A system for creating a security application, which comprises: a programmable cryptography module comprising module code for operating the programmable cryptography module, a file system that stores modes of operation of said programmable cryptography module and encryption algorithms for use by the programmable cryptography module and receives a binary security policy file that is formatted to load a security policy as code approved by a governmental authority, and a security policy software mode as a subset of the module code that enables modes and algorithms per a security policy to be read from the file system, wherein the security policy software module further comprises mirror security policy data structures that serve as a comparison limit for various cryptographic security policy functions of the security policy, said module further comprising a signature check module; and a processor external from the programmable cryptography module for determining a security policy for an implementation specific application as a set of rules governing cryptographic security policy functions, said processor being operative for generating a binary security policy file representative of the security policy and comparing the binary security policy file with the mirror security policy data structures to enable the cryptographic security functions of said policy upon successful comparison and further comprising an object distribution interface through which a user inputs data for generating the binary security policy file, wherein the processor is operable with the signature check module at the programmable cryptography module adapted to perform a signature check only one time on the code corresponding to the binary security policy file as approved by the governmental authority, wherein a cryptographic security policy function is enabled after a successful comparison without reapproval of the code. a programmable cryptography module comprising module code for operating the programmable cryptography module, a file system that stores modes of operation of said programmable cryptography module and encryption algorithms for use by the programmable cryptography module and receives a binary security policy file that is formatted to load a security policy as code approved by a governmental authority, and a security policy software mode as a subset of the module code that enables modes and algorithms per a security policy to be read from the file system, wherein the security policy software module further comprises mirror security policy data structures that serve as a comparison limit for various cryptographic security policy functions of the security policy, said module further comprising a signature check module; and a processor external from the programmable cryptography module for determining a security policy for an implementation specific application as a set of rules governing cryptographic security policy functions, said processor being operative for generating a binary security policy file representative of the security policy and comparing the binary security policy file with the mirror security policy data structures to enable the cryptographic security functions of said policy upon successful comparison and further comprising an object distribution interface through which a user inputs data for generating the binary security policy file, wherein the processor is operable with the signature check module at the programmable cryptography module adapted to perform a signature check only one time on the code corresponding to the binary security policy file as approved by the governmental authority, wherein a cryptographic security policy function is enabled after a successful comparison without reapproval of the code.