Cryptographic controls can ensure the availability, authenticity, integrity, and confidentiality of data. Financial entitiesas defined in Article 2, points (a) to (t) referred to in Title II of this Regulation should therefore identify and implement such controls on the basis of a risk-based approach. To that end, financial entitiesas defined in Article 2, points (a) to (t) should encrypt the data concerned at rest, in transit or, where necessary, in use, on the basis of the results of a two-pronged process, namely data classification and a comprehensive ICT riskany reasonably identifiable circumstance in relation to the use of network and information systems which, if materialised, may compromise the security of the network and information systems, of any technology dependent tool or process, of operations and processes, or of the provision of services by producing adverse effects in the digital or physical environment assessment. Given the complexity of encrypting data in use, financial entitiesas defined in Article 2, points (a) to (t) referred to in Title II of this Regulation should encrypt date in use only where that would be appropriate in light of the results of the ICT riskany reasonably identifiable circumstance in relation to the use of network and information systems which, if materialised, may compromise the security of the network and information systems, of any technology dependent tool or process, of operations and processes, or of the provision of services by producing adverse effects in the digital or physical environment assessment. Financial entitiesas defined in Article 2, points (a) to (t) referred to in Title II of this Regulation should, however, be able, where encryption of data in use is not feasible or is too complex, to protect the confidentiality, integrity, and availability of the data concerned through other ICT security measures. Given the rapid technological developments in the field of cryptographic techniques, financial entitiesas defined in Article 2, points (a) to (t) referred to in Title II of this Regulation should remain abreast of relevant developments in cryptanalysis and consider leading practices and standards. Financial entitiesas defined in Article 2, points (a) to (t) referred to in Title II of this Regulation should hence follow a flexible approach, based on risk mitigation and monitoring, to deal with the dynamic landscape of cryptographic threats, including threats from quantum advancements.