Use of cryptography

Plain-language summary

Setting and applying rules for using encryption and other cryptography properly — what must be encrypted at rest and in transit, with which methods — and managing keys and certificates through their whole life so the protection holds and nothing becomes unrecoverable.

What the clause is really asking

Encryption protects information when other controls have failed: the stolen laptop, the missing backup drive, the intercepted message. The control asks you to define rules for cryptography in a topic-specific policy — which information and devices must be encrypted, in storage and in transit, and which algorithms and protocol versions are acceptable — and to manage keys through their life cycle: generation, storage, distribution, rotation, backup and recovery, revocation and destruction. Certificates are keys too, and an expired TLS certificate is one of the most visible failures. The common misunderstanding is that switching on BitLocker is the whole answer; the audit asks who holds the recovery keys and whether you could recover a drive. In South Africa, POPIA section 19 requires reasonable technical measures to protect personal information, and encryption at rest and in transit is one of the first measures anyone asks about after a loss. Whether lost data was encrypted, with the keys kept safe, also shapes your section 22 assessment of whether personal information was actually accessed. Legal limits on cryptography across borders sit under 5.31.

What auditors look for

Auditors ask for the cryptography policy and then check it against reality. They pull the device management report showing encryption status for laptops and phones and ask about the ones not compliant. They ask where BitLocker or FileVault recovery keys are stored and who can retrieve them, and may ask you to retrieve one. They check how backups are encrypted, which TLS versions your public sites and mail servers accept, and whether databases holding personal information are encrypted. They ask for the certificate inventory and how you know one is about to expire. The hard question: if the person who manages your keys left tomorrow, could you still decrypt your backups?

Typical evidence

Cryptography and key management policy; list of approved algorithms and protocol versions; device encryption compliance report; recovery key escrow configuration and access list; certificate inventory with expiry dates and renewal owners; TLS configuration scan results; backup encryption settings; key rotation and revocation records; evidence of encryption for personal information at rest and in transit.

How to comply — recommendations

Write a two-page cryptography policy: what must be encrypted (laptops, phones, removable media, backups, databases and file stores holding personal or confidential information, and all data in transit over public networks), acceptable algorithms and protocols (current AES, TLS 1.2 or later) and who manages keys. Enforce disk encryption through device management and escrow recovery keys centrally with restricted access. Keep a certificate inventory with owners and renewal reminders 30 days ahead, or automate renewal. Hold backup and administrator keys in a password vault with a break-glass procedure. Scan public services for weak protocols annually and review the policy when accepted algorithms change.

Common nonconformities

No cryptography policy or key management rules; laptops or removable media unencrypted; recovery keys held by one person or not escrowed; backups unencrypted; expired or self-signed certificates on public services; outdated TLS or SSL versions accepted; no certificate inventory; personal information stored or sent unencrypted despite POPIA section 19 commitments; keys never rotated.

Resources for this clause

• ArticleISO/IEC 27001:2022 Annex A explained: the 93 controls in plain English, theme by theme, with the 114-to-93 map and the attribute tags
• ArticleThe Statement of Applicability, explained — what ISO/IEC 27001 clause 6.1.3 requires, the four ways an SoA fails Stage 1, and how to build one from the risk register
• ArticleISO/IEC 27001:2022 explained for people who already run ISO 9001: what is the same, what is new, and how to get certified
• Toolkit · $39Risk & SoA ToolkitScore your information security risks on a documented method, pick the Annex A controls that treat them, and the Statement of Applicability writes its own first draft — every justification citing the risks behind it.
• Toolkit · $29ISMS Metrics & Evidence TrackerThe three things an ISMS has to show after certification, in one workbook: measures with a live Green / Amber / Red status, management review minutes that cover every required input, and an evidence register that gives every control an owner, a rhythm and a due date.
• Free downloadAnnex A 93 Controls Quick ReferenceOne A3 page: all 93 Annex A controls in their four themes, the eleven new in 2022 flagged, and the ISO/IEC 27002:2022 attribute legend — the poster for the wall beside the Statement of Applicability.
• Free downloadISO 27001 Gap Analysis ChecklistWhere you stand against ISO/IEC 27001:2022 in one afternoon — the 30 management-system requirements and all 93 Annex A controls, scored, with owners, dates and a readiness figure that calculates itself.
• Free masterclass · ~27 minISO 27001 MasterclassYou already know four fifths of ISO 27001. Here is the other fifth — the risk method, the SoA, the 93 controls, the evidence rhythm, POPIA, and a 44-week path.
• Free appAudit ManagerPlan the programme, anchor each finding to its clause and drive the NC to closure.