# Policy Cryptography and Transmission Policy | Document information | Value | |-----------------------|------| | Document type | Policy | | Scope | {{ISMS_SCOPE}} | | Organisation | {{ORG_NAME}} | | Responsible | {{ROLE_IT_LEAD}} | | Approved by | {{ROLE_MANAGEMENT}} | | Version | {{DOC_VERSION}} | | Date | {{DOC_DATE}} | | Status | {{DOC_STATUS}} | ## 1. Purpose This policy governs cryptographic procedures, key management and protection during information transmission. It elaborates the information security policy ({{LINK:L00}}) and serves to meet the requirements of VDA ISA 2027. ## 2. Scope This policy applies within the defined ISMS scope ({{ISMS_SCOPE_DESCRIPTION}}). ## 3. Requirements and implementation > Structure per section: **Requirement** (1:1 from VDA ISA; [MUST]/[SHOULD] and — where the protection need applies — [HIGH]/[VERY HIGH]) and **Implementation at {{ORG_NAME}}** (consolidated, to be adjusted where necessary). ### 3.1 Use of cryptographic procedures *Requirement reference:* {{#if FLAG_FW_TISAX}}VDA ISA 5.1.1{{/if}}{{#if FLAG_FW_ISO27001}}{{#if FLAG_FW_TISAX}} · {{/if}}ISO/IEC 27001 A.8.24{{/if}} **Requirement** {{#if FLAG_FW_TISAX}} {{#if FLAG_FW_ISO27001}}*Requirements per VDA ISA 2027:*{{/if}} - **[MUST]** All cryptographic procedures used (e.g. encryption, signature, hash algorithms, protocols) provide the security required in the respective field of application according to a recognised industry standard, as far as legally possible. {{#if FLAG_INCLUDE_SHOULD}} - **[SHOULD]** A concept for the use of cryptography is defined and implemented; the relevant aspects are taken into account. {{/if}} {{#if FLAG_HIGH_PROTECTION}} - **[HIGH]** Requirements for key sovereignty (in particular in the case of external processing) are determined and met. (C, I) {{/if}} {{/if}} {{#if FLAG_FW_ISO27001}} {{#if FLAG_FW_TISAX}}*Requirements per ISO/IEC 27001:*{{/if}} - **[ISO A.8.24]** Rules for the effective use of cryptography, including key management, are defined and implemented. {{/if}} **Implementation at {{ORG_NAME}}** The permissible procedures and key lengths per BL-CRY-02 ({{CRYPTO_ALGO}}) correspond to the recognised industry standard and are prescribed; outdated procedures are prohibited. A cryptography concept is documented (see {{LINK:VA-07}}), and keys are securely managed throughout their lifecycle (BL-CRY-05). {{#if FLAG_ELEVATED_PROTECTION}} Where the protection need is high, requirements for key sovereignty (in particular in the case of external processing) are determined and met. {{/if}} ### 3.2 Protection during information transmission *Requirement reference:* {{#if FLAG_FW_TISAX}}VDA ISA 5.1.2{{/if}}{{#if FLAG_FW_ISO27001}}{{#if FLAG_FW_TISAX}} · {{/if}}ISO/IEC 27001 A.5.14{{/if}} **Requirement** {{#if FLAG_FW_TISAX}} {{#if FLAG_FW_ISO27001}}*Requirements per VDA ISA 2027:*{{/if}} - **[MUST]** The network services used for transmitting information are identified and documented. - **[MUST]** Policies and procedures in line with the classification requirements for the use of network services are defined and implemented. - **[MUST]** Measures to protect transmitted content against unauthorised access are implemented. {{#if FLAG_INCLUDE_SHOULD}} - **[SHOULD]** Measures to ensure correct addressing and correct transmission of information are implemented. {{/if}} {{#if FLAG_INCLUDE_SHOULD}} - **[SHOULD]** Electronic data exchange takes place using content or transport encryption in line with the respective classification. {{/if}} {{#if FLAG_INCLUDE_SHOULD}} - **[SHOULD]** Remote access connections to the organisation's network have appropriate security features; the relevant aspects are taken into account. {{/if}} {{#if FLAG_HIGH_PROTECTION}} - **[HIGH]** Information is transmitted encrypted (at least transport encryption) or protected by equivalently effective measures. (C) {{/if}} {{#if FLAG_VERY_HIGH_PROTECTION}} - **[VERY HIGH]** Information is transmitted with content encryption. (C) {{/if}} {{/if}} {{#if FLAG_FW_ISO27001}} {{#if FLAG_FW_TISAX}}*Requirements per ISO/IEC 27001:*{{/if}} - **[ISO A.5.14]** Rules, procedures and agreements for the secure transfer of information are established for all transfer channels in use. {{/if}} **Implementation at {{ORG_NAME}}** The network services used are identified and documented in the network/network services register ({{LINK:REG-NET}}); policies/procedures in line with the classification are implemented. Information is protected during transmission in accordance with the protection need (at least {{TLS_MIN}}, BL-CRY-01), correct addressing is ensured and remote access is safeguarded; rules for email/file encryption are defined (BL-CRY-04, cryptography/key management see {{LINK:VA-07}}). {{#if FLAG_ELEVATED_PROTECTION}} Where the protection need is high, information is transmitted at least transport-encrypted or protected equivalently; {{#if FLAG_VERY_HIGH_PROTECTION}}where the protection need is very high, content encryption is applied.{{/if}} {{/if}} ## 4. Binding nature This policy is binding for all affected roles within the scope. Compliance is monitored by {{ROLE_IT_LEAD}}. ## 5. Roles and responsibilities | Role | Responsibility in this policy | |-------|-------------------------------------| | {{ROLE_IT_LEAD}} | Procedures/keys | | {{ROLE_ISB}} | Permissible algorithms | ## 6. Review and update This policy is reviewed at least {{REVIEW_CYCLE}} and on an ad-hoc basis by {{ROLE_IT_LEAD}} and approved by {{ROLE_MANAGEMENT}}. ## 7. Evidence The evidence is not maintained in this document but centrally in the evidence register ({{LINK:NACHWEISREGISTER}}) and in the associated entries of the ISMS tool ({{TOOL_NAME}}). ## 8. Related documents - Associated procedures: {{LINK:VA-07}} - Technical security baseline: {{LINK:BASELINE}} - ISA mapping matrix: {{LINK:ISA_MAPPING}} - Evidence register: {{LINK:NACHWEISREGISTER}} - Further: {{LINK:R08}}, {{LINK:R10}}, {{LINK:R12}}