The measures referred to in paragraph 1 shall be based on an all-hazards approach that aims to protect network and information systems and the physical environment of those systems from incidents, and shall include measures for maintaining policies and procedures regarding the use of cryptography and, where appropriate, encryption.
The Encryption Key Management System (CKMS) handles, manages, stores, and monitors encryption keys. The management system can be implemented as an automated tool or as a more manual implementation.
The organization must have the means to monitor and report on all encryption materials and their status using an encryption key management system. The cryptographic key management system should be used at least to:
Laptops are protected by full-disk encryption.
When the confidentiality of backups is important, backups are protected by encryption. The need to encrypt backups may become highlighted when backups are stored in a physical location where security policies are unknown.
The organization's personnel are offered a solution to protect unclassified confidential information with encryption when information is transferred outside of physically protected areas via the network. The solution has no known vulnerabilities and, according to the information received from the manufacturer, it supports modern encryption strengths and settings.
The staff's competence in the safe use of the encryption solution has been ensured (for example, instructions, training and supervision).
The data to be transmitted must be protected using cryptographic methods. The protection of the confidentiality and integrity of the data transmitted applies to the internal and external network and to all systems that can transmit data. These include:
The data to be transferred can be protected by physical or logical means.
Storing confidential information on removable media should be avoided. When removable media is used to transfer confidential information, appropriate security is used (e.g., full disk encryption with pre-boot authentication).
Our organization has defined policies for creating, storing, sharing, and deleting encryption keys.
Encryption key lengths and usage practices will be selected in accordance with best general practices by monitoring developments in the industry.
When choosing the encryption methods to be used, take into account e.g. the following points:
The need for the advice of external experts is always considered when determining used cryptographic practices.
In Cyberday, all frameworks’ requirements are mapped into universal tasks, so you achieve multi-framework compliance effortlessly.
.png)
Elevate Your Knowledge with Exclusive Access to Weekly Webinars, Video Courses, Help Articles, and Blogs.
