8.24 Use of cryptography
Requires defined and implemented rules on using cryptography effectively, including how cryptographic keys are managed.
5
artefacts
0
held by a system
2
at each review
hard
to go live
Document repository
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Evidence of implementation, sampled across data at rest, data in transit and any application layer encryption · Document repository
- Evidence of key protection, such as hardware security modules or a managed key service, with access controls and dual control where warranted · Document repository
governing documentDocuments that govern the control
- The cryptography rules, defining approved algorithms, key lengths and protocols, and where cryptography must be used · Document repository
- The key management procedures covering generation, distribution, storage, rotation, revocation, archival and destruction · Policy repository / GRC workspace
- Records of periodic review against current cryptographic guidance, and a plan for deprecating weak algorithms · Policy repository / GRC workspace
First move
This control is evidenced by people and documents, not systems. Put the document under version control with an owner and review date, and log each review as a record with reviewer and date. Do not try to automate it.
Common gaps auditors find
- Rules defined while deprecated protocols and cipher suites remain enabled on live services
- Key management undocumented, so nobody can say where a key is held, who can use it or when it was last rotated
- Rotation never performed because the process was never built, so keys are effectively permanent
- Encryption claimed from a cloud service default with no control over, or knowledge of, key custody
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet