant employees and SHOULD be integral to their work. If the policy is changed or deviations prove necessary, this SHOULD be coordinated with the CISO and documented accordingly. There SHOULD be regular checks on whether the policy is still being properly implemented. The results SHOULD be appropriately documented.

1. Pregled

1.1 Reference

1.2 Utvrđeni zahtjevi

1.3 Povezani propisi

2. Utvrđeni zahtjevi

Zahtjevi

3. Povezani propisi

Propisi

Povezani zadaci

Poveznice
blocks G 0.18 Poor Planning or Lack of Adaptation
blocks G 0.19 Disclosure of Sensitive Information
blocks G 0.27 Lack of Resources
blocks G 0.30 Unauthorised Use or Administration of Devices and Systems
blocks G 0.31 Incorrect Use or Administration of Devices and Systems