# Encryption & Key Management Policy

> **Template — adapt before use.** Replace `[bracketed]` placeholders and have an owner approve it. Not compliance advice.

| | |
|---|---|
| **Owner** | [Role] | **Approved** | [YYYY-MM-DD] | **Review** | Annual | **Version** | 1.0 |

Maps to: ISO 27001 A.8.24 · SOC 2 CC6.1 · PCI DSS Req 3 & 4 · HIPAA §164.312(a)(2)(iv) & (e).

## 1. Purpose & scope
Defines how [Company Name] uses cryptography to protect data and how it manages cryptographic keys.

## 2. Encryption requirements
- **In transit:** TLS 1.2+ for all data over untrusted networks; strong cipher suites only; no plaintext protocols for sensitive data.
- **At rest:** Restricted and Confidential data encrypted with [AES-256] or equivalent.
- **Secrets:** API keys, passwords, and private keys stored in a managed secrets vault — never in source code, tickets, or config files.

## 3. Key management
- Keys are generated, stored, rotated, and retired using [KMS / HSM].
- Access to keys is least-privilege and logged.
- Rotation: [annually] for data-encryption keys, and immediately on suspected compromise or operator departure.
- Separation of duties for key custodians where required (e.g. PCI Req 3.6/3.7).

## 4. Prohibited
- Hard-coded keys/secrets, self-signed certs in production, deprecated algorithms (MD5, SHA-1 for signatures, DES/3DES, RSA < 2048).

## 5. Evidence
TLS configuration exports, KMS policies, and rotation records are reusable evidence across PCI, ISO, SOC 2, and HIPAA.

## Revision history
| Version | Date | Author | Change |
|---|---|---|---|
| 1.0 | [YYYY-MM-DD] | [Name] | Initial issue |