Scope Enterprise Active

Cryptography & Key Management

To manage the use of encryption and cryptographic keys to protect data.

Domain ID
DOM-009
Domain Code
CRY
Business Owner
Security Team

Domain Overview

CRY · Full Domain Profile
Short Overview

Establishes the processes for managing cryptographic controls, encryption technologies, and cryptographic keys to protect data at rest, in transit, and in use.

Description

Focuses on the secure lifecycle management of encryption keys and the proper use of cryptographic solutions to protect data at rest and in transit.

Why This Domain Matters

The move to quantum computing threatens current cryptographic standards, requiring organizations to prepare for cryptographic agility and post-quantum migration.

Business Objectives

    Business Risks

      Common Challenges

        Key Capabilities

        Stakeholders, Industries & Technologies

        CRY · Operating Context

        Typical Stakeholders

        Applicable Industries

        Applicable Technologies

        Keywords & Tags

        Associated Controls Catalog

        5 Active Controls in Domain
        Control ID Control Name Category & Type Criticality Status Requirements Action
        CRY-001 Cryptographic Governance Establishes enterprise cryptographic gov...
        Technical
        Detective
        		 Critical Active 📋 10 Reqs View →
        CRY-002 Data-at-Rest Encryption Establishes encryption controls for data...
        Technical
        Detective
        		 Critical Active 📋 10 Reqs View →
        CRY-003 Data-in-Transit Encryption Establishes encryption for data in trans...
        Technical
        Detective
        		 Critical Active 📋 10 Reqs View →
        CRY-004 Cryptographic Key Management Establishes comprehensive cryptographic...
        Technical
        Corrective
        		 Critical Active 📋 10 Reqs View →
        CRY-005 Digital Certificate Management Establishes comprehensive digital certif...
        Technical
        Detective
        		 High Active 📋 10 Reqs View →

        Compliance Requirements & Audit Crosswalk

        50 Specific Audit Clauses

        The following requirements dictate specific audit evidence criteria and testing steps mapped directly under the controls of this domain.

        REQUIREMENT ID REQUIREMENT TITLE & DETAILS MAPPED CONTROL TYPICAL OWNER ACTION
        CRY-001-R001 Cryptographic Governance Framework The organization shall establish a crypt... CRY-001 Cryptographic Governance CISO / Cryptography Governance Owner View ↗
        CRY-001-R002 Cryptographic Policy The organization shall establish a crypt... CRY-001 Cryptographic Governance CISO / Security Policy Owner View ↗
        CRY-001-R003 Approved Cryptographic Standards The organization shall define and mainta... CRY-001 Cryptographic Governance Cryptography Engineering / Security Architecture View ↗
        CRY-001-R004 Roles & Responsibilities The organization shall clearly define an... CRY-001 Cryptographic Governance CISO / Cryptography Governance Owner View ↗
        CRY-001-R005 Cryptographic Risk Assessment The organization shall conduct regular r... CRY-001 Cryptographic Governance Information Security Risk Management View ↗
        CRY-001-R006 Cryptographic Compliance Monitoring The organization shall monitor cryptogra... CRY-001 Cryptographic Governance Cryptography Security Engineering View ↗
        CRY-001-R007 Governance Reporting The organization shall report on cryptog... CRY-001 Cryptographic Governance CISO / Security Governance View ↗
        CRY-001-R008 Governance Review The organization shall conduct periodic... CRY-001 Cryptographic Governance Cryptography Governance Committee View ↗
        CRY-001-R009 Exception Management The organization shall manage exceptions... CRY-001 Cryptographic Governance Risk & Compliance / Cryptography Governance View ↗
        CRY-001-R010 Governance Continuous Improvement The organization shall drive ongoing enh... CRY-001 Cryptographic Governance CISO / Cryptography Governance Committee View ↗
        CRY-002-R001 Encryption Framework The organization shall establish a data-... CRY-002 Data-at-Rest Encryption Data Security / Cryptography Engineering View ↗
        CRY-002-R002 Data Identification The organization shall identify data tha... CRY-002 Data-at-Rest Encryption Data Protection / Data Owners View ↗
        CRY-002-R003 Encryption Requirements The organization shall define encryption... CRY-002 Data-at-Rest Encryption Cryptography Engineering / Data Security View ↗
        CRY-002-R004 Encryption Configuration The organization shall configure encrypt... CRY-002 Data-at-Rest Encryption Platform Engineering / Data Security View ↗
        CRY-002-R005 Encryption Validation The organization shall validate that dat... CRY-002 Data-at-Rest Encryption Security Assurance / Platform Security View ↗
        CRY-002-R006 Encryption Monitoring The organization shall monitor data-at-r... CRY-002 Data-at-Rest Encryption Security Operations / Network Security View ↗
        CRY-002-R007 Encryption Exception Management The organization shall manage exceptions... CRY-002 Data-at-Rest Encryption Risk Management / Data Security View ↗
        CRY-002-R008 Encryption Reporting The organization shall report on data-at... CRY-002 Data-at-Rest Encryption Network Security Governance View ↗
        CRY-002-R009 Encryption Review The organization shall conduct periodic... CRY-002 Data-at-Rest Encryption Cryptography Governance / Internal Security Assurance View ↗
        CRY-002-R010 Encryption Continuous Improvement The organization shall drive ongoing enh... CRY-002 Data-at-Rest Encryption Cryptography Governance / Network Security View ↗
        CRY-003-R001 Transmission Encryption Framework The organization shall establish a data-... CRY-003 Data-in-Transit Encryption Network Security / Cryptography Engineering View ↗
        CRY-003-R002 Secure Communication Requirements The organization shall define secure com... CRY-003 Data-in-Transit Encryption Network Security Architecture View ↗
        CRY-003-R003 Protocol Management The organization shall manage secure com... CRY-003 Data-in-Transit Encryption Network Security Engineering View ↗
        CRY-003-R004 Certificate Validation The organization shall validate digital... CRY-003 Data-in-Transit Encryption PKI / Application Security View ↗
        CRY-003-R005 Secure Channel Management The organization shall manage secure com... CRY-003 Data-in-Transit Encryption Network Security / Platform Engineering View ↗
        CRY-003-R006 Encryption Monitoring The organization shall monitor data-in-t... CRY-003 Data-in-Transit Encryption Security Operations / Network Security View ↗
        CRY-003-R007 Communication Security Review The organization shall conduct periodic... CRY-003 Data-in-Transit Encryption Network Security Assurance View ↗
        CRY-003-R008 Encryption Reporting The organization shall report on data-in... CRY-003 Data-in-Transit Encryption Network Security Governance View ↗
        CRY-003-R009 Encryption Assessment The organization shall conduct periodic... CRY-003 Data-in-Transit Encryption Security Assurance / Internal Audit View ↗
        CRY-003-R010 Encryption Continuous Improvement The organization shall drive ongoing enh... CRY-003 Data-in-Transit Encryption Cryptography Governance / Network Security View ↗
        CRY-004-R001 Key Management Framework The organization shall establish a crypt... CRY-004 Cryptographic Key Management Cryptography Engineering / Key Management View ↗
        CRY-004-R002 Key Generation The organization shall generate cryptogr... CRY-004 Cryptographic Key Management Key Management Team View ↗
        CRY-004-R003 Key Distribution The organization shall distribute crypto... CRY-004 Cryptographic Key Management Key Management / Cloud Security View ↗
        CRY-004-R004 Key Storage & Protection The organization shall store cryptograph... CRY-004 Cryptographic Key Management Key Management Team / Platform Security View ↗
        CRY-004-R005 Key Rotation The organization shall rotate cryptograp... CRY-004 Cryptographic Key Management Key Management / Platform Engineering View ↗
        CRY-004-R006 Key Backup & Recovery The organization shall back up cryptogra... CRY-004 Cryptographic Key Management Key Management / Business Continuity View ↗
        CRY-004-R007 Key Revocation & Destruction The organization shall revoke and destro... CRY-004 Cryptographic Key Management Key Management / Security Operations View ↗
        CRY-004-R008 Key Lifecycle Monitoring The organization shall monitor cryptogra... CRY-004 Cryptographic Key Management Key Management / Security Operations View ↗
        CRY-004-R009 Key Management Review The organization shall conduct periodic... CRY-004 Cryptographic Key Management Cryptography Assurance / Key Management View ↗
        CRY-004-R010 Key Management Continuous Improvement The organization shall drive ongoing enh... CRY-004 Cryptographic Key Management Cryptography Engineering View ↗
        CRY-005-R001 Certificate Management Framework The organization shall establish a digit... CRY-005 Digital Certificate Management PKI / Cryptography Governance View ↗
        CRY-005-R002 Certificate Issuance The organization shall issue digital cer... CRY-005 Digital Certificate Management PKI Administration / Security Engineering View ↗
        CRY-005-R003 Certificate Inventory The organization shall maintain a compre... CRY-005 Digital Certificate Management PKI / Infrastructure Security View ↗
        CRY-005-R004 Certificate Renewal The organization shall renew digital cer... CRY-005 Digital Certificate Management PKI / Platform Engineering View ↗
        CRY-005-R005 Certificate Revocation The organization shall revoke digital ce... CRY-005 Digital Certificate Management PKI / Incident Response View ↗
        CRY-005-R006 Certificate Monitoring The organization shall monitor digital c... CRY-005 Digital Certificate Management PKI / Security Operations View ↗
        CRY-005-R007 Certificate Trust Validation The organization shall validate the trus... CRY-005 Digital Certificate Management PKI / Endpoint Security View ↗
        CRY-005-R008 Certificate Reporting The organization shall report on digital... CRY-005 Digital Certificate Management PKI Governance View ↗
        CRY-005-R009 Certificate Review The organization shall conduct periodic... CRY-005 Digital Certificate Management PKI Assurance / Security Engineering View ↗
        CRY-005-R010 Certificate Continuous Improvement The organization shall drive ongoing enh... CRY-005 Digital Certificate Management PKI / Cryptography Governance View ↗

        Cross-Mapped Regulatory Frameworks

        Harmonized Control Mappings
        Framework Code Framework Name & Description Family / Category Version Action
        MAPPED NIST SP 800-57 Crosswalk regulatory baseline mapped under ASPIA UCL. Standard Baseline —
        MAPPED FIPS 140-2/140-3 Crosswalk regulatory baseline mapped under ASPIA UCL. Standard Baseline —
        MAPPED NIST SP 800-131A Crosswalk regulatory baseline mapped under ASPIA UCL. Standard Baseline —
        MAPPED ISO 27001 (Clause A.10) Crosswalk regulatory baseline mapped under ASPIA UCL. Standard Baseline —
        PCI-DSS PCI DSS PCI DSS is an industry security standard...
        PCI
        Standard
        		 v4 View →
        GDPR GDPR The General Data Protection Regulation i...
        EU
        Regulation
        		 vCurrent View →
        MAPPED Cloud Security Alliance Crosswalk regulatory baseline mapped under ASPIA UCL. Standard Baseline —