Policy Owner: Principal Engineer

Effective Date: 2023-05-01

Purpose

To ensure proper and effective use of cryptography to protect the confidentiality, authenticity and/or integrity of information. This policy establishes requirements for the use and protection of cryptographic keys and cryptographic methods throughout the entire encryption lifecycle.

Scope

All information systems developed and/or controlled by CloudCard which store or transmit confidential data.

Policy

CloudCard shall ensure that all non-public data is encrypted at rest and in transit over public networks. Strong cryptography with associated key management processes and procedures shall be implemented and documented for all encryption usage. All encryption shall be performed in accordance with industry standards, including NIST SP 800-57.

Customer or confidential company data must utilize strong ciphers and configurations in accordance with vendor recommendations and industry best practices including NIST Cryptographic Standards when stored or transferred over a public network.

Key Management

Access to keys and secrets shall be tightly controlled in accordance with the Access Control Policy.

The following table includes the recommended usage for cryptographic keys:

Exceptions

Requests for an exception to this policy must be submitted to the Principal Engineer for approval.

A documented exception is required prior to moving, copying, or storing customer or company confidential data on any media or removable device; all portable devices and removable media containing sensitive data must be encrypted using approved standards and mechanisms.

Violations & Enforcement

Any known violations of this policy should be reported to the Chief Technical Officer. Violations of this policy can result in immediate withdrawal or suspension of system and network privileges and/or disciplinary action in accordance with company procedures up to and including termination of employment.