Encryption Change Management

[All Actors]
Applies to all Roles (Baseline) before application of role context.
1. Establish and document policies and procedures for Cryptography, Encryption, and Key Management.

2. Approve the policies and procedures through formal governance processes (e.g., security committee, 
CISO).

3. Communicate the policies and procedures to all relevant stakeholders.

4. Apply the approved policies and procedures to all systems, services, and processes under the role’s 
control.

5. Evaluate the effectiveness of policy and procedure implementation using internal audits, technical 
reviews, and encryption control validations.

6. Review and update the policies and procedures at least annually, or when significant system, 
model, or regulatory changes occur.

1. Verify that the CSP maintains a documented change management procedure specifically for cryptographic, encryption, and key management technologies, covering infrastructure-layer services (e.g., KMS, HSM, TLS endpoints).

2. Confirm that the procedure accommodates changes from both internal sources (e.g., platform enhancements, algorithm updates) and external sources (e.g., industry deprecations, regulatory mandates, customer requirements).

3. Review whether CEK-related change requests are tracked in a centralized system and routed through formal change review and risk assessment processes (e.g., CAB, security design review).

4. Verify that roles and responsibilities are clearly defined for CEK change request review, approval, testing, and rollout, including participation from cryptographic engineers, infrastructure leads, and compliance officers.

5. Confirm that each approved CEK change includes a structured implementation plan, with defined testing procedures, contingency/rollback steps, and timeline for execution.

6. Review how changes are communicated to internal teams (e.g., operations, DevOps, customer engineering) and external stakeholders (e.g., tenants impacted by changes to cryptographic behavior).

7. Validate that version control is enforced for encryption configurations, key policy templates, and any code or automation artifacts related to the CEK change.

8. Verify that post-implementation testing is conducted to validate the effectiveness of the change, including automated checks for service availability, encryption correctness, and logging integrity.

9. Confirm that full CEK change documentation is maintained, including testing results, implementation notes, approval evidence, and communications, and confirm that it is available for audits and tenant assurance requests.

10. Review whether CEK change management includes analysis of upstream dependencies (e.g., third-party crypto libraries, hardware appliances) and downstream impact on tenants and shared service consumers.

From CCM:

1. Examine policy and procedures and obtain evidence that these include the change management process.
2. Obtain representative samples of recent changes relating to cryptographic, encryption, and key management technology.
3. Confirm that sample changes have followed the organization's change management procedures, including approval by appropriate individuals, communication of changes to relevant stakeholders, and assessment of the success of implementing changes with any required remediation actions being tracked.