craftvia/seed/isms-vorlagenpaket-v2-en/richtlinien/R09_Kryptografie-und-Uebertragungsrichtlinie.md

Policy Cryptography and Transmission Policy

Document information	Value
Document type	Policy
Scope	{{ISMS_SCOPE}}
Organisation	{{ORG_NAME}}
Responsible	{{ROLE_IT_LEAD}}
Approved by	{{ROLE_MANAGEMENT}}
Version	{{DOC_VERSION}}
Date	{{DOC_DATE}}
Status	{{DOC_STATUS}}

1. Purpose

This policy governs cryptographic procedures, key management and protection during information transmission. It elaborates the information security policy ({{LINK:L00}}) and serves to meet the requirements of VDA ISA 2027.

2. Scope

This policy applies within the defined ISMS scope ({{ISMS_SCOPE_DESCRIPTION}}).

3. Requirements and implementation

Structure per section: Requirement (1:1 from VDA ISA; [MUST]/[SHOULD] and — where the protection need applies — [HIGH]/[VERY HIGH]) and Implementation at {{ORG_NAME}} (consolidated, to be adjusted where necessary).

3.1 Use of cryptographic procedures

Requirement reference: {{#if FLAG_FW_TISAX}}VDA ISA 5.1.1{{/if}}{{#if FLAG_FW_ISO27001}}{{#if FLAG_FW_TISAX}} · {{/if}}ISO/IEC 27001 A.8.24{{/if}}

Requirement

{{#if FLAG_FW_TISAX}} {{#if FLAG_FW_ISO27001}}Requirements per VDA ISA 2027:{{/if}}

• [MUST] All cryptographic procedures used (e.g. encryption, signature, hash algorithms, protocols) provide the security required in the respective field of application according to a recognised industry standard, as far as legally possible. {{#if FLAG_INCLUDE_SHOULD}}

• [SHOULD] A concept for the use of cryptography is defined and implemented; the relevant aspects are taken into account. {{/if}} {{#if FLAG_HIGH_PROTECTION}}

• [HIGH] Requirements for key sovereignty (in particular in the case of external processing) are determined and met. (C, I) {{/if}} {{/if}}

{{#if FLAG_FW_ISO27001}} {{#if FLAG_FW_TISAX}}Requirements per ISO/IEC 27001:{{/if}}

• [ISO A.8.24] Rules for the effective use of cryptography, including key management, are defined and implemented. {{/if}}

Implementation at {{ORG_NAME}}

The permissible procedures and key lengths per BL-CRY-02 ({{CRYPTO_ALGO}}) correspond to the recognised industry standard and are prescribed; outdated procedures are prohibited. A cryptography concept is documented (see {{LINK:VA-07}}), and keys are securely managed throughout their lifecycle (BL-CRY-05).

{{#if FLAG_ELEVATED_PROTECTION}}

Where the protection need is high, requirements for key sovereignty (in particular in the case of external processing) are determined and met. {{/if}}

3.2 Protection during information transmission

Requirement reference: {{#if FLAG_FW_TISAX}}VDA ISA 5.1.2{{/if}}{{#if FLAG_FW_ISO27001}}{{#if FLAG_FW_TISAX}} · {{/if}}ISO/IEC 27001 A.5.14{{/if}}

Requirement

{{#if FLAG_FW_TISAX}} {{#if FLAG_FW_ISO27001}}Requirements per VDA ISA 2027:{{/if}}

• [MUST] The network services used for transmitting information are identified and documented.

• [MUST] Policies and procedures in line with the classification requirements for the use of network services are defined and implemented.

• [MUST] Measures to protect transmitted content against unauthorised access are implemented. {{#if FLAG_INCLUDE_SHOULD}}

• [SHOULD] Measures to ensure correct addressing and correct transmission of information are implemented. {{/if}} {{#if FLAG_INCLUDE_SHOULD}}

• [SHOULD] Electronic data exchange takes place using content or transport encryption in line with the respective classification. {{/if}} {{#if FLAG_INCLUDE_SHOULD}}

• [SHOULD] Remote access connections to the organisation's network have appropriate security features; the relevant aspects are taken into account. {{/if}} {{#if FLAG_HIGH_PROTECTION}}

• [HIGH] Information is transmitted encrypted (at least transport encryption) or protected by equivalently effective measures. (C) {{/if}} {{#if FLAG_VERY_HIGH_PROTECTION}}

• [VERY HIGH] Information is transmitted with content encryption. (C) {{/if}} {{/if}}

{{#if FLAG_FW_ISO27001}} {{#if FLAG_FW_TISAX}}Requirements per ISO/IEC 27001:{{/if}}

• [ISO A.5.14] Rules, procedures and agreements for the secure transfer of information are established for all transfer channels in use. {{/if}}

Implementation at {{ORG_NAME}}

The network services used are identified and documented in the network/network services register ({{LINK:REG-NET}}); policies/procedures in line with the classification are implemented. Information is protected during transmission in accordance with the protection need (at least {{TLS_MIN}}, BL-CRY-01), correct addressing is ensured and remote access is safeguarded; rules for email/file encryption are defined (BL-CRY-04, cryptography/key management see {{LINK:VA-07}}).

{{#if FLAG_ELEVATED_PROTECTION}}

Where the protection need is high, information is transmitted at least transport-encrypted or protected equivalently; {{#if FLAG_VERY_HIGH_PROTECTION}}where the protection need is very high, content encryption is applied.{{/if}} {{/if}}

4. Binding nature

This policy is binding for all affected roles within the scope. Compliance is monitored by {{ROLE_IT_LEAD}}.

5. Roles and responsibilities

Role	Responsibility in this policy
{{ROLE_IT_LEAD}}	Procedures/keys
{{ROLE_ISB}}	Permissible algorithms

6. Review and update

This policy is reviewed at least {{REVIEW_CYCLE}} and on an ad-hoc basis by {{ROLE_IT_LEAD}} and approved by {{ROLE_MANAGEMENT}}.

7. Evidence

The evidence is not maintained in this document but centrally in the evidence register ({{LINK:NACHWEISREGISTER}}) and in the associated entries of the ISMS tool ({{TOOL_NAME}}).

8. Related documents

• Associated procedures: {{LINK:VA-07}}
• Technical security baseline: {{LINK:BASELINE}}
• ISA mapping matrix: {{LINK:ISA_MAPPING}}
• Evidence register: {{LINK:NACHWEISREGISTER}}
• Further: {{LINK:R08}}, {{LINK:R10}}, {{LINK:R12}}