Cryptography policy and key management

Catalog reference

Set and apply a cryptography policy and procedures so that cryptography protects the confidentiality, authenticity and integrity of data in line with the asset classification and your risk assessment. Decide the type, strength and quality of cryptographic measures for data at rest and in transit, the approved protocols, algorithms, key lengths and solutions (with crypto-agility where fitting), and your key management: generating keys, issuing and obtaining certificates, distributing, activating, storing, changing, handling compromised keys, revoking, backing up and archiving, destroying and logging key activity, and activation and deactivation dates. Review the policy and procedures on a schedule against the state of the art. Decide this in only if the Account is one of the eleven entity types Implementing Regulation 2024/2690 covers: DNS service providers, top-level domain (TLD) name registries, cloud computing service providers, data centre service providers, content delivery network providers, managed service providers, managed security service providers, online marketplaces, online search engines, social networking service platforms, and trust service providers.

Narrative — how we satisfy this requirement