Guidance

Rule 22: ICT shall be compliant with HMG Information Assurance Policy for the employment of Cryptographic Products

Updated 16 October 2023

© Crown copyright 2023

This publication is licensed under the terms of the Open Government Licence v3.0 except where otherwise stated. To view this licence, visit nationalarchives.gov.uk/doc/open-government-licence/version/3 or write to the Information Policy Team, The National Archives, Kew, London TW9 4DU, or email: psi@nationalarchives.gov.uk.

Where we have identified any third party copyright information you will need to obtain permission from the copyright holders concerned.

This publication is available at https://www.gov.uk/government/publications/joint-service-publication-jsp-604-network-rules/rule-22-ict-shall-be-compliant-with-hmg-information-assurance-policy-for-the-employment-of-cryptographic-products

The rules are under review and subject to change.

1. Rule requirement

1.1 Cryptographic Compliance

HMG Information Assurance Policy mandates that all Defence Projects & Programmes employing data at rest or data in transit whose Protective Marking is above UNCLASSIFIED, implement cryptography

  • Data marked as OFFICIAL must employ recognised industry cryptographic best practice based on guidance from the NCSC

  • Data marked as SECRET or ABOVE SECRET must employ High Assurance Cryptographic systems, known within HMG as Crypt-Key, these systems are independently assured by the NCSC

  • Projects & Programmes acquiring Crypt-Key systems must engage with CyDR Crypt-Key and complete a Crypt-Key Management Plan (CMP) starting during the Concept Phase. Completion of the CMP provides the necessary Assurance of the implementation of the Crypt-Key system

  • Validation and verification of the end to end Crypt-Key system is recommended and is the responsibility of the Delivery Team as part of the engineering assurance process

  • Procurement of foreign Crypt-Key systems is not recommended by the NCSC and may encounter technical challenges. Such cases must be raised with CyDR C-K at the earliest opportunity

Back to top