Encryption Algorithm

[All Actors]
Applies to all Roles (Baseline) before application of role context
1. Establish and document policies and procedures for Cryptography, Encryption, and Key Management.

2. Approve the policies and procedures through formal governance processes (e.g., security committee, CISO).

3. Communicate the policies and procedures to all relevant stakeholders.

4. Apply the approved policies and procedures to all systems, services, and processes under the role’s control.

5. Evaluate the effectiveness of policy and procedure implementation using internal audits, technical reviews, 
and encryption control validations.

6. Review and update the policies and procedures at least annually, or when significant system, model, or 
regulatory changes occur.

1. Verify that the CSP maintains a documented standard for approved encryption algorithms aligned with data classification levels (e.g., confidential, regulated, sensitive) and global cryptographic standards (e.g., NIST, ISO, ENISA).

2. Confirm that algorithms used for encryption at rest and in transit (e.g., AES-256, RSA-2048, TLS 1.3) are certified or validated, and confirm that they are mapped to specific service tiers, storage types, and transmission protocols.

3. Review whether algorithm effectiveness is periodically reassessed to address known vulnerabilities, cryptographic deprecation (e.g., SHA-1), or regulatory changes, and confirm that retirement or replacement procedures are documented.

4. Validate that algorithm selection accounts for operational considerations including latency, performance, and compatibility across CSP service offerings (e.g., storage, compute, network encryption layers).

5. Confirm that algorithm usage is consistently enforced across all service layers, including encryption of control plane communications, customer data, metadata, and backup services.

6. Verify that encryption algorithms are tightly integrated with the CSP’s key management infrastructure (e.g., KMS, HSM), and that usage policies enforce isolation, access boundaries, and proper key pairing.

7. Review whether encryption algorithm use is governed through approval processes involving cryptography or platform security teams, with documentation of review cycles and escalation paths.

8. Confirm that third-party components embedded in the CSP infrastructure (e.g., firmware, load balancers, backup appliances) use encryption algorithms that comply with CSP standards and undergo regular security vetting.

9. Validate that algorithm issues identified through internal audits, penetration tests, customer escalations, or regulatory assessments are tracked and addressed within the algorithm lifecycle governance process.

10. Verify that the CSP supports downstream encryption compatibility by publishing supported algorithm suites and offering configuration options (e.g., customer-defined cipher suites), while maintaining interoperability with upstream libraries or dependencies.

From CCM:
1. Identify the encryption algorithms in use.
2. Confirm that identified encryption algorithms have been reviewed and approved by appropriate management.
3. Confirm that the encryption algorithm approval process includes assessment of the appropriateness of the algorithm for the data it is protecting, any associated risks, and the algorithm's usability.