Essential Cybersecurity Controls (ECC – 2 : 2024) - Cryptography; Documentation and Requirements

Essential Cybersecurity Controls (ECC – 2 : 2024) - 2-8-1

Cybersecurity Requirements For Cryptography Must Be Defined, Documented And Approved.

The Cybersecurity Requirements For Cryptography Must Be Implemented.

The cybersecurity requirements for cryptography must include at least the requirements in the National Cryptographic Standards; published by NCA and each national entity is required to choose and implement the appropriate cryptographic standard level based on the nature and sensitivity of the data, systems and networks to be protected, and based on the risk assessment by the entity; and as per related laws and regulations; according to the following:

Approved cryptographic systems and solutions standards and its technical and regulatory limitations.
Secure management of cryptographic keys during their lifecycles.
Encryption of data in-transit, at-rest, and while processing as per classification and related laws and regulations.

The Cybersecurity Requirements For Cryptography Must Be Reviewed Periodically.