ISO 27002:2022
Technological controls – ISO 27002:2022

ISO 27002:2022 8.24: Use of cryptography

Requires defined and implemented rules on using cryptography effectively, including how cryptographic keys are managed.

What else in your programme already covers this

This control maps to 176 controls across 33 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

PCI DSS 4.0 · 28 controls

  • 10.1.1 Requirement 10 policies and operational procedures documented and maintained
  • 10.1.2 Requirement 10 roles and responsibilities documented and assigned
  • 12.3.3 Cryptographic cipher suites and protocols inventory
  • 2.2.7 Non-console administrative access encrypted
  • 2.3.2 Wireless encryption keys rotated
  • 3.3.2 SAD stored prior to authorization is encrypted
  • 3.5.1 PAN rendered unreadable wherever stored
  • 3.5.1.1 Hashes of PAN use keyed cryptographic functions
  • 3.5.1.2 Disk-level encryption with logical access controls
  • 3.5.1.3 Disk-level encryption key management
  • 3.6.1.1 Documented description of cryptographic architecture
  • 3.6.1.2 Secret and private keys restricted to fewest custodians
  • 3.6.1.4 Cryptographic keys stored in fewest possible locations
  • 3.7.2 Secure key distribution
  • 3.7.3 Secure key storage
  • 3.7.4 Cryptoperiod and key changes
  • 3.7.5 Retirement or replacement of keys
  • 3.7.6 Manual cleartext key operations use split knowledge
  • 3.7.7 Prevent unauthorised substitution of keys
  • 4.2.1 Strong cryptography and security protocols are implemented as follows to safeguard PAN during transmission over open, public networks: • Only trusted keys and certificates are accepted. • Certificates used to safeguard PAN during transmission
  • 4.2.1.1 Inventory of trusted keys and certificates
  • 4.2.2 PAN is secured with strong cryptography whenever it is sent via end-user messaging technologies
  • 8.3.2 Strong cryptography is used to render all authentication factors unreadable during transmission and storage on all system components
  • 9.2.4 Consoles in sensitive areas locked when not in use
  • 3.6.1 Procedures are defined and implemented to protect cryptographic keys used to protect stored account data against disclosure and misuse that include: • Access to keys is restricted to the fewest number of custodians necessary.
  • 3.7.1 Key-management policies and procedures are implemented to include generation of strong cryptographic keys used to protect stored account data
  • 6.4.3 All payment page scripts that are loaded and executed in the consumer's browser are managed as follows: • A method is implemented to confirm that each script is authorized. • A method is implemented
  • 8.6.2 Passwords/passphrases for any application and system accounts that can be used for interactive login are not hard coded in scripts, configuration/property files, or bespoke and custom source code

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 19 controls

FedRAMP High · 13 controls

  • AC-17(2) Protection of Confidentiality and Integrity Using Encryption
  • AC-19(5) Full Device or Container-Based Encryption
  • CP-9(8) System Backup | Cryptographic Protection. Implement cryptographic mechanisms to prevent unauthorized disclosure and modification of [Assignment: organization-defined backup information]
  • IA-5(2) Public Key-Based Authentication
  • SC-12 Cryptographic Key Establishment and Management
  • SC-13 Cryptographic Protection
  • SC-17 Public Key Infrastructure Certificates
  • SC-21 Secure Name/Address Resolution Service (Recursive or Caching Resolver)
  • SC-28 Protection of Information at Rest
  • SC-28(1) Cryptographic Protection
  • SC-8 Transmission Confidentiality and Integrity
  • SC-8(1) Cryptographic Protection
  • SI-7 Software, Firmware, and Information Integrity

FedRAMP Moderate · 13 controls

  • AC-17(2) Protection of Confidentiality and Integrity Using Encryption
  • AC-19(5) Full Device or Container-Based Encryption
  • CP-9(8) System Backup | Cryptographic Protection. Implement cryptographic mechanisms to prevent unauthorized disclosure and modification of [Assignment: organization-defined backup information]
  • IA-5(2) Public Key-Based Authentication
  • SC-12 Cryptographic Key Establishment and Management
  • SC-13 Cryptographic Protection
  • SC-17 Public Key Infrastructure Certificates
  • SC-21 Secure Name/Address Resolution Service (Recursive or Caching Resolver)
  • SC-28 Protection of Information at Rest
  • SC-28(1) Cryptographic Protection
  • SC-8 Transmission Confidentiality and Integrity
  • SC-8(1) Cryptographic Protection
  • SI-7 Software, Firmware, and Information Integrity

NIST SP 800-53 Rev 5 MODERATE · 10 controls

  • AC-17(2) Protection of Confidentiality and Integrity Using Encryption
  • AC-19(5) Full Device or Container-Based Encryption
  • CP-9(8) System Backup | Cryptographic Protection. Implement cryptographic mechanisms to prevent unauthorized disclosure and modification of [Assignment: organization-defined backup information]
  • SC-12 Cryptographic Key Establishment and Management
  • SC-13 Cryptographic Protection
  • SC-17 Public Key Infrastructure Certificates
  • SC-21 Secure Name/Address Resolution Service (Recursive or Caching Resolver)
  • SC-28 Protection of Information at Rest
  • SC-8 Transmission Confidentiality and Integrity
  • SI-7 Software, Firmware, and Information Integrity

NIST SP 800-53 Revision 5.1 HIGH · 10 controls

  • AC-17(2) Protection of Confidentiality and Integrity Using Encryption
  • AC-19(5) Full Device or Container-Based Encryption
  • CP-9(8) System Backup | Cryptographic Protection. Implement cryptographic mechanisms to prevent unauthorized disclosure and modification of [Assignment: organization-defined backup information]
  • SC-12 Cryptographic Key Establishment and Management
  • SC-13 Cryptographic Protection
  • SC-17 Public Key Infrastructure Certificates
  • SC-21 Secure Name/Address Resolution Service (Recursive or Caching Resolver)
  • SC-28 Protection of Information at Rest
  • SC-8 Transmission Confidentiality and Integrity
  • SI-7 Software, Firmware, and Information Integrity

NIST SP 800-53 Rev 5 · 9 controls

Azure Security Benchmark · 7 controls

  • ASBv3-DP-5 Use customer-managed key option in data at rest encryption when required
  • ASBv3-DP-6 Use a secure key management process
  • ASBv3-DP-7 Use a secure certificate management process
  • BR-2 Protect backup and recovery data
  • DP-3 Encrypt sensitive data in transit
  • DP-4 Enable data at rest encryption by default
  • IM-4 Authenticate server and services

C5 (Germany) · 6 controls

  • C5-COS-08 Policies for data transmission
  • C5-CRY-01 Policy for the use of encryption procedures and key management
  • C5-CRY-02 Encryption of data for transmission (transport encryption)
  • C5-CRY-03 Encryption of sensitive data for storage
  • C5-CRY-04 Secure key management
  • C5-OPS-09 Data Backup and Recovery - Storage

CIS Controls v8 · 6 controls

  • CIS-11.3 Protect Recovery Data
  • CIS-2.7 Allowlist Authorized Scripts
  • CIS-3.10 Encrypt Sensitive Data in Transit
  • CIS-3.11 Encrypt Sensitive Data at Rest
  • CIS-3.6 Encrypt Data on End-User Devices
  • CIS-3.9 Encrypt Data on Removable Media

CMMC 2.0 · 6 controls

AWS Well-Architected Security Pillar · 5 controls

ANSSI Guide d'hygiene informatique (42 mesures, v2.0) · 4 controls

  • ANSSI-HYG-11 Protect Passwords Stored on Systems
  • ANSSI-HYG-18 Encrypt Sensitive Data Transmitted Over the Internet
  • ANSSI-HYG-21 Use Secure Protocols Wherever They Exist
  • ANSSI-HYG-31 Encrypt Sensitive Data, in Particular on Equipment That May Be Lost

Australian Information Security Manual · 4 controls

  • ISM-0471 Only AACAs or high assurance cryptographic algorithms are used by cryptographic equipment,
  • ISM-0481 Only AACPs or high assurance cryptographic protocols are used by cryptographic equipment,
  • ISM-0507 Cryptographic key management processes, and supporting cryptographic key management proced
  • ISM-1091 Keying material is changed when compromised or suspected of being compromised.

HIPAA Security Rule · 4 controls

NIST Cybersecurity Framework 2.0 · 4 controls

  • NIST-CSF-PR.AA-04 Identity assertions are protected, conveyed, and verified
  • NIST-CSF-PR.DS-01 The confidentiality, integrity, and availability of data-at-rest are protected
  • NIST-CSF-PR.DS-02 The confidentiality, integrity, and availability of data-in-transit are protected
  • NIST-CSF-PR.DS-10 The confidentiality, integrity, and availability of data-in-use are protected

NIST SP 800-66 Rev 2 · 4 controls

SOC 2 · 4 controls

  • SOC2-C1.1 Confidential information is identified and protected during receipt, processing, storage
  • SOC2-CC5.2 COSO principle 11: Selects and develops general controls over technology
  • SOC2-CC6.7 Transmission of data is restricted to authorized users
  • SOC2-P4.3 Personal information is securely disposed of

ISO 27701:2019 · 3 controls

  • 6.7 Cryptography
  • 6.7.1 Cryptographic controls
  • 7.4.9 PII transmission controls

NIST SP 800-53 Rev 5 LOW · 3 controls

  • SC-12 Cryptographic Key Establishment and Management
  • SC-13 Cryptographic Protection
  • SC-21 Secure Name/Address Resolution Service (Recursive or Caching Resolver)

NIST SP 800-171 Rev 3 · 2 controls

  • 03.13.10 Cryptographic Key Establishment and Management
  • 03.13.11 Cryptographic Protection

ASD Strategies to Mitigate Cyber Security Incidents · 1 control

  • ASD37-17 TLS encryption between email servers (Limited)

Australia Consumer Data Right - Banking (CDR) · 1 control

  • AUCDR-IS-2 Secure the network and systems within the data environment

Bermuda Monetary Authority (BMA) Cyber Risk Management Code of Conduct · 1 control

DORA · 1 control

GDPR · 1 control

ISO 27001:2022 · 1 control

  • 8.24 Use of cryptography

ISO/IEC 27011:2024 · 1 control

ISO/IEC 42001:2023 · 1 control

  • A.9 Use of AI systems

NIS2 Directive · 1 control

  • Art.21.2.h Policies and procedures on the use of cryptography and, where appropriate, encryption

NIST SP 800-161 Rev 1 · 1 control

  • 161R1-SC-8 Transmission Confidentiality and Integrity

NIST SP 800-172 · 1 control

  • 3.14.1e Verify Integrity of Security Critical Software and Firmware

NIST SP 800-218 · 1 control

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in Technological controls – ISO 27002:2022

You are reading one control. How much of ISO 27002:2022 have you already done?

ISO 27002:2022 8.24 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of ISO 27002:2022 your existing evidence covers. Hold NIST SP 800-53 Rev 5 and 79 of 93 ISO 27002:2022 controls already carry evidence.

If you hold NIST SP 800-53 Rev 584.9% covered · 14 gapsIf you hold FedRAMP Moderate80.6% covered · 18 gapsIf you hold Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.174.2% covered · 24 gapsIf you hold C5 (Germany)69.9% covered · 28 gapsIf you hold NIST Cybersecurity Framework 2.063.4% covered · 34 gapsIf you hold NIST SP 800-171 Rev 357% covered · 40 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 180 were rejected on the NIST SP 800-53 Rev 5 pair alone.

See the released pairs, $299 eachBrowse the graph free

Query this from an agent

The graph holds this control, the 176 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll ISO 27002:2022 controls