This tool contains two sample policies that establish guidelines for use of encryption to secure company information assets and applications.

In these samples, keys will be securely distributed; keys will be securely stored within all applications; keys will be changed at least annually; old keys will be revoked and destroyed when data that was encrypted with the key no longer exists; dual control of keys will be required to create keys; preventive controls will be in place to prevent unauthorized substitution of keys; keys suspected of compromise will be suspended; and audit trails will be kept to show any time a key is created, modified or deleted.