Chapter 7 — Cryptography and trust services: organizational integration
Lesson map
Lesson 07 published. Map, example, EX031.
flowchart TD
N0["Learning outcomes"]
N1["7.1 Standards into processes"]
N2["7.2 Ownership across units"]
N3["7.3 Procurement and suppliers"]
N4["7.4 Change management"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX031"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["7.1 Standards into processes"]
N2["7.2 Ownership across units"]
N3["7.3 Procurement and suppliers"]
N4["7.4 Change management"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX031"]
[Learning outcomes]
|
v
[7.1 Standards into processes]
|
v
[7.2 Ownership across units]
|
v
[7.3 Procurement and suppliers]
|
v
[7.4 Change management]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX031]
Learning outcomes
You will (1) embed cryptographic standards into organisational processes; (2) assign ownership across units; (3) integrate with procurement, architecture review and change management.
7.1 Standards into processes
A baseline in a document does nothing until processes use it. Leila embeds Corvane's cryptographic standard into four processes: architecture review, where new designs must state algorithms and key ownership; procurement, where suppliers answer a cryptography questionnaire; change management, where TLS and key changes need a rollback plan; and onboarding, where engineers learn the standard and its reasons. She publishes the standard with an approved-algorithms list and retirement dates, following the transition approach of SP 800-131A, and assigns the security architecture team to maintain it.
7.2 Ownership across units
Each business unit nominates a cryptography owner responsible for its inventory, renewals and migrations. Leila runs a monthly forum where owners share problems and progress. Ownership resolves a pattern seen in the inventory: certificates and keys with no clear owner were the ones that expired or lingered on deprecated algorithms. She defines a RACI chart: units are responsible for their systems, security architecture is accountable for the standard, operations is consulted on changes and the risk committee is informed quarterly.
7.3 Procurement and suppliers
Procurement becomes a lever. New contracts require support for TLS 1.3, documented key management, notification of key compromise within a set time and a post-quantum migration roadmap. Leila provides a scoring guide so procurement staff, who are not cryptographers, can evaluate answers. The first tender using the questionnaire rejects a supplier whose answers revealed hard-coded keys in its product. She notes that procurement cannot fix existing contracts quickly, so renewals become the main opportunity for older suppliers. She also offers procurement staff a short training session on the guide.
7.4 Change management
Cryptographic changes can break systems silently, for example a cipher suite removal that disconnects a partner. Leila adds a cryptographic change template: what changes, which clients might fail, how to detect failure, rollback steps and partner notification. Changes to legacy EDI require partner notice weeks in advance. After a change disconnects a small partner unexpectedly, she adds a pre-change client compatibility scan. Integrating cryptography into change management reduces both outages and the temptation to avoid security changes for fear of breaking things.
Worked example
Leila embeds the standard into architecture review, procurement, change management and onboarding, appoints unit owners with a RACI chart and adds a compatibility scan after a partner disconnection.
Synthetic case. Corvane's processes are invented; SP 800-131A is real.
Errors and limits
Standards without owners decay. Procurement questionnaires need scoring guidance or answers go unchecked.
Exercises
- EX031 — Four processes. Into which four processes was the standard embedded? Rubric: 3 = architecture review, procurement, change management, onboarding;; 2 = three;; 1 = one;; 0 = none.
- EX032 — Ownership pattern. What inventory pattern did unit ownership address? Rubric: 3 = unowned certificates and keys were those that expired or stayed on deprecated algorithms;; 2 = pattern;; 1 = vague;; 0 = none.
- EX033 — Contract requirements. List three contract requirements for new suppliers. Rubric: 3 = three of TLS 1.3, documented key management, compromise notification, PQ roadmap;; 2 = two;; 1 = one;; 0 = none.
- EX034 — Tender rejection. Why was a supplier rejected in the first tender? Rubric: 3 = answers revealed hard-coded keys in its product;; 2 = hard-coded keys;; 1 = price;; 0 = none.
- EX035 — Compatibility scan. What prompted the pre-change compatibility scan? Rubric: 3 = a change unexpectedly disconnected a small partner;; 2 = outage;; 1 = audit;; 0 = none.
Synthesis
Cryptography becomes organisational practice when standards drive processes, owners exist in every unit and changes are managed for compatibility.
Continue studying — chapter 07 of 12
← Chapter 06 (draft) · Course chapter index · Chapter 08 (draft) →