Skip to main content

💼 5 An APRA-regulated entity would typically deploy, where relevant, controls to limit access to cryptographic keys, including:

  • Contextual name: 💼 5 An APRA-regulated entity would typically deploy, where relevant, controls to limit access to cryptographic keys, including:
  • ID: /frameworks/apra-cpg-234/e/5
  • Located in: 💼 Attachment E - Cryptographic techniques

Description​

Empty...

Similar​

  • Internal
    • ID: dec-c-03210f47

Sub Sections​

SectionSub SectionsInternal RulesPoliciesFlags
💼 a. use of physically and logically protected devices and environments to store and generate cryptographic keys, generate PINs and perform encryption and decryption. In most cases this would involve the use of Hardware Security Modules10 (HSMs) or similarly secured devices;
💼 b. use of cryptographic techniques to maintain cryptographic key confidentiality;
💼 c. segregation of duties, with no single individual having knowledge of the entire cryptographic key (i.e. two-person controls) or having access to all the components making up these keys;
💼 d. predefined activation and deactivation dates for cryptographic keys, limiting the period of time they remain valid for use. The period of time a cryptographic key remains valid would be commensurate with the risk;34
💼 e. clearly defined cryptographic key revocation processes;
💼 f. the deployment of detection techniques to identify any instances of cryptographic key substitution.