Bank of Mauritius Guideline on Use of Cloud Services (2022) 7.2.viii: Encrypt data at rest and in transit and manage encryption keys under institution control

What does 7.2.viii require?

Data stored on the cloud, data in transit and the channel used to access them are encrypted at a level proportionate to the materiality of the assets, the deployment model and the risks, with encryption keys stored separately from virtual images and data. The institution has a key management process: it may keep and manage keys itself (hardware security modules, virtual encryption tooling, cloud security tooling or a mix of these) or use the cloud key management service of a reputable third party with appropriate arrangements to secure the keys. Where it uses the key management service of the provider hosting its data it makes sure access to keys is segregated from access to customer information within the provider and that it understands and accepts the circumstances in which the provider may use or access the keys. Keys that protect core banking services are access-controlled, and the provider is given access to them only to deliver critical or security services agreed in advance.