A.8.24
Use of cryptography
ISO 27001 · ISO/IEC 27001:2022 · Last verified July 2026
Objective
Use cryptography appropriately to protect the confidentiality, authenticity, and/or integrity of information according to organizational topic policies and risk.
Points of focus
- Cryptography policy or standard defined
- Keys and secrets managed with ownership
- TLS and at-rest protections for in-scope data
- Deprecation path for weak algorithms
Implementation notes
Publish a short cryptography standard: approved algorithms, TLS minimums, at-rest expectations for datastores and backups, and secret storage rules. Prefer cloud KMS/HSM-backed keys with least-privilege IAM. Keep application secrets out of git; rotate on cadence and on personnel change. Align with GDPR Art. 32 and HIPAA addressable encryption decisions when those laws apply — document why a given dataset is encrypted and who can decrypt.
Audit tip: Show key ownership and a recent secret-rotation or KMS policy sample — not only a statement that 'we use AES-256'.
Evidence auditors typically request:
- Cryptography / key-management standard
- Cloud KMS key inventory with owners and rotation policy
- TLS configuration evidence for public endpoints
- Secret management platform access reviews
Common gaps
- Keys in repos or shared password managers for production
- No inventory of where customer data is encrypted
- Legacy weak ciphers still enabled on admin endpoints
Cross-Framework Mapping
| Framework | Requirement | Implementation note |
|---|---|---|
| ISO 27001 | A.8.24 | This control |
| SOC 2 | CC6.1, CC6.7 | Related Trust Services Criteria themes — map in your crosswalk; not identical requirements. |
| GDPR | Article 32 | Related GDPR articles for personal-data security or processor themes — not a compliance claim. |
| HIPAA | 164.312(a)(2)(iv) | Related HIPAA Security Rule citations when PHI is in scope — SoA does not replace BAAs. |
Primary sources
- ISO/IEC 27001:2022 Annex A: ISO/IEC 27001:2022 Annex A (A.8.24)