DP010Encryption and rights management

The protection of information such that possession of the file is not possession of its contents.

Control	Jurisdiction	Source	What it establishes	Prerequisite or recommendation
DP010/EUMandatory	European Union	Directive (EU) 2022/2555, article 21European Parliament and Council · read 29 Aug 2026	That asset management, access control policies, human resources security, cryptography, and training are among the measures an entity in scope has to take, without saying what any of them holds.	Policies and procedures on the use of cryptography and, where appropriate, on encryption are named among the measures an entity in scope has to take.