compliance controls are associated with this Policy definition 'Managed disks should use a specific set of disk encryption sets for the customer-managed key encryption' (d461a302-a187-421a-89ac-84acdb4edc04)
| Control Domain |
Control |
Name |
MetadataId |
Category |
Title |
Owner |
Requirements |
Description |
Info |
Policy# |
| CMMC_L2_v1.9.0 |
MP.L2_3.8.6 |
CMMC_L2_v1.9.0_MP.L2_3.8.6 |
Cybersecurity Maturity Model Certification (CMMC) Level 2 v1.9.0 MP.L2 3.8.6 |
Media Protection |
Portable Storage Encryption |
Shared |
Implement cryptographic mechanisms to protect the confidentiality of CUI stored on digital media during transport unless otherwise protected by alternative physical safeguards. |
To ensure that sensitive information remains secure and confidential even if the media is lost, stolen, or intercepted during transit. |
|
9 |
| CMMC_L2_v1.9.0 |
SC.L2_3.13.10 |
CMMC_L2_v1.9.0_SC.L2_3.13.10 |
Cybersecurity Maturity Model Certification (CMMC) Level 2 v1.9.0 SC.L2 3.13.10 |
System and Communications Protection |
Key Management |
Shared |
Establish and manage cryptographic keys for cryptography employed in organizational systems. |
To protect information assets from unauthorized access, manipulation, or disclosure. |
|
14 |
| CMMC_L2_v1.9.0 |
SC.L2_3.13.11 |
CMMC_L2_v1.9.0_SC.L2_3.13.11 |
Cybersecurity Maturity Model Certification (CMMC) Level 2 v1.9.0 SC.L2 3.13.11 |
System and Communications Protection |
CUI Encryption |
Shared |
Employ FIPS validated cryptography when used to protect the confidentiality of CUI. |
To ensure the integrity and effectiveness of cryptographic protections applied to sensitive data. |
|
19 |
| PCI_DSS_v4.0.1 |
3.5.1.1 |
PCI_DSS_v4.0.1_3.5.1.1 |
PCI DSS v4.0.1 3.5.1.1 |
Protect Stored Account Data |
Hashes used to render PAN unreadable (per the first bullet of Requirement 3.5.1) are keyed cryptographic hashes of the entire PAN, with associated key-management processes and procedures in accordance with Requirements 3.6 and 3.7 |
Shared |
n/a |
Examine documentation about the hashing method used to render PAN unreadable, including the vendor, type of system/process, and the encryption algorithms (as applicable) to verify that the hashing method results in keyed cryptographic hashes of the entire PAN, with associated key management processes and procedures. Examine documentation about the key management procedures and processes associated with the keyed cryptographic hashes to verify keys are managed in accordance with Requirements 3.6 and 3.7. Examine data repositories to verify the PAN is rendered unreadable. Examine audit logs, including payment application logs, to verify the PAN is rendered unreadable |
|
19 |
| PCI_DSS_v4.0.1 |
3.5.1.2 |
PCI_DSS_v4.0.1_3.5.1.2 |
PCI DSS v4.0.1 3.5.1.2 |
Protect Stored Account Data |
If disk-level or partition-level encryption (rather than file-, column-, or field-level database encryption) is used to render PAN unreadable, it is implemented only as follows: on removable electronic media OR if used for non-removable electronic media, PAN is also rendered unreadable via another mechanism that meets Requirement 3.5.1 |
Shared |
n/a |
Examine encryption processes to verify that, if disk-level or partition-level encryption is used to render PAN unreadable, it is implemented only as follows: on removable electronic media, OR if used for non-removable electronic media, examine encryption processes used to verify that PAN is also rendered unreadable via another method that meets Requirement 3.5.1. Examine configurations and/or vendor documentation and observe encryption processes to verify the system is configured according to vendor documentation the result is that the disk or the partition is rendered unreadable |
|
9 |
| PCI_DSS_v4.0.1 |
3.6.1 |
PCI_DSS_v4.0.1_3.6.1 |
PCI DSS v4.0.1 3.6.1 |
Protect Stored Account Data |
Procedures are defined and implemented to protect cryptographic keys used to protect stored account data against disclosure and misuse that include: access to keys is restricted to the fewest number of custodians necessary. Key-encrypting keys are at least as strong as the data-encrypting keys they protect. Key-encrypting keys are stored separately from data-encrypting keys. Keys are stored securely in the fewest possible locations and forms |
Shared |
n/a |
Examine documented key-management policies and procedures to verify that processes to protect cryptographic keys used to protect stored account data against disclosure and misuse are defined to include all elements specified in this requirement |
|
16 |
| PCI_DSS_v4.0.1 |
3.6.1.1 |
PCI_DSS_v4.0.1_3.6.1.1 |
PCI DSS v4.0.1 3.6.1.1 |
Protect Stored Account Data |
Additional requirement for service providers only: A documented description of the cryptographic architecture is maintained that includes: details of all algorithms, protocols, and keys used for the protection of stored account data, including key strength and expiry date. Preventing the use of the same cryptographic keys in production and test environments. Description of the key usage for each key. Inventory of any hardware security modules (HSMs), key management systems (KMS), and other secure cryptographic devices (SCDs) used for key management, including type and location of devices, to support meeting Requirement 12.3.4 |
Shared |
n/a |
Additional testing procedure for service provider assessments only: Interview responsible personnel and examine documentation to verify that a document exists to describe the cryptographic architecture that includes all elements specified in this requirement |
|
14 |
| PCI_DSS_v4.0.1 |
3.6.1.3 |
PCI_DSS_v4.0.1_3.6.1.3 |
PCI DSS v4.0.1 3.6.1.3 |
Protect Stored Account Data |
Access to cleartext cryptographic key components is restricted to the fewest number of custodians necessary |
Shared |
n/a |
Examine user access lists to verify that access to cleartext cryptographic key components is restricted to the fewest number of custodians necessary |
|
1 |
| PCI_DSS_v4.0.1 |
3.7.1 |
PCI_DSS_v4.0.1_3.7.1 |
PCI DSS v4.0.1 3.7.1 |
Protect Stored Account Data |
Key-management policies and procedures are implemented to include generation of strong cryptographic keys used to protect stored account data |
Shared |
n/a |
Examine the documented key-management policies and procedures for keys used for protection of stored account data to verify that they define generation of strong cryptographic keys. Observe the method for generating keys to verify that strong keys are generated |
|
16 |
| PCI_DSS_v4.0.1 |
3.7.2 |
PCI_DSS_v4.0.1_3.7.2 |
PCI DSS v4.0.1 3.7.2 |
Protect Stored Account Data |
Key-management policies and procedures are implemented to include secure distribution of cryptographic keys used to protect stored account data |
Shared |
n/a |
Examine the documented key-management policies and procedures for keys used for protection of stored account data to verify that they define secure distribution of cryptographic keys. Observe the method for distributing keys to verify that keys are distributed securely |
|
16 |
| PCI_DSS_v4.0.1 |
3.7.3 |
PCI_DSS_v4.0.1_3.7.3 |
PCI DSS v4.0.1 3.7.3 |
Protect Stored Account Data |
Key-management policies and procedures are implemented to include secure storage of cryptographic keys used to protect stored account data |
Shared |
n/a |
Examine the documented key-management policies and procedures for keys used for protection of stored account data to verify that they define secure storage of cryptographic keys. Observe the method for storing keys to verify that keys are stored securely |
|
14 |
| PCI_DSS_v4.0.1 |
3.7.5 |
PCI_DSS_v4.0.1_3.7.5 |
PCI DSS v4.0.1 3.7.5 |
Protect Stored Account Data |
Key management policies procedures are implemented to include the retirement, replacement, or destruction of keys used to protect stored account data, as deemed necessary when: the key has reached the end of its defined cryptoperiod. The integrity of the key has been weakened, including when personnel with knowledge of a cleartext key component leaves the company, or the role for which the key component was known. The key is suspected of or known to be compromised. Retired or replaced keys are not used for encryption operations |
Shared |
n/a |
Examine the documented key-management policies and procedures for keys used for protection of stored account data and verify that they define retirement, replacement, or destruction of keys in accordance with all elements specified in this requirement. Interview personnel to verify that processes are implemented in accordance with all elements specified in this requirement |
|
14 |
| PCI_DSS_v4.0.1 |
3.7.6 |
PCI_DSS_v4.0.1_3.7.6 |
PCI DSS v4.0.1 3.7.6 |
Protect Stored Account Data |
Where manual cleartext cryptographic key-management operations are performed by personnel, key-management policies and procedures are implemented, including managing these operations using split knowledge and dual control |
Shared |
n/a |
Examine the documented key-management policies and procedures for keys used for protection of stored account data and verify that they define using split knowledge and dual control. Interview personnel and/or observe processes to verify that manual cleartext keys are managed with split knowledge and dual control |
|
16 |
| PCI_DSS_v4.0.1 |
3.7.7 |
PCI_DSS_v4.0.1_3.7.7 |
PCI DSS v4.0.1 3.7.7 |
Protect Stored Account Data |
Key management policies and procedures are implemented to include the prevention of unauthorized substitution of cryptographic keys |
Shared |
n/a |
Examine the documented key-management policies and procedures for keys used for protection of stored account data and verify that they define prevention of unauthorized substitution of cryptographic keys. Interview personnel and/or observe processes to verify that unauthorized substitution of keys is prevented |
|
14 |
| PCI_DSS_v4.0.1 |
3.7.8 |
PCI_DSS_v4.0.1_3.7.8 |
PCI DSS v4.0.1 3.7.8 |
Protect Stored Account Data |
Key management policies and procedures are implemented to include that cryptographic key custodians formally acknowledge (in writing or electronically) that they understand and accept their key-custodian responsibilities |
Shared |
n/a |
Examine the documented key-management policies and procedures for keys used for protection of stored account data and verify that they define acknowledgments for key custodians in accordance with all elements specified in this requirement. Examine documentation or other evidence showing that key custodians have provided acknowledgments in accordance with all elements specified in this requirement |
|
14 |
| PCI_DSS_v4.0.1 |
4.2.1 |
PCI_DSS_v4.0.1_4.2.1 |
PCI DSS v4.0.1 4.2.1 |
Protect Cardholder Data with Strong Cryptography During Transmission Over Open, Public Networks |
Strong cryptography and security protocols are implemented as follows to safeguard PAN during transmission over open, public networks: Only trusted keys and certificates are accepted. Certificates used to safeguard PAN during transmission over open, public networks are confirmed as valid and are not expired or revoked. The protocol in use supports only secure versions or configurations and does not support fallback to, or use of insecure versions, algorithms, key sizes, or implementations. The encryption strength is appropriate for the encryption methodology in use |
Shared |
n/a |
Examine documented policies and procedures and interview personnel to verify processes are defined to include all elements specified in this requirement. Examine system configurations to verify that strong cryptography and security protocols are implemented in accordance with all elements specified in this requirement. Examine cardholder data transmissions to verify that all PAN is encrypted with strong cryptography when it is transmitted over open, public networks. Examine system configurations to verify that keys and/or certificates that cannot be verified as trusted are rejected |
|
19 |
| RBI_ITF_NBFC_v2017 |
3.1.h |
RBI_ITF_NBFC_v2017_3.1.h |
RBI IT Framework 3.1.h |
Information and Cyber Security |
Public Key Infrastructure (PKI)-3.1 |
|
n/a |
The IS Policy must provide for a IS framework with the following basic tenets:
Public Key Infrastructure (PKI) - NBFCs may increase the usage of PKI to ensure confidentiality of data, access control, data integrity, authentication and nonrepudiation. |
link |
31 |
| RMiT_v1.0 |
10.53 |
RMiT_v1.0_10.53 |
RMiT 10.53 |
Cloud Services |
Cloud Services - 10.53 |
Shared |
n/a |
A financial institution must implement appropriate safeguards on customer and counterparty information and proprietary data when using cloud services to protect against unauthorised disclosure and access. This shall include retaining ownership, control and management of all data pertaining to customer and counterparty information, proprietary data and services hosted on the cloud, including the relevant cryptographic keys management. |
link |
14 |
| RMiT_v1.0 |
11.15 |
RMiT_v1.0_11.15 |
RMiT 11.15 |
Data Loss Prevention (DLP) |
Data Loss Prevention (DLP) - 11.15 |
Shared |
n/a |
A financial institution must design internal control procedures and implement appropriate technology in all applications and access points to enforce DLP policies and trigger any policy violations. The technology deployed must cover the following:
(a) data in-use - data being processed by IT resources;
(b) data in-motion - data being transmitted on the network; and
(c) data at-rest - data stored in storage mediums such as servers, backup media and databases. |
link |
14 |