Kibernetinio saugumo reikalavimų aprašas (KSRA)
Cryptography and Encryption Usage Policy and Procedures
55. The head of the cybersecurity entity or a person authorised by them must establish a procedure for the use of cryptography and encryption, covering:
- 55.1. provisions on the cybersecurity entity's use of cryptography and encryption measures, having regard to the information classification and handling requirements established by the entity
- 55.2. key management (generation, destruction, archiving, etc.).
- 55.3. requirements for carrying out an inventory of the use of cryptography and for documenting its results, as well as how often the inventory is carried out — at least once every three years. The inventory of the use of cryptography must cover at least:
- 55.3.1. identification of the cryptographic algorithms, protocols and encryption measures used;
- 55.3.2. the purpose for which cryptography is used in the network and information systems;
- 55.3.3. the cryptographic parameters used, including key lengths, protocol versions and certificate validity periods;
- 55.4. identification of network and information systems at high quantum risk (hereinafter — high quantum risk systems). High quantum risk systems are understood as network and information systems meeting at least one of the following criteria:
- 55.4.1. a disruption of their operation or loss of data would disrupt the performance of the cybersecurity entity's essential functions to such an extent that the entity's business continuity would become impossible;
- 55.4.2. a disruption of their operation, unlawful access, disclosure, modification or loss of data would have an adverse effect on the national security or public security of the Republic of Lithuania or on the performance of the functions of state institutions and bodies;
- 55.4.3. a disruption of their operation or a breach of the security of the data processed in them would give rise, or could give rise, to legal liability for the cybersecurity entity, including liability for breaches of personal data protection, of the performance of financial or contractual obligations, or of intellectual property rights;
- 55.4.4. the confidentiality of the data processed or stored in them must, under the requirements of the legal acts governing data protection, be ensured for at least 10 years;
- 55.4.5. the deployment of post-quantum cryptography algorithms in them would take longer than 8 years because of technical, architectural or compatibility constraints of the network and information systems.
56. If a cryptographic key is lost, the responsible person must be informed.
57. The technical requirements applicable to cybersecurity entities are set out in Table 4.
All cybersecurity entities
44. The confidentiality of information sensitive to the cybersecurity entity that is transmitted over public electronic communications networks must be ensured using encryption or a virtual private network (VPN).
45. Wireless communications must be encrypted using a key of the length recommended by good security practice. Keys and protocol versions that are generally recognised as secure must be used. The manufacturer's default keys must be changed on the wireless access point.
46. Data transmitted between a mobile device and the network and information system must be encrypted using virtual private network (VPN) technology with a TLS / SSL certificate, or a private Access Point Name (APN) technology through the mobile operator must be used, applying encryption of the transmitted data in the stream with a TLS / SSL certificate where VPN technology is not supported by the mobile devices.
47. Network and information systems data held on mobile device media and on external computer media must be encrypted.
48. The website cryptography requirements must be implemented:
- 48.1. officially recognised secure key lengths must be used;
- 48.2. when carrying out website administration work, the connection must be encrypted;
- 48.3. the digital certificates used for encryption must be issued by trusted certification authorities;
<...>
- 48.5. the website's cryptographic functions must be deployed on the part of the server hosting the website or in a hardware security module;
<...>
49. Data in backup copies must be encrypted (the encryption keys must be stored separately from the copies), or other measures must be taken to prevent the copies from being used to recover information unlawfully.
50. Audit records relating to cryptographic key management activities (generation, destruction, archiving, user actions) must be retained and monitored.
50-2. In network and information systems that use asymmetric cryptography, post-quantum cryptography algorithms must be used that are standardised and generally recognised by international standardisation organisations such as the National Institute of Standards and Technology of the United States of America or the International Organization for Standardization.
Additionally, only for Essential cybersecurity entities
48. The website cryptography requirements must be implemented:
- 48.4. the TLS standard (version 1.3 or later) must be used;
- 48.6. all cryptographic modules must be able to fail securely.
50-1. In high quantum risk systems that use asymmetric cryptography, post-quantum cryptography algorithms must be used that are standardised and generally recognised by international standardisation organisations such as the National Institute of Standards and Technology of the United States of America or the International Organization for Standardization, or hybrid solutions must be applied in which post-quantum cryptography algorithms are used together with the asymmetric cryptography algorithms in use at the time.