Policy
Encryption and Key Management Policy
Defines mandatory encryption and cryptographic key management requirements. Ensures that confidentiality, integrity, and availability are protected through consistent encryption controls for data at rest, in transit, and in use.
- Type
- Policy
- Version
- 1.9.2
- Date
- 2026-11-06
- Owner
- Chief Information Security Officer
- Approving authority
- Governance Library Maintainer
- Classification
- Public
- Confidentiality
- Public
- Category
- Information Security
- Review frequency
- Annual and upon material threat, framework, or regulatory change
- Licence
- CC BY-SA 4.0
Read the full text on GitHub (opens in a new tab)
Outline
- 1. Purpose
- 2. Scope
- 3. Governance and accountability
- 4. Encryption standards
- 5. Cryptographic key management
- 6. Cryptographic algorithms and hashing
- 7. Cloud and SaaS encryption requirements
- 8. BASC trade-data protection
- 9. AI and data encryption requirements
- 10. Monitoring and compliance
- 11. Exceptions
- 12. Continual improvement
- 13. Framework alignment
Frameworks it maps to
- ISO/IEC 27002:2022
- ISO/IEC 27017:2026
- COBIT 2019
- CSA CCM v4.1
- NIST SP 800-57 Part 1 Rev. 5
- NIST FIPS 197-upd1
- NIST SP 800-38D
- NIST SP 800-131A Rev. 2
- NIST SP 800-208
- PCI DSS v4.0.1
- ETSI EN 304 223 V2.1.1 (2025-12)
- BASC International Security Standard 6.0.2/6.0.3 (2022)
- WCO SAFE Framework (2025 edition)
- ISO 28000:2022
Related documents
- Information Security Policysecurity
- Data Classification and Handling Standardsecurity
- Data Loss Prevention Standardsecurity
- AI Security and Risk Standardai
- Cryptographic Key Operations Proceduresecurity
- Approved Key-Agreement Protocols Registersecurity
Next
All Documents