Blockchain Transaction Lifecycle Security Standard Audit Framework

previous: Manage a Secure Software Supply Chain | Contents page | next: Prepare for Cryptography Migration

Document Cryptography Migration Procedures

Statement of Requirement:

All Actors MUST document plans and any procedures for cryptographic migration scenarios, including protocol-level transitions to post-quantum algorithms.

See it in the Specification

Purpose

Provide transparency into resilience planning

Audit Procedure

• Verify that for each method documented for Document Hashing Process, and for all software described in Document Software Supply Chain there is a migration strategy. This could be "keep the software up to date to adopt cryptography changes".
• Review coverage of: learning of required migration, scope/impact assessment, key/certificate migration steps, node software update procedures, testing/validation, rollback, and timeline commitments aligned with protocol governance.
• Verify that cryptographic migration procedures are accessible to customers
• Review tabletop exercises, simulations, or partial tests of migration procedures.

Key Evidence

• Cryptographic migration contingency plan; key migration procedures
• Post-quantum readiness assessment
• Cryptographic algorithm inventory provided for Document Hashing Process
• Documentation provided for Document Software Supply Chain
• Tabletop exercise records or simulation results
• Auditor-verified customer accessibility of procedures

Success Criteria

• Cryptographic migration plans procedures are documented. Note that documenting that
  • there are no plans, or
  • the only plans are to accept upstream changes made in Protocols and software used are both acceptable if they are accurate statements
• Documentation is customer-accessible

Best Practice

• Documented procedures cover migration triggers, execution steps, testing, rollback, and post-quantum scenarios
• Engineering/security personnel demonstrate awareness of migration challenge and contingency plan

Failure Criteria

Any of these circumstances is likely to mean the Requirement is not met.

• No cryptographic migration procedures exist
• Procedures exist but do not reference post-quantum cryptography or protocol-level transitions
• Procedures are purely aspirational with no actionable steps
• Documentation is not accessible to customers

Common Failure Patterns

• Procedures reference "follow protocol guidance when available" without defining interim actions;
• Migration procedures do not address the Actor's specific architecture (particularly HSMs, remote signers, multi-sig);
• post-quantum is mentioned generically with no specific algorithms or migration paths;
• no scenario except a shift to post-quantum cryptography is contemplated as necessitating a migration of algorithms
• no tabletop exercise has been conducted.

Other Relevant Standards

ISO 27001

A.8.24, A.5.30, A.8.32

SOC 2

CC6.1, CC3.1, CC8.1

PCI DSS

4.2.1, 12.3.3

NIST CSF

PR.DS-01, PR.DS-02, GV.SC-05

previous: Manage a Secure Software Supply Chain | Contents page | next: Prepare for Cryptography Migration