+9.1 For the purpose of Article 21(2), point (h) of Directive (EU) 2022/2555, the relevant entities …
|
9.1 For the purpose of Article 21(2), point (h) of Directive (EU) 2022/2555, the relevant entities …
RequirementFor the purpose of Article 21(2), point (h) of Directive (EU) 2022/2555, the relevant entities shall establish, implement and apply a policy and procedures related to cryptography, with a view to ensuring adequate and effective use of cryptography to protect the confidentiality, authenticity and integrity of data in line with the relevant entities’ asset classification and the results of the risk assessment carried out pursuant to point 2.1. Guidance- Ensure that the comprehensive policy and procedures related to cryptography are in line with relevant regulations and state-of-the-art standards (83).
Examples of evidence- Documented policy on cryptography and procedures related to cryptography.
Mapping to standards and frameworks| ISO standard 27001:2022 | A.5.31, A.8.24 | | NIST Cybersecurity Framework v2.0 | PR.DS-01, PR.DS-02, ID.IM-01, ID.IM-02, ID.IM-03, ID.IM-04 | | ETSI Standard EN 319 401 V3.1.1 | Clause 7.5, ref. to clause 8.24 of ISO/IEC 27002:2022 | | CEN/TS 18026:2024 | ISP-02, CKM-01, CKM-02, CKM-03, CKM-04 | | BE-CyFun®2023 | IMPORTANT: PR.DS-6.1
ESSENTIAL: PR.AC-3.4, PR.DS-8.1 | | FI-Kybermittari | ARCHITECTURE-5 | | EL- Ministerial decision 1689/2025 | Ministerial decision 1689/2025: articles 22a, 22b, 22c, 22d, 22e
Cybersecurity Handbook: Part B: 5.5, 6.22, 9.10, 9.16, 11.1, 11.2, 11.3, 11.4, 11.5, 11.6, 11.7, 11.8
Self-assessment tool: 6.7, 10.7, 12.1, 12.2, 12.3, 12.4, 12.5, 12.6, 12.7 | | ENS-Royal Decree 311/2022 | Article 10, Article 27
Annex II: [op.exp.10] Cryptographic key protection, [mp.si.2]. Cryptography | | FR | 2.B.4-IE/EE
8.1-IE/EE
8.2-IE/EE
8.3-IE/EE
8.4-EE
8.5-EE
19.10-EE
19.11-EE
19.12-EE |
1. Visão geral
1.1 Referências
- PR.DS-01 The confidentiality, integrity, and availability of data-at-rest are protected
- PR.DS-02 The confidentiality, integrity, and availability of data-in-transit are protected
- ID.IM-01 Improvements are identified from evaluations
- ID.IM-02 Improvements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third parties
- ID.IM-03 Improvements are identified from execution of operational processes, procedures, and activities
- ID.IM-04 Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved
1.2 Requisitos identificados
1.3 Regulamentos relacionados
2. Requisitos identificados
Requisitos
| Fonte |
Requisito |
3. Regulamentos relacionados
Regulamentos
| Fonte |
Regulamentação |
Pedidos ligados
- ENISA -
EN: Publications of the European Union Agency for Cybersecurity (ENISA), https://www.enisa.europa.eu/. © European Union Agency for Cybersecurity (ENISA). Unless otherwise noted, licensed under CC BY 4.0. Changes: divided into sections, converted into the GRCA format and linked to the EU legal acts they refer to; images and material of third parties are not reproduced. Only the versions published by ENISA are authoritative.
DE: Veröffentlichungen der Agentur der Europäischen Union für Cybersicherheit (ENISA), https://www.enisa.europa.eu/. © European Union Agency for Cybersecurity (ENISA). Soweit nicht anders vermerkt, lizenziert unter CC BY 4.0. Änderungen: in Abschnitte aufgeteilt, in das GRCA-Format umgewandelt und mit den EU-Rechtsakten verknüpft, auf die sie sich beziehen; Bilder und Material Dritter werden nicht wiedergegeben. Maßgeblich sind allein die von der ENISA veröffentlichten Fassungen.
|