← ISO 27001 · A.8 — Technological
A.8.24 — Use of cryptography
critical
encryption-at-restencryption-in-transitkey-management
Requirement
Rules for the effective use of cryptography, including cryptographic key management, shall be defined and implemented.
What the engine looks for
Every group below must be satisfied — by an affirmative statement, not a plan, a hedge or a denial — for the control to count as covered. A term ending in … matches any word it begins. Supporting terms do not change the verdict — they raise confidence and distinguish a policy that names a mechanism from one that gestures at a category.
Required element 1 — any one of
cryptograph…encryptionencrypt
Required element 2 — any one of
key managementkmskey rotationalgorithmstandardstandardisedstandardized
Supporting terms — specificity signals
aes-256tls 1.2tls 1.3hsmrotate annuallyapproved algorithmsno deprecated
Contradiction markers
Finding any of these outranks coverage — a policy that admits the gap is worse than silence.
md5
sha1 for signing
des
unencrypted
keys in source control
Equivalent controls elsewhere
Matched on shared topics. Satisfying this control usually moves these too.
| Framework | Control | Title | Shared topics |
|---|---|---|---|
| GDPR | Art.5(1)(f) | Integrity and confidentiality | encryption-at-rest encryption-in-transit |
| SOC 2 | CC6.7 | Restriction of information transmission, movement and removal | encryption-in-transit encryption-at-rest |
| PCI DSS 4.0.1 | 3.5 | PAN is rendered unreadable wherever it is stored | encryption-at-rest key-management |
| HIPAA | 164.312(a)(2)(iv) | Encryption and decryption at rest (A) | encryption-at-rest key-management |
| GLBA | 314.4(c)(3) | Encryption of customer information in transit and at rest | encryption-at-rest encryption-in-transit |
| NIST CSF 2.0 | PR.DS-01 | Confidentiality, integrity and availability of data at rest | encryption-at-rest key-management |
| GDPR | Art.32 | Security of processing | encryption-at-rest encryption-in-transit |
| NDPA 2023 | s.39 | Security, integrity and confidentiality | encryption-at-rest encryption-in-transit |