The DSP has a policy or process governing the lifecycle of encryption keys to minimise the risk of key compromise, covering asymmetric (public key) algorithms, hashing algorithms and symmetric algorithms, with algorithm use aligned to the Australian Government guidelines for using cryptography; the policy or plan covers generation, distribution, storage, access, renewal, revocation, rotation, archiving, key length and complexity, destruction of compromised keys and recovery (the OSF points to APRA CPS 234 attachment F). Where a third party manages the keys, the DSP shows the relationship (contract or agreement). For categories D and E it applies where the product manages keys or PKI.
This control maps to 2 controls across 2 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 2 it maps to, and the evidence behind each claim, over MCP and REST.