ISO 27001 Use of Cryptography Explained – Annex A 8.24

ISO 27001 Annex A 8.24 sets clear rules for using encryption to protect sensitive data. Managing these guidelines through everyday work systems ensures information stays confidential and secure.

Key Takeaways

• Establish Cryptographic Policy: Draft and publish a comprehensive policy in SharePoint defining standards for data encryption at rest, in transit, and in use.
• Document Encryption Standards: Maintain version-controlled technical guidelines in Confluence detailing approved cryptographic algorithms, minimum key lengths, and cipher suites.
• Manage Cryptographic Keys: Define formal processes for key generation, distribution, storage, rotation, revocation, and destruction in a central repository.
• Enforce Transport Encryption: Mandate strong encryption protocols (e.g., TLS 1.3, IPsec) for all sensitive data moving across internal and external networks.
• Enforce Storage Encryption: Apply full-disk encryption on mobile devices and database-level or file-level encryption for sensitive data at rest.
• Build Cryptographic Workflows: Route key access requests, algorithm exception approvals, and key destruction procedures through formal Jira tickets.
• Monitor Key Lifecycle Compliance: Track key expiration dates and schedule routine rotations using automated tasks linked to operational management logs.
• Review Policy Governance: Re-evaluate cryptographic rules, key management roles, and threat risks annually with notes recorded in management review minutes.

How to Implement ISO 27001 Annex A 8.24

• Define Master Cryptographic Standards: Publish a comprehensive cryptographic policy in SharePoint establishing approved encryption standards, cipher suites, and key lengths across all asset types.
• Classify Data Encryption Requirements: Identify and document specific data categories requiring encryption at rest (databases, storage buckets) and in transit (TLS protocols, VPN tunnels) in Confluence.
• Document Key Lifecycle Procedures: Detail full key management processes—including generation, distribution, rotation, storage, revocation, and destruction—in your technical wiki.
• Automate Recurring Key Management Tasks: Set up scheduled Jira tickets to track key expiration dates, policy revalidation, and mandatory key rotation cycles.
• Appoint and Record Key Custodians: Formalize key management responsibilities, key custodian assignments, and split-knowledge authorization roles in management review minutes.
• Audit Technical System Configurations: Audit cloud key management systems (KMS), database encryption keys, and TLS settings regularly to verify alignment with your SharePoint policy.
• Centralize Vendor Service Reports: Store third-party HSM (Hardware Security Module) audit reports, provider certificates, and key management service logs in SharePoint.
• Enforce Strong Key Generation Protocols: Ensure all cryptographic keys are generated using cryptographically secure pseudo-random number generators (CSPRNGs) and protected by strong access controls.

How to Audit ISO 27001 Annex A 8.24

• Inspect Cryptographic Policies: Review the cryptographic management policy in SharePoint to verify that rules governing key generation, algorithm selection, usage lifetimes, and storage standards are documented and approved.
• Verify Encryption Algorithms: Inspect system configuration files, database settings, and cloud services to verify approved encryption standards (e.g., AES-256, TLS 1.3) are actively enforced for data at rest and in transit.
• Audit Key Management Lifecycle Controls: Examine key management procedures in Confluence to confirm secure generation, distribution, access restrictions, rotation schedules, and destruction mechanisms for cryptographic keys.
• Sample Hardware Security Modules (HSMs) & Vaults: Sample access logs and configuration settings for KMS systems or HSMs to ensure master keys are separated from encrypted data and restricted to authorized roles.
• Check Public Key Infrastructure (PKI) Certificates: Audit SSL/TLS certificate inventories and Jira tickets to verify active certificates are issued by trusted certificate authorities and managed prior to expiration.
• Verify Data at Rest Encryption: Inspect configuration proofs for databases, cloud storage buckets (e.g., AWS S3, Azure Blob), and full-disk endpoint encryption (e.g., BitLocker) to confirm default encryption is active.
• Inspect Key Compromise Playbooks: Review documented incident response plans and emergency key revocation procedures to verify rapid containment steps in the event of a key compromise are defined.
• Examine Cryptographic Review Logs: Check meeting records and security assessment reports in internal repositories to verify cryptographic standards, cipher suites, and key inventories are revalidated regularly.
• Verify Separation of Key Custodian Duties: Audit access permissions and split-knowledge authorization logs to confirm dual control is enforced for sensitive key management operations.
• Audit Endpoint Disk Encryption Management: Inspect central endpoint management portals to confirm mobile devices and laptops maintain active, uncompromised full-disk encryption compliance.

Audit Evidence Checklist

• Cryptographic Policy Document: Present the master Cryptographic Policy stored in SharePoint, complete with formal version history and management sign-off metadata.
• Key Lifecycle Jira History: Supply full Jira ticket logs showing key generation, scheduled rotation, access granting, and secure destruction workflows with associated approvals.
• Confluence Key Management Manual: Provide the technical key management operations manual published in Confluence, detailing approved ciphers, key lengths, and emergency revocation steps.
• Key Custodian Appointment Minutes: Share formal leadership meeting minutes in SharePoint documenting the designation of key custodians, split-knowledge roles, and key access permissions.
• Cryptographic Asset Register: Produce a version-controlled inventory detailing master keys, certificates, KMS aliases, hardware security modules (HSMs), and their exact system locations.
• Data Encryption Risk Assessments: Present documented risk evaluations justifying chosen encryption strengths, algorithm selections, and key lifetime limits for sensitive data assets.
• SSL/TLS Certificate Inventories: Provide active PKI certificate logs and automated renewal records demonstrating proactive management of public-facing and internal domain certificates.

What to Teach Employees

• Understand Encryption Basics: Teach employees how encryption protects confidential company data and customer information from unauthorized access at rest and in transit.
• Enforce Full-Disk Encryption: Show mobile and office staff how to verify BitLocker or FileVault is active on company laptops before working remotely.
• Use Approved Storage Vaults: Train developers and system admins to store API keys, tokens, and database passwords in secure key vaults rather than hardcoding them in scripts or source code.
• Protect Encryption Keys: Remind technical staff that private keys and master secrets must never be shared via email, chat apps, or unencrypted tickets.
• Verify Secure Data Transfers: Show staff how to confirm web applications and file transfers use HTTPS and secure protocols (e.g., SFTP, TLS) when handling sensitive data.
• Follow Key Rotation Schedules: Train key custodians and cloud operators to execute routine key rotations using Jira tickets in accordance with central cryptographic policy rules.
• Report Expired Certificates: Teach web and system leads to monitor TLS certificate expiration dates and log renewal tickets before services experience downtime.
• Report Suspected Key Breaches: Train staff to notify the IT security team immediately if an encryption key, token, or secret management vault credential is exposed or compromised.
• Respect Cryptographic Governance: Instruct technical teams where to find approved cipher suites, minimum key lengths, and policy standards in Confluence and SharePoint.

Common Implementation Challenges

• Hardcoded Secrets in Source Code: Developers frequently hardcode API keys, database credentials, and private keys into code repositories instead of retrieving them dynamically from secure key management vaults.
• Poor Key Lifecycle Management: Inconsistent processes for cryptographic key generation, rotation, and destruction often lead to stagnant keys remaining active long past their recommended operational lifetime.
• Legacy Systems Supporting Weak Ciphers: Outdated internal applications and older network hardware frequently rely on deprecated algorithms (e.g., DES, SHA-1, TLS 1.0) that cannot be upgraded without breaking legacy integrations.
• Unmanaged Certificate Expirations: Lack of centralized tracking for SSL/TLS certificates across cloud environments and internal subdomains results in sudden service outages due to unexpected certificate expiration.
• Insecure Storage of Master Keys: Storing cryptographic keys on the same physical server or database drive as the encrypted data renders the encryption ineffective if the underlying host is compromised.
• Performance Overhead of High-Volume Decryption: Encrypting large database fields or inspecting encrypted HTTPS traffic at scale can introduce latency and processing bottlenecks on application servers.
• Lack of Key Revocation Playbooks: Organizations often lack tested emergency procedures to rapidly revoke, rotate, and re-encrypt data in the event of a confirmed key leak or vault exposure.
• Fragmented Multi-Cloud KMS Environments: Managing separate key management services across AWS, Azure, and on-premise Hardware Security Modules (HSMs) leads to inconsistent access policies and audit blind spots.

How to Measure Effectiveness (KPIs)

• Hardcoded Secret Exposure Count: Tracks the number of plain-text API keys, passwords, or tokens detected in source code repositories during automated secret scans.
• Cryptographic Key Rotation Rate: Measures the percentage of active master keys, database encryption keys, and API tokens rotated on schedule according to key policy lifetimes logged in Jira.
• Data at Rest Encryption Coverage: Tracks the percentage of active production databases, cloud storage buckets, and mobile endpoints with mandatory full-disk or field-level encryption active.
• Expired Certificate Outage Count: Measures the number of operational disruptions or service downtime events caused by unrenewed or expired SSL/TLS certificates.
• Deprecated Cipher Usage Rate: Tracks the percentage of internal applications, API endpoints, or network services still permitting weak or deprecated protocols (e.g., TLS 1.0, DES, SHA-1).
• Key Vault Access Audit Rate: Measures the percentage of Key Management Service (KMS) access policies and Hardware Security Module (HSM) roles reviewed and revalidated every quarter.
• Mean Time to Revoke Compromised Keys: Measures the average time elapsed between detecting a secret or key exposure and completing full revocation and re-encryption.
• Data in Transit Encryption Compliance Rate: Tracks the percentage of internal and external network connections strictly enforcing modern, approved TLS standards.

Related ISO 27001 Controls

Annex A 8.24 interacts with several core requirements:

• ISO 27001 Clause 8.1: Operational planning and control.
• ISO 27001 Annex A 5.15: Complements access control policies.
• ISO 27001 Annex A 8.10: Information deletion and secure disposal.