1. Document Control

• Document Title: Encryption Policy

• Document Identifier: POL-ALL-005

• Version Number: v1.0

• Approval Date: <23 June 2025>

• Effective Date: <23 June 2025>

• Review Date: <23 June 2026>

• Document Owner: <Chief Information Security Officer>

• Approved By: <Information Security Governance Committee>

2. Purpose

The purpose of this Encryption Policy is to define the requirements and standards for using encryption to protect sensitive information stored, processed, or transmitted by . Encryption is a critical control for maintaining confidentiality and integrity, especially for personal data, financial records, intellectual property, and other proprietary information.

This policy ensures that implements strong encryption methods across all systems, aligns with regulatory and industry expectations, and mitigates the risk of data breaches, interception, or unauthorized access. It supports compliance with SOC 2 Trust Services Criteria CC6.1 and CC6.2, and ISO/IEC 27001:2022 Controls A.8.24 through A.8.28, which mandate secure cryptographic controls and key management practices.

3. Scope

This policy applies to all employees, contractors, and third parties who use or manage systems handling data. It covers:

• Data at rest (on endpoints, servers, databases, backups, removable media)

• Data in transit (over email, networks, web, cloud services, APIs)

• Data within SaaS applications and cloud storage

• Cryptographic keys and key management systems

This policy applies to both company-owned and third-party-managed infrastructure where company data is stored or transmitted. Exceptions must be documented and approved through the established exception process.

4. Policy Statement

mandates the use of strong encryption to safeguard sensitive and regulated data. The organization shall:

1. Use only approved encryption algorithms and configurations for all cryptographic implementations (see Section 5).

2. Encrypt sensitive data at rest and in transit using minimum standards outlined in this policy.

3. Enforce encryption for all remote access, wireless communication, portable devices, and mobile endpoints.

4. Prohibit the use of proprietary or unvetted cryptographic methods without formal approval.

5. Store encryption keys securely, separate from the data they protect, using managed key management systems.

6. Conduct annual reviews of cryptographic implementations and key rotation schedules.

5. Safeguards

enforces the following encryption standards and controls: