Cryptography Policy
Algorithms, keys, certificates and encryption of data at rest and in transit
1. General Principles
The organisation uses cryptography as a primary mechanism for protecting the confidentiality and integrity of data, both at rest and in transit. The decision to apply cryptography is based on data classification (DOC-010) and risk assessment results (DOC-002).
⚠️
Deprecated algorithms – PROHIBITED: MD5, SHA-1 (for signatures), DES, 3DES, RC4, SSLv2, SSLv3, TLS 1.0, TLS 1.1. Their use constitutes a violation of this policy and requires immediate remediation.
2. Approved Algorithms and Key Lengths
| Category | Algorithm | Min. key length | Recommended length | Organisation's policy |
|---|---|---|---|---|
| Symmetric encryption | AES (CBC/GCM) | 128 bit | 256 bit | ▸ [e.g. AES-256-GCM]min. AES-128 |
| Asymmetric encryption (RSA) | RSA | 2048 bit | 4096 bit | ▸ [e.g. RSA-4096]min. RSA-2048 |
| Asymmetric encryption (ECC) | ECDSA / ECDH | 256 bit (P-256) | 384 bit (P-384) | ▸ [e.g. P-384]min. P-256 |
| Hash function | SHA-2 family | SHA-256 | SHA-384 / SHA-512 | ▸ [e.g. SHA-256]min. SHA-256 |
| TLS protocol | TLS | TLS 1.2 | TLS 1.3 | ▸ [e.g. TLS 1.3 preferred, 1.2 fallback]min. TLS 1.2 |
| Key exchange | ECDHE / DHE | ECDHE-256 / DH-2048 | ECDHE-384 | ▸ [e.g. ECDHE]PFS required |
| Disk encryption | AES-XTS | 128 bit | 256 bit | ▸ [e.g. AES-XTS-256]min. AES-128 |
| Password hashing | bcrypt / Argon2 / PBKDF2 | bcrypt cost≥10 / Argon2id | Argon2id (recommended) | ▸ [e.g. bcrypt cost=12]bcrypt cost≥10 |
3. Encryption of Data at Rest
| Data type | Encryption requirement | Method / tool |
|---|---|---|
| Laptops and workstations | REQUIRED – all devices | ▸ [e.g. BitLocker / FileVault / LUKS] |
| Servers with key data | REQUIRED | ▸ [e.g. filesystem-level encryption / LUKS / database TDE] |
| Portable media (USB, external drives) | REQUIRED – confidential and secret data | ▸ [e.g. VeraCrypt / BitLocker To Go] |
| Cloud data | ▸ [Required for confidential+ data]min. for sensitive data | ▸ [e.g. client-side encryption (CSE) / SSE with organisation-managed keys] |
| Databases | ▸ [Required for personal and secret data] | ▸ [e.g. TDE (SQL Server / Oracle) / pg_crypto] |
| Backup copies | REQUIRED – all copies | ▸ [e.g. encryption in backup tool] |
4. Encryption of Data in Transit
| Scenario | Requirement | Configuration |
|---|---|---|
| Browser – web server communication | HTTPS with TLS 1.2+ REQUIRED | ▸ [HSTS enabled, HSTS max-age ≥ 31536000 s]min. TLS 1.2 |
| Internal API connections | ▸ [TLS 1.2+ required]min. TLS 1.2 | ▸ [mTLS for critical services] |
| Database connections | TLS required | ▸ [server certificate verified] |
| ▸ [TLS for SMTP, S/MIME or PGP for confidential data] | ▸ [e.g. STARTTLS / DANE / SMTPS] | |
| VPN | End-to-end encryption required | ▸ [e.g. WireGuard (ChaCha20-Poly1305) / IPsec AES-256] |
| OT/SCADA communications | Encryption required where feasible | ▸ [e.g. TLS or dedicated sector protocols (IEC 62351)] |
5. Certificate Management
| Parameter | Requirement | Organisation's policy |
|---|---|---|
| Maximum public certificate validity | 397 days (CA/Browser Forum requirement) | ▸ [e.g. 365 days]max. 397 days |
| Expiry monitoring | Required | ▸ [alerts 30 and 7 days before expiry]min. 14 days before |
| Certificate Authority (CA) | Publicly trusted or internal CA for internal services | ▸ [e.g. Let's Encrypt / DigiCert / internal Microsoft CA] |
| Certificate register | Required | ▸ [certificate register location] |
| Certificate revocation (CRL/OCSP) | Required for internal CAs | ▸ [e.g. OCSP stapling] |
6. Cryptographic Key Management
- Cryptographic keys are protected against unauthorised access, disclosure and modification.
- Private keys are never transmitted over unencrypted channels.
- Key rotation: symmetric keys every ▸ [1 year]max. 2 years; asymmetric keys every ▸ [2 years]max. 5 years.
- Backup encryption keys stored in a physical safe or HSM.
- Key destruction procedure: secure deletion after expiry or key change – documented in register.
▸ Organisation completes – key management system
KMS (Key Management System): ▸ [e.g. AWS KMS / Azure Key Vault / HashiCorp Vault / Thales HSM]
Cryptographic key register: ▸ [register location]
7. Change History
| Version | Date | Author | Description | Approved by |
|---|---|---|---|---|
| ▸ 1.0 | ▸ DD/MM/YYYY | ▸ | ▸ Initial release | ▸ Board |
DOC-009 Cryptography Policy | v1.0 | NIS2/ISMS