CIF-4 - Information and Data Encryption
Encryption of cloud data at rest and in transit: standard algorithms, key management and mandatory use of secure TLS/HTTPS.
Control Definition
Rules for the correct use of cryptographic techniques must be defined and the required encryption level determined according to data classification. Information at rest must be encrypted with industry-standard algorithms and keys managed through specialized services, prohibiting algorithms and protocols considered weak or obsolete. Communications in transit must be protected by requiring secure versions of TLS and HTTPS on all exposed services, and compliance with these practices must be verified periodically.
Requirements
Requirement 1
We define rules for the correct use of cryptographic techniques, including how to manage encryption keys.
Requirement 2
We apply rules for the correct use of cryptographic techniques, including how to manage encryption keys.
Requirement 3
We define the required encryption level based on data classification.
Requirement 4
We enable encryption at rest with industry-standard or widely accepted cryptographic algorithms on all cloud storage services.
Requirement 5
We use customer-managed keys (CMK) stored in a KMS (Key Management Service) for confidential and restricted data.
Requirement 6
We prohibit cryptographic algorithms considered weak or obsolete under current industry standards.
Requirement 7
We require TLS 1.2 as the minimum version for all data in transit, preferring TLS 1.3.
Requirement 8
We make HTTPS mandatory on all exposed web services.
Requirement 9
We make HTTPS mandatory on all exposed APIs.
Requirement 10
We implement mTLS for service-to-service communications in microservice architectures.
Requirement 11
We implement HSTS with preload on all web applications.
Requirement 12
We prohibit insecure protocols: HTTP, FTP, Telnet and SNMPv1.
Requirement 13
We periodically verify encryption compliance through configuration scans and SSL/TLS analysis.