ADGM FSRA Information Technology Risk Management Guidance (VER01.201124) 13.1: Use recognised, current cryptographic schemes suited to each use case, keep them resistant to new techniques, secure any PKI and assess post-quantum needs

What does 13.1 require?

The cryptographic scheme applied matches what each use case needs for security, preferring well-established internationally recognised and tested schemes configured to current standards for key size, hash and random functions, deployed under the system development and testing framework. The institution follows industry developments to keep schemes resistant to new attack techniques and replaces outdated ones; where it runs its own public key infrastructure the certificate authority, registration authority, directory, certificate policy and management system are securely configured and protected, and third-party PKI receives due diligence; and it evaluates the need for post-quantum cryptography or quantum key distribution for sensitive datasets and communications, including against harvest-now-decrypt-later threats to long-lived high-value data.