Requirement
"Rules for the effective use of cryptography, including cryptographic key management, shall be defined and implemented."[1]
Explanation
The organization should define what types of encryption will be used to protect information on its systems. For example it can define that BitLocker and File vault will be used to encrypt information on workstations and removable storage devices and that the keys will be managed using Microsoft Intune. Other types of cryptographic keys that need to be managed include digital certificates and SSH keys.
