9.2: Cryptographic measures, protocols, and key management requirements

The policy and procedures referred to in point 9.1 shall establish:

1. in accordance with the relevant entities’ classification of assets, the type, strength and quality of the cryptographic measures required to protect the relevant entities’ assets, including data at rest and data in transit;
2. based on point (a), the protocols or families of protocols to be adopted, as well as cryptographic algorithms, cipher strength, cryptographic solutions and usage practices to be approved and required for use in the relevant entities, following, where appropriate, a cryptographic agility approach;
3. the relevant entities’ approach to key management, including, where appropriate, methods for the following:
   • generating different keys for cryptographic systems and applications;
   • issuing and obtaining public key certificates;
   • distributing keys to intended entities, including how to activate keys when received;
   • storing keys, including how authorised users obtain access to keys;
   • changing or updating keys, including rules on when and how to change keys;
   • dealing with compromised keys;
   • revoking keys including how to withdraw or deactivate keys;
   • recovering lost or corrupted keys;
   • backing up or archiving keys;
   • destroying keys;
   • logging and auditing of key management-related activities;
   • setting activation and deactivation dates for keys ensuring that the keys can only be used for the specified period of time according to the organization's rules on key management.