Az Policy Advertizer

Azure_Security_Benchmark_v3.0

DP-5

Azure_Security_Benchmark_v3.0_DP-5

Microsoft cloud security benchmark DP-5

Data Protection

Use customer-managed key option in data at rest encryption when required

Shared

**Security Principle:** If required for regulatory compliance, define the use case and service scope where customer-managed key option is needed. Enable and implement data at rest encryption using customer-managed key in services. **Azure Guidance:** Azure also provides encryption option using keys managed by yourself (customer-managed keys) for certain services. However, using customer-managed key option requires additional operational efforts to manage the key lifecycle. This may include encryption key generation, rotation, revoke and access control, etc. **Implementation and additional context:** Encryption model and key management table: https://docs.microsoft.com/azure/security/fundamentals/encryption-models Services that support encryption using customer-managed key: https://docs.microsoft.com/azure/security/fundamentals/encryption-models#supporting-services How to configure customer managed encryption keys in Azure Storage: https://docs.microsoft.com/azure/storage/common/storage-encryption-keys-portal

n/a

Canada_Federal_PBMM_3-1-2020

CM_3(6)

Canada_Federal_PBMM_3-1-2020_CM_3(6)

Canada Federal PBMM 3-1-2020 CM 3(6)

Configuration Change Control

Configuration Change Control | Cryptography Management

Shared

The organization ensures that cryptographic mechanisms used to provide any cryptographic-based safeguards are under configuration management.

To uphold security and integrity measures.

Canada_Federal_PBMM_3-1-2020

SC_12

Canada_Federal_PBMM_3-1-2020_SC_12

Canada Federal PBMM 3-1-2020 SC 12

Cryptographic Key Establishment and Management

Shared

The organization establishes and manages cryptographic keys for required cryptography employed within the information system in accordance with CSE-approved cryptography.

To enhance overall security posture and compliance with industry best practices.

Canada_Federal_PBMM_3-1-2020

SC_12(1)

Canada_Federal_PBMM_3-1-2020_SC_12(1)

Canada Federal PBMM 3-1-2020 SC 12(1)

Cryptographic Key Establishment and Management

Cryptographic Key Establishment and Management | Availability

Shared

The organization maintains availability of information in the event of the loss of cryptographic keys by users.

To implement backup and recovery mechanisms.

CMMC_2.0_L2

SC.L2-3.13.10

CMMC_2.0_L2_SC.L2-3.13.10

404 not found

n/a

CMMC_L2_v1.9.0

SC.L2_3.13.11

CMMC_L2_v1.9.0_SC.L2_3.13.11

Cybersecurity Maturity Model Certification (CMMC) Level 2 v1.9.0 SC.L2 3.13.11

System and Communications Protection

CUI Encryption

Shared

Employ FIPS validated cryptography when used to protect the confidentiality of CUI.

To ensure the integrity and effectiveness of cryptographic protections applied to sensitive data.

CEK_02

CSA_v4.0.12_CEK_02

CSA Cloud Controls Matrix v4.0.12 CEK 02

Cryptography, Encryption & Key Management

CEK Roles and Responsibilities

Shared

n/a

Define and implement cryptographic, encryption and key management roles and responsibilities.

CEK_03

CSA_v4.0.12_CEK_03

CSA Cloud Controls Matrix v4.0.12 CEK 03

Cryptography, Encryption & Key Management

Data Encryption

Shared

n/a

Provide cryptographic protection to data at-rest and in-transit, using cryptographic libraries certified to approved standards.

CEK_10

CSA_v4.0.12_CEK_10

CSA Cloud Controls Matrix v4.0.12 CEK 10

Cryptography, Encryption & Key Management

Key Generation

Shared

n/a

Generate Cryptographic keys using industry accepted cryptographic libraries specifying the algorithm strength and the random number generator used.

CEK_11

CSA_v4.0.12_CEK_11

CSA Cloud Controls Matrix v4.0.12 CEK 11

Cryptography, Encryption & Key Management

Key Purpose

Shared

n/a

Manage cryptographic secret and private keys that are provisioned for a unique purpose.

CEK_12

CSA_v4.0.12_CEK_12

CSA Cloud Controls Matrix v4.0.12 CEK 12

Cryptography, Encryption & Key Management

Key Rotation

Shared

n/a

Rotate cryptographic keys in accordance with the calculated cryptoperiod, which includes provisions for considering the risk of information disclosure and legal and regulatory requirements.

CEK_15

CSA_v4.0.12_CEK_15

CSA Cloud Controls Matrix v4.0.12 CEK 15

Cryptography, Encryption & Key Management

Key Activation

Shared

n/a

Define, implement and evaluate processes, procedures and technical measures to create keys in a pre-activated state when they have been generated but not authorized for use, which include provisions for legal and regulatory requirements.

CEK_16

CSA_v4.0.12_CEK_16

CSA Cloud Controls Matrix v4.0.12 CEK 16

Cryptography, Encryption & Key Management

Key Suspension

Shared

n/a

Define, implement and evaluate processes, procedures and technical measures to monitor, review and approve key transitions from any state to/from suspension, which include provisions for legal and regulatory requirements.

DSP_07

CSA_v4.0.12_DSP_07

CSA Cloud Controls Matrix v4.0.12 DSP 07

Data Security and Privacy Lifecycle Management

Data Protection by Design and Default

Shared

n/a

Develop systems, products, and business practices based upon a principle of security by design and industry best practices.

DSP_17

CSA_v4.0.12_DSP_17

CSA Cloud Controls Matrix v4.0.12 DSP 17

Data Security and Privacy Lifecycle Management

Sensitive Data Protection

Shared

n/a

Define and implement, processes, procedures and technical measures to protect sensitive data throughout it's lifecycle.

UEM_08

CSA_v4.0.12_UEM_08

CSA Cloud Controls Matrix v4.0.12 UEM 08

Universal Endpoint Management

Storage Encryption

Shared

n/a

Protect information from unauthorized disclosure on managed endpoint devices with storage encryption.

EU_2555_(NIS2)_2022

EU_2555_(NIS2)_2022_21

EU 2022/2555 (NIS2) 2022 21

Cybersecurity risk-management measures

Shared

n/a

Requires essential and important entities to take appropriate measures to manage cybersecurity risks.

193

EU_GDPR_2016_679_Art._24

EU General Data Protection Regulation (GDPR) 2016/679 Art. 24

Chapter 4 - Controller and processor

Responsibility of the controller

Shared

n/a

310

EU_GDPR_2016_679_Art._25

EU General Data Protection Regulation (GDPR) 2016/679 Art. 25

Chapter 4 - Controller and processor

Data protection by design and by default

Shared

n/a

310

EU_GDPR_2016_679_Art._28

EU General Data Protection Regulation (GDPR) 2016/679 Art. 28

Chapter 4 - Controller and processor

Processor

Shared

n/a

310

FBI_Criminal_Justice_Information_Services_v5.9.5_5

EU_GDPR_2016_679_Art._32

EU General Data Protection Regulation (GDPR) 2016/679 Art. 32

Chapter 4 - Controller and processor

Security of processing

Shared

n/a

310

FBI_Criminal_Justice_Information_Services_v5.9.5_5.1

FBI Criminal Justice Information Services (CJIS) v5.9.5 5.1

Policy and Implementation - Systems And Communications Protection

Systems And Communications Protection

Shared

In addition, applications, services, or information systems must have the capability to ensure system integrity through the detection and protection against unauthorized changes to software and information.

Examples of systems and communications safeguards range from boundary and transmission protection to securing an agency's virtualized environment.

110

FedRAMP_High_R4

SC-12

FedRAMP_High_R4_SC-12

FedRAMP High SC-12

System And Communications Protection

Cryptographic Key Establishment And Management

Shared

n/a

The organization establishes and manages cryptographic keys for required cryptography employed within the information system in accordance with [Assignment: organization-defined requirements for key generation, distribution, storage, access, and destruction]. Supplemental Guidance: Cryptographic key management and establishment can be performed using manual procedures or automated mechanisms with supporting manual procedures. Organizations define key management requirements in accordance with applicable federal laws, Executive Orders, directives, regulations, policies, standards, and guidance, specifying appropriate options, levels, and parameters. Organizations manage trust stores to ensure that only approved trust anchors are in such trust stores. This includes certificates with visibility external to organizational information systems and certificates related to the internal operations of systems. Related controls: SC-13, SC-17. References: NIST Special Publications 800-56, 800-57.

FedRAMP_Moderate_R4_SC-12

FedRAMP_Moderate_R4

SC-12

FedRAMP Moderate SC-12

System And Communications Protection

Cryptographic Key Establishment And Management

Shared

n/a

ISO_IEC_27017_2015_10.1.1

HITRUST_CSF_v11.3

06.c

HITRUST_CSF_v11.3_06.c

HITRUST CSF v11.3 06.c

Compliance with Legal Requirements

Prevent loss, destruction and falsification of important records in accordance with statutory, regulatory, contractual, and business requirements.

Shared

1. Guidelines are to be issued and implemented by the organization on the ownership, classification, retention, storage, handling, and disposal of all records and information. 2. Accountings of disclosure as organizational records are to be documented and maintained for a pre-defined period.

Important records shall be protected from loss, destruction, and falsification, in accordance with statutory, regulatory, contractual, and business requirements.

ISO_IEC_27001_2022

7.5.3

ISO_IEC_27001_2022_7.5.3

ISO IEC 27001 2022 7.5.3

Support

Control of documented information

Shared

1. Documented information required by the information security management system and by this document shall be controlled to ensure: a. it is available and suitable for use, where and when it is needed; and b. it is adequately protected (e.g. from loss of confidentiality, improper use, or loss of integrity). 2. For the control of documented information, the organization shall address the following activities, as applicable: a. distribution, access, retrieval and use; b. storage and preservation, including the preservation of legibility; c. control of changes (e.g. version control); and d. retention and disposition.

Specifies that the documented information of external origin, determined by the organization to be necessary for the planning and operation of the information security management system, shall be identified as appropriate, and controlled

ISO_IEC_27017_2015

10.1.1

ISO IEC 27017 2015 10.1.1

Cryptography

Policy on the use of cryptographic controls

Shared

For Cloud Service Customer: The cloud service customer should implement cryptographic controls for its use of cloud services if justified by the risk analysis. The controls should be of sufficient strength to mitigate the identified risks, whether those controls are supplied by the cloud service customer or by the cloud service provider. When the cloud service provider offers cryptography, the cloud service customer should review any information supplied by the cloud service provider to confirm whether the cryptographic capabilities: (i) meet the cloud service customer's policy requirements; (ii) are compatible with any other cryptographic protection used by the cloud service customer; (iii) apply to data at rest and in transit to, from and within the cloud service. For Cloud Service Provider: The cloud service provider should provide information to the cloud service customer regarding the circumstances in which it uses cryptography to protect the information it processes. The cloud service provider should also provide information to the cloud service customer about any capabilities it provides that can assist the cloud service customer in applying its own cryptographic protection.

To ensure proper and effective use of cryptography to protect the confidentiality, authenticity or integrity of information according to business and information security requirements, and taking into consideration legal, statutory, regulatory and contractual requirements related to cryptography.

ISO_IEC_27017_2015

18.1.3

ISO_IEC_27017_2015_18.1.3

ISO IEC 27017 2015 18.1.3

Compliance

Protection of Records

Shared

For Cloud Service Customer: The cloud service customer should request information from the cloud service provider about the protection of records gathered and stored by the cloud service provider that are relevant to the use of cloud services by the cloud service customer. For Cloud Service Provider: The cloud service provider should provide information to the cloud service customer about the protection of records that are gathered and stored by the cloud service provider relating to the use of cloud services by the cloud service customer.

To ensure compliance with legal, statutory, regulatory and contractual requirements, as well as community or societal expectations related to the protection and availability of records.

ISO_IEC_27017_2015

18.1.5

ISO_IEC_27017_2015_18.1.5

ISO IEC 27017 2015 18.1.5

Compliance

Regulation of Cryptographic Controls

Shared

For Cloud Service Customer: The cloud service customer should verify that the set of cryptographic controls that apply to the use of a cloud service comply with relevant agreements, legislation and regulations. For Cloud Service Provider: The cloud service provider should provide descriptions of the cryptographic controls implemented by the cloud service provider to the cloud service customer for reviewing compliance with applicable agreements, legislation and regulations.

To ensure compliance with legal, statutory, regulatory and contractual requirements related to information security.

LGPD_2018_Art.

LGPD_2018_Art._16

Brazilian General Data Protection Law (LGPD) 2018 Art. 16

Termination of Data Processing

Art. 16. Personal data shall be deleted following the termination of their processing

Shared

n/a

Personal data shall be deleted following the termination of their processing, within the scope and technical limits of the activities, but their storage is authorized for the following purposes: (1) compliance with a legal or regulatory obligation by the controller; (2) study by a research entity, ensuring, whenever possible, the anonymization of the personal data; (3) transfer to third parties, provided that the requirements for data processing as provided in this Law are obeyed; or (4) exclusive use of the controller, with access by third parties being prohibited, and provided the data has been anonymized.

New_Zealand_ISM

23.4.9.C.01

New_Zealand_ISM_23.4.9.C.01

23. Public Cloud Security

23.4.9.C.01 Data protection mechanisms

n/a

For each cloud service, agencies MUST ensure that the mechanisms used to protect data meet agency requirements.

NIST_SP_800-171_R2_3

.13.10

NIST_SP_800-171_R2_3.13.10

NIST SP 800-171 R2 3.13.10

System and Communications Protection

Establish and manage cryptographic keys for cryptography employed in organizational systems.

Shared

Microsoft and the customer share responsibilities for implementing this requirement.

Cryptographic key management and establishment can be performed using manual procedures or mechanisms supported by manual procedures. Organizations define key management requirements in accordance with applicable federal laws, Executive Orders, policies, directives, regulations, and standards specifying appropriate options, levels, and parameters. [SP 800-56A] and [SP 800-57-1] provide guidance on cryptographic key management and key establishment.

NIST_SP_800-171_R3_3.13.11

NIST_SP_800-171_R3_3

.13.11

NIST 800-171 R3 3.13.11

System and Communications Protection Control

Cryptographic Protection

Shared

Cryptography is implemented in accordance with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines.

Implement the following types of cryptography when used to protect the confidentiality of CUI: [Assignment: organization-defined types of cryptography].

NIST_SP_800-53_R4

SC-12

NIST_SP_800-53_R4_SC-12

NIST SP 800-53 Rev. 4 SC-12

System And Communications Protection

Cryptographic Key Establishment And Management

Shared

n/a

NIST_SP_800-53_R5.1.1_SC.13

NIST_SP_800-53_R5.1.1

SC.13

NIST SP 800-53 R5.1.1 SC.13

System and Communications Protection

Cryptographic Protection

Shared

a. Determine the [Assignment: organization-defined cryptographic uses]; and b. Implement the following types of cryptography required for each specified cryptographic use: [Assignment: organization-defined types of cryptography for each specified cryptographic use].

Cryptography can be employed to support a variety of security solutions, including the protection of classified information and controlled unclassified information, the provision and implementation of digital signatures, and the enforcement of information separation when authorized individuals have the necessary clearances but lack the necessary formal access approvals. Cryptography can also be used to support random number and hash generation. Generally applicable cryptographic standards include FIPS-validated cryptography and NSA-approved cryptography. For example, organizations that need to protect classified information may specify the use of NSA-approved cryptography. Organizations that need to provision and implement digital signatures may specify the use of FIPS-validated cryptography. Cryptography is implemented in accordance with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines.

NIST_SP_800-53_R5.1.1

SC.28

NIST_SP_800-53_R5.1.1_SC.28

NIST SP 800-53 R5.1.1 SC.28

System and Communications Protection

Protection of Information at Rest

Shared

Protect the [Selection (one or more): confidentiality; integrity] of the following information at rest: [Assignment: organization-defined information at rest].

Information at rest refers to the state of information when it is not in process or in transit and is located on system components. Such components include internal or external hard disk drives, storage area network devices, or databases. However, the focus of protecting information at rest is not on the type of storage device or frequency of access but rather on the state of the information. Information at rest addresses the confidentiality and integrity of information and covers user information and system information. System-related information that requires protection includes configurations or rule sets for firewalls, intrusion detection and prevention systems, filtering routers, and authentication information. Organizations may employ different mechanisms to achieve confidentiality and integrity protections, including the use of cryptographic mechanisms and file share scanning. Integrity protection can be achieved, for example, by implementing write-once-read-many (WORM) technologies. When adequate protection of information at rest cannot otherwise be achieved, organizations may employ other controls, including frequent scanning to identify malicious code at rest and secure offline storage in lieu of online storage.

NIST_SP_800-53_R5

SC-12

NIST_SP_800-53_R5_SC-12

NIST SP 800-53 Rev. 5 SC-12

System and Communications Protection

Cryptographic Key Establishment and Management

Shared

n/a

Establish and manage cryptographic keys when cryptography is employed within the system in accordance with the following key management requirements: [Assignment: organization-defined requirements for key generation, distribution, storage, access, and destruction].

NZ_ISM_v3.5

CR-15

NZ_ISM_v3.5_CR-15

NZISM Security Benchmark CR-15

Cryptography

17.9.25 Contents of KMPs

Customer

n/a

When agencies implement the recommended contents for Key Management Plans (KMPs) they will have a good starting point for the protection of cryptographic systems and their material within their agencies.

NZISM_Security_Benchmark_v1.1

CR-14

NZISM_Security_Benchmark_v1.1_CR-14

NZISM Security Benchmark CR-14

Cryptography

17.9.25 Contents of KMPs

Customer

The list below describes the minimum contents which SHOULD be documented in the KMP: Objectives of the KMP System Description Roles and Administrative responsibilities Accounting Classification Information Security Incidents Key Management Maintenance References

NZISM_Security_Benchmark_v1.1

CR-3

NZISM_Security_Benchmark_v1.1_CR-3

NZISM Security Benchmark CR-3

Cryptography

17.1.46 Reducing storage and physical transfer requirements

Customer

If an agency wishes to use encryption to reduce the storage or physical transfer requirements for IT equipment or media that contains classified information, they SHOULD use: full disk encryption; or partial disk encryption where the access control will only allow writing to the encrypted partition holding the classified information.

When encryption is applied to media or media residing within IT equipment it provides an additional layer of defence. Whilst such measures do not reduce or alter the classification of the information itself, physical storage, handling and transfer requirements may be reduced to those of a lesser classification for the media or equipment (but not the data itself).

17.1.51.C.01.

NZISM_v3.7_17.1.51.C.01.

NZISM v3.7 17.1.51.C.01.

Cryptographic Fundamentals

17.1.51.C.01. - enhace overall security posture.

Shared

n/a

Agencies using cryptographic functionality within a product to protect the confidentiality, authentication, non-repudiation or integrity of information, MUST ensure that the product has completed a cryptographic evaluation recognised by the GCSB.

17.1.52.C.01.

NZISM_v3.7_17.1.52.C.01.

NZISM v3.7 17.1.52.C.01.

Cryptographic Fundamentals

17.1.52.C.01. - enhace overall security posture.

Shared

n/a

Cryptographic products MUST provide a means of data recovery to allow for recovery of data in circumstances where the encryption key is unavailable due to loss, damage or failure.

17.1.52.C.02.

NZISM_v3.7_17.1.52.C.02.

NZISM v3.7 17.1.52.C.02.

Cryptographic Fundamentals

17.1.52.C.02. - enhance data accessibility and integrity.

Shared

n/a

Cryptographic products SHOULD provide a means of data recovery to allow for recovery of data in circumstances where the encryption key is unavailable due to loss, damage or failure.

17.1.53.C.03.

NZISM_v3.7_17.1.53.C.03.

NZISM v3.7 17.1.53.C.03.

Cryptographic Fundamentals

17.1.53.C.03. - ensure compliance with established security standards and enhance the effectiveness of encryption in safeguarding sensitive information.

Shared

n/a

If an agency wishes to use encryption to reduce the storage, handling or physical transfer requirements for IT equipment or media that contains classified information, they MUST use: 1. full disk encryption; or 2. partial disk encryption where the access control will allow writing ONLY to the encrypted partition holding the classified information.

17.1.53.C.04.

NZISM_v3.7_17.1.53.C.04.

NZISM v3.7 17.1.53.C.04.

Cryptographic Fundamentals

17.1.53.C.04. - ensure compliance with established security standards and enhance the effectiveness of encryption in safeguarding sensitive information.

Shared

n/a

If an agency wishes to use encryption to reduce the storage or physical transfer requirements for IT equipment or media that contains classified information, they SHOULD use: 1. full disk encryption; or 2. partial disk encryption where the access control will allow writing ONLY to the encrypted partition holding the classified information.

17.1.54.C.01.

NZISM_v3.7_17.1.54.C.01.

NZISM v3.7 17.1.54.C.01.

Cryptographic Fundamentals

17.1.54.C.01. - ensure compliance with established security standards and enhance the effectiveness of encryption in safeguarding sensitive information.

Shared

n/a

Agencies MUST use an Approved Cryptographic Algorithm to protect NZEO information when at rest on a system.

17.1.55.C.01.

NZISM_v3.7_17.1.55.C.01.

NZISM v3.7 17.1.55.C.01.

Cryptographic Fundamentals

17.1.55.C.01. - ensure compliance with established security standards and enhance the effectiveness of encryption in safeguarding sensitive information.

Shared

n/a

Agencies MUST use HACE if they wish to communicate or pass information over UNCLASSIFIED, insecure or unprotected networks.

17.1.55.C.02.

NZISM_v3.7_17.1.55.C.02.

NZISM v3.7 17.1.55.C.02.

Cryptographic Fundamentals

17.1.55.C.02. - ensure compliance with established security standards and enhance the effectiveness of encryption in safeguarding sensitive information.

Shared

n/a

Information or systems classified RESTRICTED or SENSITIVE MUST be encrypted with an Approved Cryptographic Algorithm and Protocol if information is transmitted or systems are communicating over insecure or unprotected networks, such as the Internet, public networks or non-agency controlled networks.

17.1.55.C.03.

NZISM_v3.7_17.1.55.C.03.

NZISM v3.7 17.1.55.C.03.

Cryptographic Fundamentals

17.1.55.C.03. - ensure compliance with established security standards and enhance the effectiveness of encryption in safeguarding sensitive information.

Shared

n/a

Agencies MUST encrypt aggregated agency data using an approved algorithm and protocol over insecure or unprotected networks such as the Internet, public infrastructure or non-agency controlled networks when the compromise of the aggregated data would present a significant impact to the agency.

17.1.55.C.04.

NZISM_v3.7_17.1.55.C.04.

NZISM v3.7 17.1.55.C.04.

Cryptographic Fundamentals

17.1.55.C.04. - ensure compliance with established security standards and enhance the effectiveness of encryption in safeguarding sensitive information.

Shared

n/a

Agencies SHOULD encrypt agency data using an approved algorithm and protocol if they wish to communicate over insecure or unprotected networks such as the Internet, public networks or non-agency controlled networks.

17.1.56.C.02.

NZISM_v3.7_17.1.56.C.02.

NZISM v3.7 17.1.56.C.02.

Cryptographic Fundamentals

17.1.56.C.02. - ensure compliance with security protocols and best practices.

Shared

n/a

Agencies MUST consult the GCSB for further advice on the powered off status and treatment of specific software, systems and IT equipment.

17.1.57.C.01.

NZISM_v3.7_17.1.57.C.01.

NZISM v3.7 17.1.57.C.01.

Cryptographic Fundamentals

17.1.57.C.01. - ensure compliance with security protocols and best practices.

Shared

n/a

In addition to any encryption already in place for communication mediums, agencies MUST use an Approved Cryptographic Protocol and Algorithm to protect NZEO information when in transit.

17.1.58.C.01.

NZISM_v3.7_17.1.58.C.01.

NZISM v3.7 17.1.58.C.01.

Cryptographic Fundamentals

17.1.58.C.01. - ensure compliance with security protocols and best practices.

Shared

n/a

Agencies SHOULD establish cryptoperiods for all keys and cryptographic implementations in their systems and operations.

17.1.58.C.02.

NZISM_v3.7_17.1.58.C.02.

NZISM v3.7 17.1.58.C.02.

Cryptographic Fundamentals

17.1.58.C.02. - enhance overall cybersecurity posture.

Shared

n/a

Agencies SHOULD use risk assessment techniques and guidance to establish cryptoperiods.

17.1.58.C.03.

NZISM_v3.7_17.1.58.C.03.

NZISM v3.7 17.1.58.C.03.

Cryptographic Fundamentals

17.1.58.C.03. - enhance overall cybersecurity posture.

Shared

n/a

Agencies using HACE MUST consult the GCSB for key management requirements.

NZISM_v3.7_17.10.12.C.01.

17.10.12.C.01.

NZISM v3.7 17.10.12.C.01.

Hardware Security Modules

17.10.12.C.01. - enhance the overall security posture of the systems and the sensitive information they protect.

Shared

n/a

Agencies MUST consider the use of HSMs when undertaking a security risk assessment or designing network and security architectures.

PCI_DSS_v4.0.1

3.5.1.1

PCI_DSS_v4.0.1_3.5.1.1

PCI DSS v4.0.1 3.5.1.1

Protect Stored Account Data

Hashes used to render PAN unreadable (per the first bullet of Requirement 3.5.1) are keyed cryptographic hashes of the entire PAN, with associated key-management processes and procedures in accordance with Requirements 3.6 and 3.7

Shared

n/a

Examine documentation about the hashing method used to render PAN unreadable, including the vendor, type of system/process, and the encryption algorithms (as applicable) to verify that the hashing method results in keyed cryptographic hashes of the entire PAN, with associated key management processes and procedures. Examine documentation about the key management procedures and processes associated with the keyed cryptographic hashes to verify keys are managed in accordance with Requirements 3.6 and 3.7. Examine data repositories to verify the PAN is rendered unreadable. Examine audit logs, including payment application logs, to verify the PAN is rendered unreadable

PCI_DSS_v4.0.1

4.2.1

PCI_DSS_v4.0.1_4.2.1

PCI DSS v4.0.1 4.2.1

Protect Cardholder Data with Strong Cryptography During Transmission Over Open, Public Networks

Strong cryptography and security protocols are implemented as follows to safeguard PAN during transmission over open, public networks: Only trusted keys and certificates are accepted. Certificates used to safeguard PAN during transmission over open, public networks are confirmed as valid and are not expired or revoked. The protocol in use supports only secure versions or configurations and does not support fallback to, or use of insecure versions, algorithms, key sizes, or implementations. The encryption strength is appropriate for the encryption methodology in use

Shared

n/a

Examine documented policies and procedures and interview personnel to verify processes are defined to include all elements specified in this requirement. Examine system configurations to verify that strong cryptography and security protocols are implemented in accordance with all elements specified in this requirement. Examine cardholder data transmissions to verify that all PAN is encrypted with strong cryptography when it is transmitted over open, public networks. Examine system configurations to verify that keys and/or certificates that cannot be verified as trusted are rejected

RBI_CSF_Banks_v2016

13.4

RBI_CSF_Banks_v2016_13.4

Advanced Real-Timethreat Defenceand Management

Advanced Real-Timethreat Defenceand Management-13.4

n/a

Consider implementingsecure web gateways with capability to deep scan network packets including secure (HTTPS, etc.) traffic passing through the web/internet gateway

RBI_CSF_Banks_v2016

21.1

RBI_CSF_Banks_v2016_21.1

Metrics

Metrics-21.1

n/a

Develop a comprehensive set of metrics that provide for prospective and retrospective measures, like key performance indicators and key risk indicators

RBI_ITF_NBFC_v2017

3.1.h

RBI_ITF_NBFC_v2017_3.1.h

RBI IT Framework 3.1.h

Information and Cyber Security

Public Key Infrastructure (PKI)-3.1

n/a

The IS Policy must provide for a IS framework with the following basic tenets: Public Key Infrastructure (PKI) - NBFCs may increase the usage of PKI to ensure confidentiality of data, access control, data integrity, authentication and nonrepudiation.

RMiT_v1.0

10.19

RMiT_v1.0_10.19

RMiT 10.19

Cryptography

Cryptography - 10.19

Shared

n/a

A financial institution must ensure cryptographic controls are based on the effective implementation of suitable cryptographic protocols. The protocols shall include secret and public cryptographic key protocols, both of which shall reflect a high degree of protection to the applicable secret or private cryptographic keys. The selection of such protocols must be based on recognised international standards and tested accordingly. Commensurate with the level of risk, secret cryptographic key and private-cryptographic key storage and encryption/decryption computation must be undertaken in a protected environment, supported by a hardware security module (HSM) or trusted execution environment (TEE).

RMiT_v1.0

10.53

RMiT_v1.0_10.53

RMiT 10.53

Cloud Services

Cloud Services - 10.53

Shared

n/a

A financial institution must implement appropriate safeguards on customer and counterparty information and proprietary data when using cloud services to protect against unauthorised disclosure and access. This shall include retaining ownership, control and management of all data pertaining to customer and counterparty information, proprietary data and services hosted on the cloud, including the relevant cryptographic keys management.

SO.3 - Customer-Managed Keys

.3 - Customer-Managed Keys

404 not found

n/a

SOC_2

CC6.1

SOC_2_CC6.1

SOC 2 Type 2 CC6.1

Logical and Physical Access Controls

Logical access security software, infrastructure, and architectures

Shared

The customer is responsible for implementing this recommendation.

The following points of focus, specifically related to all engagements using the trust services criteria, highlight important characteristics relating to this criterion: • Identifies and Manages the Inventory of Information Assets — The entity identifies, Page 29 TSP Ref. # TRUST SERVICES CRITERIA AND POINTS OF FOCUS inventories, classifies, and manages information assets. • Restricts Logical Access — Logical access to information assets, including hardware, data (at-rest, during processing, or in transmission), software, administrative authorities, mobile devices, output, and offline system components is restricted through the use of access control software and rule sets. • Identifies and Authenticates Users — Persons, infrastructure, and software are identified and authenticated prior to accessing information assets, whether locally or remotely. • Considers Network Segmentation — Network segmentation permits unrelated portions of the entity's information system to be isolated from each other. • Manages Points of Access — Points of access by outside entities and the types of data that flow through the points of access are identified, inventoried, and managed. The types of individuals and systems using each point of access are identified, documented, and managed. • Restricts Access to Information Assets — Combinations of data classification, separate data structures, port restrictions, access protocol restrictions, user identification, and digital certificates are used to establish access-control rules for information assets. • Manages Identification and Authentication — Identification and authentication requirements are established, documented, and managed for individuals and systems accessing entity information, infrastructure, and software. • Manages Credentials for Infrastructure and Software — New internal and external infrastructure and software are registered, authorized, and documented prior to being granted access credentials and implemented on the network or access point. Credentials are removed and access is disabled when access is no longer required or the infrastructure and software are no longer in use. • Uses Encryption to Protect Data — The entity uses encryption to supplement other measures used to protect data at rest, when such protections are deemed appropriate based on assessed risk. • Protects Encryption Keys — Processes are in place to protect encryption keys during generation, storage, use, and destruction

CC2.3

SOC_2023_CC2.3

SOC 2023 CC2.3

Information and Communication

Facilitate effective internal communication.

Shared

n/a

Entity to communicate with external parties regarding matters affecting the functioning of internal control.

218

CC5.3

SOC_2023_CC5.3

SOC 2023 CC5.3

Control Activities

Maintain alignment with organizational objectives and regulatory requirements.

Shared

n/a

Entity deploys control activities through policies that establish what is expected and in procedures that put policies into action by establishing Policies and Procedures to Support Deployment of Management’s Directives, Responsibility and Accountability for Executing Policies and Procedures, perform tasks in a timely manner, taking corrective actions, perform using competent personnel and reassess policies and procedures.

229

CC7.2

SOC_2023_CC7.2

SOC 2023 CC7.2

Systems Operations

Maintain robust security measures and ensure operational resilience.

Shared

n/a

The entity monitors system components and the operation of those components for anomalies that are indicative of malicious acts, natural disasters, and errors affecting the entity's ability to meet its objectives; anomalies are analysed to determine whether they represent security events.

167