## 1 Introduction  
Dealing with information securely is a key issue for organizations of all sizes and across all industries. Due to the greatly increased media attention triggered by security incidents that have been made public, the subject of Information Security (IS) has become an important part of many organizations. As a result of these media events, many executives have become more aware of the issue, and their interest in preventing security incidents has increased. Information Security Management (ISM) is no longer viewed solely as a cost factor; instead, it has emerged as a key discipline for gaining competitive advantage and is pivotal in securing organizational assets and intellectual property. Furthermore, national and international regulations, such as the General Data Protection Regulation (GDPR) [1] or the Network and Information Security (NIS) Directive [2], impose a strict legal framework that gives organizations an additional incentive to protect their data. In this evolving landscape,the role of cryptography has become indispensable, serving as a fundamental layer in the multifaceted approach toward robust Information Security. Cryptography, which encompasses techniques such as encryption and hashing, is instrumental in ensuring the confidentiality, integrity, and authenticity of data, thereby mitigating the risks associated with unauthorized access and data breaches. The application of cryptographic measures is especially vital in the context of data privacy [3], where the safeguarding of sensitive information is paramount. The above-mentioned regulations not only necessitate the implementation of strong cryptographic controls but also emphasize the importance of maintaining a balance between data accessibility and security, underscoring the significance of cryptography in achieving compliance. The GDPR, for instance, explicitly requires the encryption of personal data [4] in transit and at rest, thereby illustrating the integral role cryptography plays in protecting individuals' privacy [5]. Beyond simply meeting regulatory requirements, the strategic use of cryptography boosts an organization's credibility and trust among stakeholders, clients, and partners. With the rise in data breaches and cyber threats, businesses that showcase dedication to data privacy with strong cryptographic measures are more apt to cultivate trust and loyalty. This can result in a lasting competitive edge. The proactive adaptation and integration of advanced cryptographic solutions also enable organizations to stay ahead of emerging threats, thereby reinforcing their security posture and ensuring the resilience of their information systems. Within the broader IS context, the Research and Education (R&E) sector is not exempt. Universities and research institutions have increasingly come under the scanner of cyber threats. Therefore, it is necessary to address ISM in higher education as well and provide guidance to R&E service and infrastructure providers on how to implement a security program. National Research and Education Networks (NREN) are at the center of scientific IT infrastructure. They connect the higher education facilities in their country and provide them with networks, basic infrastructure, and other IT services. Consequently, they not only need to protect themselves but also play a central role in securing their constituents. European NRENs collaborate under the umbrella of the GEANT Project [6], a joint venture funded by the European Union Horizon Framework Partnership Agreement. In this project, the organizations not only develop and operate shared services, including R&E core services such as eduGAIN, eduroam, and eduVPN, but also work jointly on common IS challenges. This collaboration puts the NRENs in the perfect position to establish a common security architecture and support each other in implementing necessary measures. Since 2019, the GEANT project has also been working more closely in the area of ISM in order to standardize and improve many security aspects within the community.