CRY-02 Encryption of data for transmission (transport encryption)
Implement procedures and technical measures applying strong encryption and authentication to cloud customer data whenever it is transmitted over public networks, so traffic in transit can be neither read nor spoofed.
4
artefacts
2
held by a system
0
at each review
easy
to go live
Key management / PKI
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Protocol and cipher suite configuration of public-facing service endpoints · Key management / PKI
- External scan output confirming deprecated protocol versions are refused · Vulnerability scanner / patch tooling
periodic reviewEvidence produced at each review
none for this control
governing documentDocuments that govern the control
- Certificate inventory for the endpoints terminating customer traffic · Policy repository / GRC workspace
- Flow design identifying which transmissions leave the provider network over public paths · Policy repository / GRC workspace
First move
Automate the pull from your Key management / PKI. Key inventory, rotation dates and certificate expiry from the KMS or PKI.
Common gaps auditors find
- Legacy endpoints still negotiating outdated protocol versions for backward compatibility
- Encryption terminated at a load balancer and carried onward unprotected across a public link
- Peer authentication not enforced, so the identity of the far end is never validated
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetCRY-01 Policy for the use of encryption procedures and key management · CRY-03 Encryption of sensitive data for storage