Cryptography policy

Catalog reference

Have an adopted policy on the use of cryptography, put it in writing and apply it demonstrably (art. 13(1)). Set processes and procedures on the use of cryptography, and apply them demonstrably (art. 13(2)). The policy and the processes and procedures work out at least when cryptography is used, which types of encryption are used and how, who in the entity is responsible for implementing cryptography, and who is responsible for key management (art. 13(3)). Exclude this only if the Account is exclusively one of the eleven entity types Implementing Regulation 2024/2690 covers: DNS service providers, top-level domain (TLD) name registries, cloud computing service providers, data centre service providers, content delivery network providers, managed service providers, managed security service providers, online marketplaces, online search engines, social networking service platforms, and trust service providers. An entity that is only partly one of those types keeps both sets.

Narrative — how we satisfy this requirement