Change Control and Configuration Management (CCC)
Level N/A
'Implement a procedure for the management of exceptions, including emergencies, in the change and configuration process. Align the procedure with the requirements of GRC-04: Policy Exception Process.'
Change Control and Configuration Management (CCC)
Level N/A
Define and implement a process to proactively roll back changes to a previous known good state in case of errors or security concerns.
Cryptography Encryption and Key Management (CEK)
Establish, document, approve, communicate, apply, evaluate and maintain policies and procedures for Cryptography, Encryption and Key Management. Review and update the policies and procedures at least annually.
Cryptography Encryption and Key Management (CEK)
Level N/A
Define and implement cryptographic, encryption and key management roles and responsibilities.
Cryptography Encryption and Key Management (CEK)
Level N/A
Provide cryptographic protection to data at-rest and in-transit, using cryptographic libraries certified to approved standards.
Cryptography Encryption and Key Management (CEK)
Level N/A
Use encryption algorithms that are appropriate for data protection, considering the classification of data, associated risks, and usability of the encryption technology.
Cryptography Encryption and Key Management (CEK)
Level N/A
Establish a standard change management procedure, to accommodate changes from internal and external sources, for review, approval, implementation and communication of cryptographic, encryption and key management technology changes.
Cryptography Encryption and Key Management (CEK)
Level N/A
Manage and adopt changes to cryptography-, encryption-, and key management-related systems (including policies and procedures) that fully account for downstream effects of proposed changes, including residual risk, cost, and benefits analysis.
Cryptography Encryption and Key Management (CEK)
Level N/A
Establish and maintain an encryption and key management risk program that includes provisions for risk assessment, risk treatment, risk context, monitoring, and feedback.
Cryptography Encryption and Key Management (CEK)
Level N/A
CSPs must provide the capability for CSCs to manage their own data encryption keys.
