65 lines
2.3 KiB
Markdown
65 lines
2.3 KiB
Markdown
Title: Cryptography and Key Management Policy
|
|
Document ID: [POL-CRYPTO-001]
|
|
Version: 0.1 Draft
|
|
Status: Draft
|
|
Owner: CISO (Paul Jenkins)
|
|
Approver: CEO (Paul Hague)
|
|
Classification: Internal
|
|
Effective date: [DD Month YYYY]
|
|
Review date: [DD Month YYYY]
|
|
|
|
# Cryptography and Key Management Policy
|
|
|
|
## Purpose
|
|
|
|
This policy defines BlackDice's expectations for the use of cryptographic controls and the secure management of keys, secrets, and certificates.
|
|
|
|
## Scope
|
|
|
|
This policy applies to cryptographic protections used for data at rest, data in transit, identity material, secrets, certificates, and platform integrations within the ISMS scope.
|
|
|
|
## Objectives
|
|
|
|
- protect sensitive information using appropriate cryptographic controls
|
|
- reduce the risk of compromise through weak or poorly managed keys and secrets
|
|
- support secure cloud-native and software delivery operations
|
|
|
|
## Principles / Policy Statements
|
|
|
|
Cryptographic controls must be selected based on business need, risk, and applicable legal or contractual requirements.
|
|
|
|
Sensitive information in transit must be protected using approved secure protocols.
|
|
|
|
Secrets, keys, tokens, and certificates must be generated, stored, rotated, distributed, and revoked using controlled processes.
|
|
|
|
Hard-coded secrets in source code, CI/CD pipelines, container images, or infrastructure definitions must be prohibited unless explicitly justified and approved.
|
|
|
|
Access to key and secret management functions must be limited to authorised personnel and systems.
|
|
|
|
## Roles and Responsibilities
|
|
|
|
- [Role] must define approved cryptographic requirements.
|
|
- System owners must ensure their services use appropriate protections.
|
|
- Engineering and operations teams must manage secrets and certificates through approved methods.
|
|
|
|
## Compliance / Exceptions
|
|
|
|
Any deviation from approved cryptographic or key management practice must be documented and approved as an exception.
|
|
|
|
## Monitoring and Review
|
|
|
|
This policy should be reviewed alongside secrets management, certificate issues, incident findings, and control assurance activity.
|
|
|
|
## Related Documents
|
|
|
|
- Information Security Policy
|
|
- Secrets Management Standard
|
|
- Secure Configuration Standard
|
|
- Secure Development Policy
|
|
|
|
## Version Control
|
|
|
|
| Version | Date | Description of Change | Author |
|
|
| --- | --- | --- | --- |
|
|
| 0.1 Draft | [DD Month YYYY] | Initial draft. | [Name or Role] |
|