msolarczekandClaude Opus 5
c8e6f30a27
Unveränderter Stand von certvia/dev (a48c5fb) plus Craftvia-Spezifikation und Brandbook unter docs/craftvia/. ISMS-Module werden im Folgecommit entfernt. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
157 lines
6.7 KiB
Markdown
157 lines
6.7 KiB
Markdown
# Policy Cryptography and Transmission Policy
|
|
|
|
| Document information | Value |
|
|
|-----------------------|------|
|
|
| Document type | Policy |
|
|
| Scope | {{ISMS_SCOPE}} |
|
|
| Organisation | {{ORG_NAME}} |
|
|
| Responsible | {{ROLE_IT_LEAD}} |
|
|
| Approved by | {{ROLE_MANAGEMENT}} |
|
|
| Version | {{DOC_VERSION}} |
|
|
| Date | {{DOC_DATE}} |
|
|
| Status | {{DOC_STATUS}} |
|
|
|
|
|
|
## 1. Purpose
|
|
|
|
This policy governs cryptographic procedures, key management and protection during information transmission. It elaborates the information security policy ({{LINK:L00}}) and serves to meet the requirements of VDA ISA 2027.
|
|
|
|
## 2. Scope
|
|
|
|
This policy applies within the defined ISMS scope ({{ISMS_SCOPE_DESCRIPTION}}).
|
|
|
|
## 3. Requirements and implementation
|
|
|
|
> Structure per section: **Requirement** (1:1 from VDA ISA; [MUST]/[SHOULD] and — where the protection need applies — [HIGH]/[VERY HIGH]) and **Implementation at {{ORG_NAME}}** (consolidated, to be adjusted where necessary).
|
|
|
|
### 3.1 Use of cryptographic procedures
|
|
|
|
<!-- FW:REF-START ORIG:(ISA 5.1.1) -->
|
|
*Requirement reference:* {{#if FLAG_FW_TISAX}}VDA ISA 5.1.1{{/if}}{{#if FLAG_FW_ISO27001}}{{#if FLAG_FW_TISAX}} · {{/if}}ISO/IEC 27001 A.8.24{{/if}}
|
|
<!-- FW:REF-END -->
|
|
|
|
**Requirement**
|
|
|
|
<!-- FW:TISAX-REQ-START -->
|
|
{{#if FLAG_FW_TISAX}}
|
|
{{#if FLAG_FW_ISO27001}}*Requirements per VDA ISA 2027:*{{/if}}
|
|
|
|
<!-- REQ 5.1.1-M1 -->
|
|
- **[MUST]** All cryptographic procedures used (e.g. encryption, signature, hash algorithms, protocols) provide the security required in the respective field of application according to a recognised industry standard, as far as legally possible.
|
|
{{#if FLAG_INCLUDE_SHOULD}}
|
|
<!-- REQ 5.1.1-S1 -->
|
|
- **[SHOULD]** A concept for the use of cryptography is defined and implemented; the relevant aspects are taken into account.
|
|
{{/if}}
|
|
{{#if FLAG_HIGH_PROTECTION}}
|
|
<!-- REQ 5.1.1-H1 -->
|
|
- **[HIGH]** Requirements for key sovereignty (in particular in the case of external processing) are determined and met. (C, I)
|
|
{{/if}}
|
|
{{/if}}
|
|
<!-- FW:TISAX-REQ-END -->
|
|
<!-- FW:ISO-REQ-START -->
|
|
{{#if FLAG_FW_ISO27001}}
|
|
{{#if FLAG_FW_TISAX}}*Requirements per ISO/IEC 27001:*{{/if}}
|
|
|
|
<!-- REQ A.8.24-1 -->
|
|
- **[ISO A.8.24]** Rules for the effective use of cryptography, including key management, are defined and implemented.
|
|
{{/if}}
|
|
<!-- FW:ISO-REQ-END -->
|
|
|
|
**Implementation at {{ORG_NAME}}**
|
|
|
|
<!-- IMPL 5.1.1 -->
|
|
The permissible procedures and key lengths per BL-CRY-02 ({{CRYPTO_ALGO}}) correspond to the recognised industry standard and are prescribed; outdated procedures are prohibited. A cryptography concept is documented (see {{LINK:VA-07}}), and keys are securely managed throughout their lifecycle (BL-CRY-05).
|
|
|
|
{{#if FLAG_ELEVATED_PROTECTION}}
|
|
<!-- IMPL 5.1.1-elev -->
|
|
Where the protection need is high, requirements for key sovereignty (in particular in the case of external processing) are determined and met.
|
|
{{/if}}
|
|
|
|
### 3.2 Protection during information transmission
|
|
|
|
<!-- FW:REF-START ORIG:(ISA 5.1.2) -->
|
|
*Requirement reference:* {{#if FLAG_FW_TISAX}}VDA ISA 5.1.2{{/if}}{{#if FLAG_FW_ISO27001}}{{#if FLAG_FW_TISAX}} · {{/if}}ISO/IEC 27001 A.5.14{{/if}}
|
|
<!-- FW:REF-END -->
|
|
|
|
**Requirement**
|
|
|
|
<!-- FW:TISAX-REQ-START -->
|
|
{{#if FLAG_FW_TISAX}}
|
|
{{#if FLAG_FW_ISO27001}}*Requirements per VDA ISA 2027:*{{/if}}
|
|
|
|
<!-- REQ 5.1.2-M1 -->
|
|
- **[MUST]** The network services used for transmitting information are identified and documented.
|
|
<!-- REQ 5.1.2-M2 -->
|
|
- **[MUST]** Policies and procedures in line with the classification requirements for the use of network services are defined and implemented.
|
|
<!-- REQ 5.1.2-M3 -->
|
|
- **[MUST]** Measures to protect transmitted content against unauthorised access are implemented.
|
|
{{#if FLAG_INCLUDE_SHOULD}}
|
|
<!-- REQ 5.1.2-S1 -->
|
|
- **[SHOULD]** Measures to ensure correct addressing and correct transmission of information are implemented.
|
|
{{/if}}
|
|
{{#if FLAG_INCLUDE_SHOULD}}
|
|
<!-- REQ 5.1.2-S2 -->
|
|
- **[SHOULD]** Electronic data exchange takes place using content or transport encryption in line with the respective classification.
|
|
{{/if}}
|
|
{{#if FLAG_INCLUDE_SHOULD}}
|
|
<!-- REQ 5.1.2-S3 -->
|
|
- **[SHOULD]** Remote access connections to the organisation's network have appropriate security features; the relevant aspects are taken into account.
|
|
{{/if}}
|
|
{{#if FLAG_HIGH_PROTECTION}}
|
|
<!-- REQ 5.1.2-H1 -->
|
|
- **[HIGH]** Information is transmitted encrypted (at least transport encryption) or protected by equivalently effective measures. (C)
|
|
{{/if}}
|
|
{{#if FLAG_VERY_HIGH_PROTECTION}}
|
|
<!-- REQ 5.1.2-V1 -->
|
|
- **[VERY HIGH]** Information is transmitted with content encryption. (C)
|
|
{{/if}}
|
|
{{/if}}
|
|
<!-- FW:TISAX-REQ-END -->
|
|
<!-- FW:ISO-REQ-START -->
|
|
{{#if FLAG_FW_ISO27001}}
|
|
{{#if FLAG_FW_TISAX}}*Requirements per ISO/IEC 27001:*{{/if}}
|
|
|
|
<!-- REQ A.5.14-1 -->
|
|
- **[ISO A.5.14]** Rules, procedures and agreements for the secure transfer of information are established for all transfer channels in use.
|
|
{{/if}}
|
|
<!-- FW:ISO-REQ-END -->
|
|
|
|
**Implementation at {{ORG_NAME}}**
|
|
|
|
<!-- IMPL 5.1.2 -->
|
|
The network services used are identified and documented in the network/network services register ({{LINK:REG-NET}}); policies/procedures in line with the classification are implemented. Information is protected during transmission in accordance with the protection need (at least {{TLS_MIN}}, BL-CRY-01), correct addressing is ensured and remote access is safeguarded; rules for email/file encryption are defined (BL-CRY-04, cryptography/key management see {{LINK:VA-07}}).
|
|
|
|
{{#if FLAG_ELEVATED_PROTECTION}}
|
|
<!-- IMPL 5.1.2-elev -->
|
|
Where the protection need is high, information is transmitted at least transport-encrypted or protected equivalently; {{#if FLAG_VERY_HIGH_PROTECTION}}where the protection need is very high, content encryption is applied.{{/if}}
|
|
{{/if}}
|
|
|
|
## 4. Binding nature
|
|
|
|
This policy is binding for all affected roles within the scope. Compliance is monitored by {{ROLE_IT_LEAD}}.
|
|
|
|
## 5. Roles and responsibilities
|
|
|
|
| Role | Responsibility in this policy |
|
|
|-------|-------------------------------------|
|
|
| {{ROLE_IT_LEAD}} | Procedures/keys |
|
|
| {{ROLE_ISB}} | Permissible algorithms |
|
|
|
|
## 6. Review and update
|
|
|
|
This policy is reviewed at least {{REVIEW_CYCLE}} and on an ad-hoc basis by {{ROLE_IT_LEAD}} and approved by {{ROLE_MANAGEMENT}}.
|
|
|
|
## 7. Evidence
|
|
|
|
The evidence is not maintained in this document but centrally in the evidence register ({{LINK:NACHWEISREGISTER}}) and in the associated entries of the ISMS tool ({{TOOL_NAME}}).
|
|
|
|
## 8. Related documents
|
|
|
|
- Associated procedures: {{LINK:VA-07}}
|
|
- Technical security baseline: {{LINK:BASELINE}}
|
|
- ISA mapping matrix: {{LINK:ISA_MAPPING}}
|
|
- Evidence register: {{LINK:NACHWEISREGISTER}}
|
|
- Further: {{LINK:R08}}, {{LINK:R10}}, {{LINK:R12}}
|
|
|
|
<!-- Anforderungen 1:1 aus VDA ISA 2027; Mapping (REQ/IMPL) in mapping.json ueber Hidden-Anker. Im Lesemodus nicht sichtbar. -->
|