Control A.8.24Use of cryptography
Rules for the effective use of cryptography, including cryptographic key management, must be defined and implemented.
Two halves, and the second is where implementations fail. Defining where cryptography is used — data at rest, in transit, and the integrity and authenticity mechanisms — is the straightforward part. Key management is the hard part: generation, distribution, storage, rotation, revocation, recovery and destruction.
Encryption with poorly managed keys provides the appearance of protection. Keys stored beside the data they protect, embedded in code, or held with no recovery path convert a confidentiality control into either no control or an availability risk.
The rules also have to state what is acceptable — algorithms, strengths and protocols — and be reviewed, because that answer changes. Organisations with long-lived data now also need a view on when their current choices stop being adequate.
Cryptography attracts legal constraint in some jurisdictions, which A.5.31’s register should record rather than leave for a deployment to discover.
How to put this in place
Encryption protects information only if it is used where needed and its keys and certificates are looked after. Your ISMS needs agreed rules for what is encrypted and how keys and certificates are managed, or protection fails quietly, for example when a certificate expires.
- Decide where encryption is required: devices, data in transit, sensitive data at rest and backups.
- Set the allowed algorithms and protocols, and disable outdated ones.
- Decide who holds keys, where they are stored and how they are rotated.
- Keep an inventory of certificates and keys with expiry dates and alerts.
- Check a sample of systems against the rules.
Evidence an auditor usually looks for: the cryptography standard, encryption settings on a sample of systems, and the certificate and key inventory with expiry dates.
What is in the packs for this
From ISO 27001 Implementation & Certification Readiness. Each one helps with this requirement.
Annex A Control Implementation LibraryExcel
Its row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies.
Statement of Applicability TemplateExcel
Has its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented.
Mandatory ISMS Documentation ChecklistExcel
Annex A Documents sheet: lists rules for cryptography and key management among the documents auditors commonly expect for this control.