Regulation of cryptographic controls

When offering cloud services, the organisation should provide descriptions of the cryptographic controls implemented to the cloud service customer for reviewing compliance with applicable agreements, legislation and regulations.

Organisation should verify that the set of cryptographic controls that apply to the use of data systems comply with relevant agreements, legislation and regulations.

Installing commercially licensed software can cause a breach of the licence terms for the software. Organisation should have a procedure for identifying licensing requirements for before permitting any licensed software to be installed.

Particular attention should be paid to cases where the data system is elastic and scalable and can be run on more systems or processor cores than is permitted by the licence terms.