Tia is developing an encryption policy for her organization. Company management wants to use encryption for sensitive data when in storage and when transmitted outside of the organization. Tia's managers also want to implement the use of secure e-mail as well as digital signatures to sign sensitive documents. In addition to the appropriate policies and procedures, Tia must also set up a PKI in the organization. Which of the following should Tia include in the policy to enforce the use of only organizationally approved encryption methods and keys?