Blockchain Transaction Lifecycle Security Standard Audit Framework

previous: Document Cryptography Migration Procedures | Contents page | next: Implement Readability Standards

Prepare for Cryptography Migration

Statement of Requirement:

All Actors SHOULD maintain operational readiness to adopt updated cryptographic schemes in accordance with protocol governance timelines.

See it in the Specification

Purpose

Ensure Actors can respond to changes in the cryptography environment in a timely manner

Audit Procedure

Verify operational readiness to implement cryptography migration, as outlined for Document Cryptography Migration Procedures, covering

• key management system capability assessments,
• software compatibility evaluations for post-quantum algorithms,
• infrastructure readiness assessments,
• staff training records,
• allocated resources/budget.

Key Evidence

• Operational readiness assessment for cryptographic migration
• Key management system capability inventory; vendor/supplier readiness evaluations
• Staff training records on cryptographic migration
• HSM firmware versions supporting post-quantum algorithms; testnet node logs using post-quantum schemes
• Vendor communications regarding post-quantum support timelines

Success Criteria

• The Actor has assessed their key management system's ability to support updated cryptographic schemes
• Critical dependency readiness has been evaluated (e.g. HSM, client software, cloud services)
• At least one concrete readiness measure is in place (testing, training, or infrastructure preparation)
• The Actor can provide realistic timeline estimate for executing a migration

Failure Criteria

Any of these circumstances is likely to mean the Requirement is not met.

• No readiness assessment has been conducted
• The Actor has not evaluated post-quantum capabilities of key management infrastructure
• No concrete readiness measures exist (readiness entirely theoretical)
• The Actor's readiness timeline significantly exceeds known protocol governance timelines

Justifiable Exceptions

Any failure to meet this requirement needs to be explicitly justified

Common Failure Patterns

• The Actor considers cryptographic migration a distant future concern with no preparatory action;
• readiness is assessed theoretically but not validated against actual infrastructure (e.g., HSM post-quantum support is assumed but not verified with vendor);
• key management systems locked to specific algorithms with no migration path;
• staff have not received training on post-quantum concepts;
• no scenario except a shift to post-quantum cryptography is contemplated as necessitating a migration of algorithms;
• dependencies on third-party services create unaccounted bottlenecks.

Other Relevant Standards

ISO 27001

A.8.24, A.5.30, A.6.3

SOC 2

CC6.1, CC1.4, CC9.1

PCI DSS

4.2.1, 12.6, 12.3.3

NIST CSF

PR.DS-01, PR.DS-02, PR.AT-01, GV.SC-05

previous: Document Cryptography Migration Procedures | Contents page | next: Implement Readability Standards