 Policies and procedures should be documented and carried out to ensure that all transmitted data is protected.The auditor should verify that management has controls in place over the data encryption management process.Access to keys should require dual control, keys should be composed of two separate components and should be maintained on a computer that is not accessible to programmers or outside users.