Key takeaways
- Define and apply rules for effective use of cryptography and key management.
- Encryption protects data when other controls fail.
- Start here: define a cryptography policy for data at rest and in transit.
Purpose
Define and apply rules for effective use of cryptography and key management.
Requirement
Requirement summaryRules for the effective use of cryptography, including cryptographic key management, shall be defined and implemented.
Why it matters
Encryption protects data when other controls fail.
How to implement
- Define a cryptography policy for data at rest and in transit.
- Use current, strong algorithms and protocols.
- Manage keys securely across their lifecycle.
- Review crypto settings when standards change.
What evidence you need to provide
Here is what you will typically need to provide for Annex A 8.24. It does not matter which system it lives in: a document, screenshot or export is fine.
Documents to have ready
- Your encryption policy: when encryption must be used and how keys are managed.
- Your Statement of Applicability (SoA: the list of all 93 controls showing which you use and why) with A.8.24 marked as used or not used, a short reason, and its current status.
Records and examples to show
- Settings showing sensitive data is encrypted when stored and when sent.
- A list of encryption keys and certificates with owners and expiry dates.
- Records of keys being changed or revoked.
- Proof certificates are renewed before they expire.
Things you should be able to show or explain
- Be able to show encryption settings on a key system.
How much to show: Three to five systems and your key list.
Common mistakes
- Old, weak encryption.
- Keys stored next to the data they protect.
- Old protocols left enabled.
- Keys stored next to the data they protect.
- Tip: Write a short crypto standard listing approved algorithms.
Policies & documents to have
- Cryptography Policy
FAQ
Is A.8.24 mandatory?
Annex A controls are not automatically mandatory. You must consider every control and record in your Statement of Applicability whether it applies and why. In practice, most organisations include this one.
What will I need to show for A.8.24?
Be ready to explain how the control works in your organisation and to provide things like: Your encryption policy: when encryption must be used and how keys are managed…