Requirement:

If cryptographic mechanisms utilizing keys are approved for use in the IACS, the asset owner shall have policies and procedures around using, protecting and enforcing the lifetime of cryptographic keys follow practices and recommendations commonly accepted by both the industrial and security communities.

Guidance: