𝐃𝐨 𝐨𝐫𝐠𝐚𝐧𝐢𝐬𝐚𝐭𝐢𝐨𝐧𝐬 𝐫𝐞𝐚𝐥𝐥𝐲 𝐧𝐞𝐞𝐝 𝐚 𝐬𝐭𝐚𝐧𝐝𝐚𝐥𝐨𝐧𝐞 𝐂𝐫𝐲𝐩𝐭𝐨𝐠𝐫𝐚𝐩𝐡𝐲 𝐏𝐨𝐥𝐢𝐜𝐲? I’m starting to think the default answer of “yes” might be wrong. I recently reviewed the Dutch Government’s Framework Cryptography Policy for the Central Government. What’s interesting is that it doesn’t push organisations to create yet another standalone document. Instead, it recognises that cryptographic governance can - and often should - be embedded across