Cryptography and Key Management Policy
Defines when Your Organization must encrypt data in transit and at rest, which algorithms and protocols are acceptable, and how cryptographic keys and certificates are generated, stored, rotated, and retired.
Maps to ISO/IEC 27001:2022 A.8.24 · FedRAMP Moderate SC-8 · FedRAMP Moderate SC-12 · FedRAMP Moderate SC-13 · FedRAMP Moderate SC-28 · CMMC Level 2 SC.L2-3.13.8 · CMMC Level 2 SC.L2-3.13.10 · CMMC Level 2 SC.L2-3.13.11 · CMMC Level 2 SC.L2-3.13.16 · NIST SP 800-171 Revision 3 03.13.08 · NIST SP 800-171 Revision 3 03.13.10 · NIST SP 800-171 Revision 3 03.13.11
Read it now — the PDF opens either way.
Purpose
Cryptography protects the confidentiality and integrity of information that Your Organization holds and transmits. Weak algorithms, poorly protected keys, and expired certificates are common causes of avoidable exposure. This policy sets the minimum cryptographic protections and the way keys are managed across their life.
Scope
This policy applies to all Your Organization systems, applications, endpoints, backups, and third-party services that store, process, or transmit Your Organization or customer data, and to every cryptographic key, secret, and certificate used to protect them. It applies to workforce members and to vendors acting on behalf of Your Organization.
6 more sections in the full template
Roles and responsibilities · Requirements · Exceptions · Enforcement · Evidence · Review cadence. Download the full document above, or open it in CMDash to fill in your organization name and effective date automatically.
Use this policy for real, not just on paper
“Open in CMDash” pre-selects the Cryptography and Key Management Policy template the first time you create a policy — your organization name and today’s date fill in automatically, and it lands as a DRAFT you can edit before publishing.