A policy establishing when and how encryption must be used to protect data at rest, in transit, and in use.