9. Cryptography

Requirement

For the purpose of Article 21(2), point (h) of Directive (EU) 2022/2555, the relevant entities shall establish, implement and apply a policy and procedures related to cryptography, with a view to ensuring adequate and effective use of cryptography to protect the confidentiality, authenticity and integrity of data in line with the relevant entities’ asset classification and the results of the risk assessment carried out pursuant to point 2.1.

Guidance

• Ensure that the comprehensive policy and procedures related to cryptography are in line with relevant regulations and state-of-the-art standards (83).

Examples of evidence

• Documented policy on cryptography and procedures related to cryptography.

Mapping to standards and frameworks

Requirement

The policy and procedures referred to in point 9.1 shall establish: (a) in accordance with the relevant entities’ classification of assets, the type, strength and quality of the cryptographic measures required to protect the relevant entities’ assets, including data at rest and data in transit; (b) based on point (a), the protocols or families of protocols to be adopted, as well as cryptographic algorithms, cipher strength, cryptographic solutions and usage practices to be approved and required for use in the relevant entities, following, where appropriate, a cryptographic agility approach; (c) the relevant entities’ approach to key management, including, where appropriate, methods for the following: (i) generating different keys for cryptographic systems and applications; (ii) issuing and obtaining public key certificates; (iii) distributing keys to intended entities, including how to activate keys when received; (iv) storing keys, including how authorised users obtain access to keys; (v) changing or updating keys, including rules on when and how to change keys; (vi) dealing with compromised keys; (vii) revoking keys including how to withdraw or deactivate keys; (viii) recovering lost or corrupted keys; (ix) backing up or archiving keys; (x) destroying keys; (xi) logging and auditing of key management-related activities; (xii) setting activation and deactivation dates for keys ensuring that the keys can only be used for the specified period of time according to the organization's rules on key management.

Guidance

• Ensure that the policy and procedures cover cryptographic mechanisms, such as digital signatures (84) and hashes (85), to:
  • protect the confidentiality and integrity of data in transit and at rest;
  • detect unauthorized changes to data at rest marked as critical; and
  • ensure secure disposal of the data after its lawful use.
• Set up a mechanism (either manual or automated) for the selection, establishment and management (including updating) of cryptographic keys.
• Apply encryption in sensitive information transfer (e.g. key generation and key management).
• Consider the encryption of electronic media that contain confidential/sensitive information.
• Ensure the confidentiality and integrity of the data with cryptographic mechanisms, when, for example (indicative, non-exhaustive list):
  • sharing information;
  • scanning network traffic;
  • using secure online (e.g. client-side cloud encryption) and offline storage; and
  • removing sensitive data from storage media.
• Maintain availability of information in the event of the loss of cryptographic keys, for example by escrowing encryption keys.
• Produce, control and distribute symmetric and asymmetric cryptographic keys using key management technology and processes.
• Consider automated cryptographic key management mechanisms to:
  • generate keys for different cryptographic systems and different applications;
  • generate and obtaining public key certificates;
  • distribute keys to intended users; and
  • deal with compromised keys.
• Keep logs of cryptographic key management activities to ensure accountability, traceability and support for incident response and audit activities. As a minimum, logging should include key generation or renewal, key transmission and key destruction or revocation.
• Where applicable, key retrieval, archiving and storage activities should also be logged, particularly in environments where manual handling or high-assurance key protection is required.
• Ensure the protection of cryptographic keys against modification and loss.
• Ensure the protection of secret and private keys against unauthorized use and disclosure.
• Ensure the authenticity of public keys.
• Physically protect equipment used to generate, store and archive keys.
• Limit the use of ad hoc cryptographic processes.
• Consider, where appropriate, a cryptographic agility approach (86). Key features of this approach are:
  • flexibility in algorithm selection;
  • modular design of the architecture whereby cryptographic components can be changed or updated independently without affecting the entire system;
  • regular updates and patching;
  • compliance with the legislative frameworks and governance of the use of cryptography within the entity’s networks and information systems;
  • future-proofing by considering quantum cryptographic algorithms.
• Consider evaluating the chosen encryption methods to verify that they meet industry standards for secure methods (87).

Examples of evidence

• Documented policy on cryptography in line with relevant regulations and state-of-the-art standards.
• Documented guidelines for encryption.
• Acceptable encryption algorithms, key lengths, protocols (88) or family of protocols (89) in line with the state of the art.
• Safeguards to protect the secrecy of secret (private) key(s) in place.
• Evidence of the existence of cryptographic mechanisms that support ensuring the confidentiality and integrity of the data at rest and in transit.
• Evidence of the existence of a mechanism (either manual or automated) for the establishment and management of cryptographic keys.
• Evidence of encryption implementation on various systems (e.g. databases, files, communications).
• Access control mechanisms for cryptographic keys and encrypted data.
• Verification that access is restricted to authorized personnel and that actions related to cryptographic keys are logged and monitored.
• Assessments of cryptographic measures for protecting data privacy.
• Evidence of secure key generation.
• Internal or external audit reports focusing on cryptographic measures.
• Evidence that the entity follows cryptographic best practices, including documentation of how new best practices are identified and incorporated.

Requirement

The relevant entities shall review and, where appropriate, update their policy and procedures at planned intervals, taking into account the state of the art in cryptography.

Guidance

• Ensure the cryptography policy aligns with relevant industry standards and with advancements in the field.
• Review the cryptography policy and procedures a t least annually.
• Maintain a procedure that specifies how reviews of the cryptography policy and procedures are conducted, including responsible personnel and review intervals.
• Ensure that changes to the cryptographic measures are tested before being applied.
• Ensure that changes to the cryptographic measures are communicated to employees.

Examples of evidence

• Logs of changes made to the cryptography policy and procedures
• Test plans and results that demonstrate the implementation and effectiveness of updated cryptographic measures.
• Records of notifications or reminders sent to relevant personnel about upcoming reviews of the cryptography policy and procedures.
• Communication records informing personnel about updates to the cryptography policy following advancements in the field or significant changes.
• Evidence that the entity remains up to date with the latest developments in cryptography (e.g. member of cryptographic bodies or consortia (e.g. Internet Engineering Task Force and cryptographic research groups) and subscriptions to cryptographic journals/feeds, mailing lists or news feeds).

Tips: guidance

• Train employees and make them aware of the use of cryptographic measures in the entity.
• Make sure network and information systems automatically encrypt and secure all portable and removable media.
• Where appropriate, consider implementing a key management system to ensure the secure handling of cryptographic keys.

Tips: examples of evidence

• Records of training programmes related to cryptography for employees.
• Employees aware of the confidentiality and integrity of data, communications and procedures and what they imply for their work.
• Employees handling sensitive information aware of and understanding the cryptography policies and procedures.
• Key management system in place.