Establish crypto strategy in the organisation. The strategy should include which cryptographic tools to use, how to manage certificates, how to ensure secure key generation, how to store keys/passwords, backup copying of keys, renewing of keys, and what to do if keys are compromised. Key management should distinguish between long-term keys and session keys, whereby long-term keys should be given additional protection.
The Encryption Key Management System (CKMS) handles, manages, stores, and monitors encryption keys. The management system can be implemented as an automated tool or as a more manual implementation.
The organization must have the means to monitor and report on all encryption materials and their status using an encryption key management system. The cryptographic key management system should be used at least to:
Our organization has defined policies for creating, storing, sharing, and deleting encryption keys.
Encryption key lengths and usage practices will be selected in accordance with best general practices by monitoring developments in the industry.
The organization must ensure that encryption keys are recycled in accordance with the specified encryption cycles. The risks of disclosure and statutory requirements must be taken into account when determining the encryption period.
When recycling encryption keys, the old key must first be used for decryption and then the new key for recryption.
The organization must have the means to generate encryption keys in pre-activated state when the key has been generated but not yet approved for use.
When activating encryption keys, please note the following:
Recovering an encryption key means rebuilding the encryption key using backups or archives.
The organization must have the means to assess the risk of disclosure of the encryption key or encrypted data compared to compromising business continuity if the encryption key is lost.
The organization must have the means to handle compromised encryption keys. Endangered cryptographic keys may be in a state where they are awaiting further investigation to determine the appropriate course of action.
The handling of compromised cryptographic keys shall take into account at least the following:
The immediate revocation of compromised encryption keys should be subject to the organisation's emergency revocation processes.
Organisation should verify that the set of cryptographic controls that apply to the use of data systems comply with relevant agreements, legislation and regulations.
In Cyberday, all frameworks’ requirements are mapped into universal tasks, so you achieve multi-framework compliance effortlessly.
.png)
Elevate Your Knowledge with Exclusive Access to Weekly Webinars, Video Courses, Help Articles, and Blogs.
