ISO/IEC 23837 - Security Requirements for Quantum Key Distribution 1.5.2: Cryptographic module requirements

What else in your programme already covers this

This control maps to 207 controls across 142 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

ISO 27043 · 3 controls

ISO27043-18 Encryption of data in transit
ISO27043-19 Certificate management
ISO27043-20 Key lifecycle management

ISO/SAE 21434 · 3 controls

ISO21434-16 Cryptographic policy and key management
ISO21434-17 Encryption of data at rest
ISO21434-19 Certificate management

MARS-E · 3 controls

MARS-E-Contingency-Media-Protection-System-Integrity-CP-MP-SI-Families-DR-COOP-Encryption-Sanitization MARS-E Contingency + Media Protection + System Integrity + CP + MP + SI Families + DR + COOP
MARS-E-Cross-Program-Coordination-IRS-Pub-1075-FedRAMP-CMS-ARS-HHS-OIG-Joint-Audit-3PAO MARS-E Cross-Program + IRS Pub 1075 + FedRAMP + CMS ARS + HHS OIG + Joint Audit + 3PAO
MARS-E-Incident-Response-Breach-Notification-IR-Family-45-CFR-164-400-414-IRS-Pub-1075-Notification-CMS-IRT MARS-E Incident Response + Breach Notification + IR Family + 45 CFR 164.400-414 + IRS Pub 1075 + CMS IRT

NIST Post-Quantum Cryptography Standards (FIPS 203, 204, 205) · 3 controls

PQC-5 Cryptographic Inventory and PQC Migration Roadmap
PQC-7 FIPS Validated Modules, HSM Readiness, and Algorithm Validation
PQC-8 Implementation Requirements - RNG, Side-Channel, Key Management, Operations, Incident Response

NIST SP 800-171A Rev 3 - Assessing CUI Security Requirements · 3 controls

FEDRAMP-SC-13 Cryptographic Protection
FEDRAMP-SC-28 Protection of Information at Rest
FEDRAMP-SC-8 Transmission Confidentiality and Integrity

NIST SP 800-53 Rev 5 · 3 controls

NIST800-IA-7 Cryptographic module authentication
NIST800-SC-12 Cryptographic key establishment and management
NIST800-SC-13 Cryptographic protection

NSA Guidance for Transition to Quantum-Resistant Cryptography · 3 controls

QRCM-1.2 Quantum-Vulnerable Identification
QRCM-3.1 Hybrid Solution Deployment (2025-2030)
QRCM-4.2 TLS 1.3 Adoption

AWWA Cybersecurity Guidance for the Water Sector (American Water Works Association) · 2 controls

AWWA-3.2 Remote Access Security
AWWA-3.4 Encryption and Data Protection

CISA Cross-Sector Cybersecurity Performance Goals (CPG) 2.0 · 2 controls

CPG-3.A Log Collection
CPG-3.B Secure Log Storage

FBI CJIS Security Policy · 2 controls

CJIS-8 Media Protection
CJIS-9 System and Communications Protection

ISO 13485 · 2 controls

ISO13485-02 ePHI encryption at rest and in transit
ISO13485-16 Transmission security and encryption

ISO 27799 · 2 controls

ISO27799-02 ePHI encryption at rest and in transit
ISO27799-16 Transmission security and encryption

NIST SP 800-124 Revision 2 - Guidelines for Managing the Security of Mobile Devices · 2 controls

MD124-CTL-02 Device Encryption
MD124-POL-03 Mobile Data Protection Policy

Nebraska Data Privacy Act · 2 controls

NDPA-1 Applicability, Scope, and Carve-Outs
NDPA-7 Data Protection Assessments and Processor Contracts

Nigeria Data Protection Act 2023 (NDPA) · 2 controls

NG-NDPA-1 Scope, Applicability, and Establishment of Nigeria Data Protection Commission
NG-NDPA-7 Cross-Border Data Transfers and International Cooperation

OWASP ASVS · 2 controls

OWASPASVS-6 Stored Cryptography (V6)
OWASPASVS-9 Communication Security (V9)

OWASP MASVS · 2 controls

OWASPMASVS-2 MASVS-CRYPTO: Cryptography Usage
OWASPMASVS-4 MASVS-NETWORK: Network Communication

OWASP Top 10:2025 · 2 controls

OWASPTOP10-2 A02:2025 Cryptographic Failures and Secret Management
OWASPTOP10-4 A04:2025 Insecure Design and Business Logic (incl. A11 API Abuse)

PTES · 2 controls

PTESPHASE-2 Intelligence Gathering (OSINT)
PTESPHASE-3 Threat Modeling

Secure by Design: A Guide for Manufacturers (CISA) · 2 controls

CISABD-1 Take Ownership of Customer Security Outcomes
SBD-DEV-04 Phishing-Resistant Authentication

TISAX - Trusted Information Security Assessment Exchange · 2 controls

TISAX-TECH-02 Cryptography
TISAXASS-2 ISA Catalog Implementation

UK Open Banking Standard · 2 controls

OB-SEC.2 Transport Layer Security
OB-SEC.4 Certificate Management

US ITAR and EAR - Export Control and Data Security · 2 controls

US-ITAR-EAR-DS-01 Technical Data Protection
US-ITAR-EAR-DS-02 Cloud and Storage

3GPP 5G Security Architecture (TS 33.501) · 1 control

TS33.501-13.2 NF Service Authorization

APPI · 1 control

APPI-A34 Request for Correction, Addition or Deletion

AS9100D:2016 - Quality Management Systems for Aviation, Space, and Defence · 1 control

9.1 Risk communication and consultation

ASD Strategies to Mitigate Cyber Security Incidents · 1 control

ASD37-17 TLS encryption between email servers (Limited)

BSI IT-Grundschutz · 1 control

BSI-08 Cryptographic protection of data

Bahrain PDPL · 1 control

BH-PDPL-13 Encryption of personal data

Belgium CyberFundamentals · 1 control

BE-CF-08 Cryptographic protection of data

FDA 21 CFR Part 11 · 1 control

Part11.30 Controls for open systems (21 CFR §11.30)

FFIEC IT Examination Handbook · 1 control

FFIEC-09 Encryption and key management

FIDO2 / WebAuthn · 1 control

FIDO2-Phishing-Resistance Phishing Resistance, Channel Binding, Anti-Replay and Privacy

FISMA · 1 control

FISMA-NIST-800-53-RMF-800-171-FIPS Operationalisation via NIST 800-53 + 800-37 RMF + 800-171 + FIPS 199 + FIPS 200

FTC GLBA Safeguards Rule (16 CFR Part 314) · 1 control

FTC-Safeguards-9-Elements 9 Safeguard Elements - Access, Inventory, Encryption, Secure-Dev, MFA, Disposal, Change-Mgmt, Monitoring, Pen-Test (16 CFR 314.4(c))

Family Educational Rights and Privacy Act (FERPA) · 1 control

FERPA-Safeguards-PTAC Data Security Safeguards for PII in Education Records (PTAC Best Practices, SPPO Guidance)

FedRAMP Rev 5 · 1 control

FedRAMP-Baselines FedRAMP Baseline Selection (Low, Moderate, High, LI-SaaS) and Control Overlay Parameters

Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL) · 1 control

UAE-PDPL-Art.4_5 Lawful basis and principles for processing personal data (UAE PDPL Articles 4-5)

GLBA · 1 control

GLBA-Subordinate-Rules-Operationalisation GLBA Operationalisation through FTC Safeguards Rule, Privacy Rule, SEC Reg S-P and Banking-Agency Guidelines

Ghana Cybersecurity Act · 1 control

GhCSA-Service-Provider-Licensing-Professional Cybersecurity Service Provider Licensing and Professional Accreditation

HITECH Act · 1 control

HITECH-Coord-HIPAA-Privacy-Security-Cures-ONC HITECH Coordination with HIPAA Privacy Rule + HIPAA Security Rule (Verified Separately) + 21st Century Cures Act + ONC

HKMA Cyber Resilience Assessment Framework (C-RAF) · 1 control

HKMA-CRAF-Domain3-4-Protection-Detection HKMA C-RAF Domain 3 (Protection) + Domain 4 (Detection) - Access, Data, Infrastructure, Application, Monitoring, Testing, Threat Intel

HKMA SPM · 1 control

HKMA-SPM-TM-Technology-TM-G-1-CRAF-Coord HKMA SPM Technology Management Modules (TM-G-1 to TM-G-4, TM-E-1) + Coordination with C-RAF

HL7 FHIR Security Framework · 1 control

HL7-FHIR-Transport-TLS-Communication HL7 FHIR Transport Security - TLS 1.2+, Communication Security, Time Keeping, Server CapabilityStatement

IEC 62351 - Power Systems Communication Security · 1 control

62351-9 Cyber security key management

ISMAP (Japan) · 1 control

ISMAP-DataProtection-Classification-Encryption-DataResidencyJapan-Backup-SecureDeletion-Cryptography-FIPS ISMAP Data Protection - Data Classification + AES-256 Encryption At Rest + TLS 1.3 In Transit + Data Residency Japan + Backup + Secure Deletion + Cryptography per FIPS 140-3 + CRYPTREC + KMS HSM

ISO 15189:2022 - Medical Laboratories Requirements for Quality and Competence · 1 control

6.7 Conducting Audit Follow-up

ISO 19011 · 1 control

6.7 Conducting Audit Follow-up

ISO 20000-1 · 1 control

9.1 Risk communication and consultation

ISO 22739:2024 - Blockchain and Distributed Ledger Technologies Vocabulary · 1 control

ISO-22739-3.2.4 Hash function

ISO 27005 · 1 control

9.1 Risk communication and consultation

ISO 27017 · 1 control

ISO27017-12 Encryption of cloud-stored data

ISO 27018 · 1 control

ISO27018-12 Encryption of cloud-stored data

ISO 31000:2018 · 1 control

6.7 Conducting Audit Follow-up

ISO/IEC 27010:2015 · 1 control

27010-10.1 Cryptographic Protection

ISO/IEC 27011:2024 · 1 control

27011-8.3 Cryptography and key management

ISO/IEC 27400:2022 · 1 control

27400-6.2 Device Identity and Authentication

ISO/IEC 27557:2022 - Organisational Privacy Risk Management · 1 control

23837-1.2 Normative references

ISO/IEC 29115:2023 - Entity Authentication Assurance Framework · 1 control

29115-7.4 Level of Assurance 4 (LoA4)

Iceland Data Protection and Processing of Personal Data Act (Act No. 90/2018) · 1 control

ICELAND-Act90-Chap4-Security-BreachNotification-DPIA-Personuvernd-72hr Iceland Act 90/2018 - Chapter IV Security of Processing + Breach Notification + DPIA (Articles 27-29)

India DPDP Act · 1 control

DPDP-DataPrincipalRights-Sec11to14-Access-Correction-Erasure-Grievance-Nominate-Withdraw DPDP Act Sections 11-14 + Data Principal Rights + Access + Correction + Erasure + Grievance Redressal + Right to Nominate + Withdraw Consent + Duties + Verification of Identity

Indiana Consumer Data Protection Act · 1 control

INCDPA-Security-ReasonablePractices-Breach-Notification-Records-Encryption-Pseudonymisation Indiana CDPA Security + Reasonable Practices + Breach Notification + Indiana Breach Notification Law (IC 24-4.9) + Records + Encryption + Pseudonymisation + De-Identification

Indonesia PDP Law · 1 control

IDPdp-SpecificData-SensitiveData-Children-Art4-Art25-Consent-COPPA-VerifiableParental Indonesia PDP Article 4 + Article 25 + Specific Personal Data (Sensitive) + Health + Biometric + Genetic + Crime + Financial + Child + Verifiable Parental Consent + Best Interests of Child

Iowa Consumer Data Protection Act · 1 control

ICDPA-SensitiveData-Notice-OptOut-NotConsent-Children-COPPA-Alignment-De-Identification Iowa CDPA Sensitive Data + Notice + Opt-Out (NOT Consent unlike VCDPA) + Children Under 13 + COPPA Alignment + De-Identification Standards + Heightened Risk Awareness

Jamaica Data Protection Act 2020 · 1 control

JM-DPA2020-Standard7-Security-Sec35-Appropriate-Technical-Organisational-Confidentiality-Integrity-Availability-Resilience Jamaica DPA 2020 Standard 7 - Security + Section 35 + Appropriate Technical and Organisational Measures + Confidentiality + Integrity + Availability + Resilience + Encryption + Pseudonymisation + Risk-Based Security

Kentucky Consumer Data Protection Act · 1 control

KY-CDPA-Sensitive-Data-Affirmative-Consent-Race-Religious-Health-Genetic-Biometric-Children-Citizenship Kentucky CDPA Sensitive Data + Affirmative Consent + Race/Ethnicity + Religious + Mental/Physical Health + Sexual Orientation + Citizenship/Immigration + Genetic + Biometric + Children's Data + Precise Geolocation (1,750 ft) + Section 4 Heightened Consent Standard

MARS-E - Minimum Acceptable Risk Standards for Exchanges · 1 control

MARSE-SC-02 Federal Tax Information Protection

MDS2 (Medical Device) · 1 control

MDS2-PHI-Data-Handling-DATA-Storage-STCF-Transmission-TXCF-TXIG-Encryption-FIPS MDS2 PHI Handling + DATA + STCF Storage + TXCF Transmission + TXIG Integrity + Encryption + FIPS

MITRE ATT&CK · 1 control

MITRE-ATTACK-Mitigations-M-IDs-Active-Directory-User-Account-Management-Password-Policies-Network-Segmentation MITRE ATT&CK Mitigations + M-IDs + Active Directory + User Account + Password + Network Segmentation + Application Control

MITRE D3FEND · 1 control

MITRE-D3FEND-Harden-Tactic-Application-Credential-Message-Platform-Hardening-MFA-Encryption-Secure-Boot MITRE D3FEND Harden Tactic + Application + Credential + Message + Platform + MFA + Encryption + Secure Boot

MTCS (Singapore) · 1 control

MTCS-Operations-Physical-Network-Tier-III-Data-Centre-Hardening-Patching-Network-Segmentation-DDoS MTCS Operations + Physical + Network + Tier III Data Centre + Hardening + Patching + Segmentation + DDoS

Malaysia PDPA 2010 · 1 control

MY-PDPA-Sensitive-Personal-Data-Section-40-Health-Religious-Political-Sexual-Children-Explicit-Consent Malaysia PDPA Sensitive Personal Data + Section 40 + Health + Religious + Political + Children + Explicit Consent

Maryland Online Data Privacy Act of 2024 · 1 control

MD-MODPA-Sensitive-Data-Health-Biometric-Section-14-4607-Reasonably-Necessary-Proportionate-Data-Minimization Maryland MODPA Data Minimization + Sensitive + Health + Biometric + Section 14-4607 + Reasonably Necessary + Proportionate

Mauritius DPA · 1 control

MU-DPA-Sensitive-Personal-Data-Section-24-Health-Biometric-Genetic-Sexual-Section-25-Children-16 Mauritius DPA Sensitive Data + Section 24 + Health + Biometric + Genetic + Sexual + Section 25 + Children 16

Mexico LFPDPPP · 1 control

MX-LFPDPPP-Sensitive-Article-3-VI-Genetic-Health-Sexual-Religious-Article-9-Minors-18-Parental-Consent Mexico LFPDPPP Sensitive Data + Article 3 Section VI + Genetic + Health + Sexual + Religious + Article 9 Minors + Parental Consent

Minnesota Consumer Data Privacy Act · 1 control

MN-CDPA-Universal-Opt-Out-GPC-Sensitive-Data-Section-325O-02-Consumer-Health-Data-Children-Known-Child-Transgender Minnesota CDPA Universal Opt-Out + GPC + Sensitive + Section 325O.02 + Consumer Health Data + Children + Known Child + Transgender

Monetary Authority of Singapore Technology Risk Management Guidelines · 1 control

MAS-TRM-Access-Cryptography-Network-Security-Chapters-9-10-MFA-PKI-Encryption-Network-Segmentation MAS TRM Access Control + Cryptography + Network + Chapters 9-10 + MFA + PKI + Encryption + Network Segmentation

Montana Consumer Data Privacy Act · 1 control

MT-CDPA-Universal-Opt-Out-Mechanism-1-January-2025-GPC-Global-Privacy-Control-Mandatory-Recognition Montana CDPA Universal Opt-Out Mechanism + 1 January 2025 + GPC + Global Privacy Control + Mandatory Recognition

NAIC Insurance Data Security Model Law (MDL-668) · 1 control

NAIC-2 Information Security Program (ISP) - Section 4

NATO STANAG 4774 (Confidentiality Metadata Labels) and STANAG 4778 (Metadata Binding) · 1 control

STANAG-2 STANAG 4778 Metadata Binding Mechanism and Cryptographic Binding

NIS2 Directive Implementing Acts · 1 control

NIS2I-5 Cyber Hygiene, Training, Cryptography, and Human Resources Security

NIST Privacy Framework · 1 control

NISTPF-8 Protect-P Information Protection Processes (PR.PO-P)

NIST SP 800-115 (Technical Guide to Information Security Testing and Assessment) · 1 control

NISTSP115-8 Operational Considerations - Tools, Reporting Templates, ISMS Integration, Annex Material

NIST SP 800-122 · 1 control

NISTSP122-5 PII Security Controls - Encryption, Access Control, Storage, Audit

NIST SP 800-123 · 1 control

NISTSP123-4 Server Cryptography - Encryption, Key Management, Certificates

NIST SP 800-137 · 1 control

NISTSP137-5 Vulnerability + Patch + Configuration Status Monitoring

NIST SP 800-144 · 1 control

NISTSP144-5 Identity and Access in Cloud, Federation, and Privileged Access

NIST SP 800-145 · 1 control

NISTSP145-8 Governance, Reporting, and Stakeholder Education on Cloud Definition

NIST SP 800-146 · 1 control

NISTSP146-6 Cloud Security and Privacy Recommendations

NIST SP 800-190 · 1 control

NIST190-12 Encryption of cloud-stored data

NIST SP 800-61 · 1 control

NISTSP61-3 Preparation: Communications, Toolkits, Training, Exercises, Threat Intelligence

NIST SP 800-63-4 · 1 control

NISTSP63R4-5 Federation: Assertions, Trust Agreements, RP Validation, Pseudonymous Identifiers

NIST SP 800-66 · 1 control

NISTSP66-6 Technical Safeguards: Access Control, Audit Controls, Integrity, Person Authentication

NIST SP 800-82 Revision 3: Guide to Industrial Control Systems (ICS) Security · 1 control

NISTSP82-2 OT Risk Assessment and Threat/Vulnerability Identification

NIST SP 800-88 · 1 control

NISTSP88-4 Cryptographic Erase, Key Management, and Verification of Erase

NIST SP 800-92 · 1 control

NISTSP92-4 Log Management: Time Synchronisation, Parsing, Storage, Integrity, Access Control

NIST Special Publication 800-34 Revision 1, Contingency Planning Guide for Federal Information Systems · 1 control

NISTSP34-3 Preventive Controls and Recovery Strategies: Backup, Alternate Sites, Equipment

New Hampshire Data Privacy Act · 1 control

NHPA-6 Reasonable Data Security and Breach Response

New Jersey Data Privacy Act · 1 control

NJDPA-7 Data Protection Assessments and Processor Contracts

New Zealand Information Security Manual (NZISM) · 1 control

NZISM-3 Personnel Security, Physical Security, and Cryptography

Nigeria Data Protection Regulation (NDPR) · 1 control

NGNDPR-5 Security of Personal Data, Breach Notification, and DPIA under NDPR Section 2.6-Security

Nigeria Open Banking Regulatory Framework (CBN, 2023) · 1 control

NGOB-3 API Security Standards, mTLS, and Encryption

O-RAN WG11 Security Specification · 1 control

ORANWG11-3 Cryptography, TLS, SSH, IPsec, and PKI Lifecycle Management

OSFI B-13 · 1 control

OSFIB13-3 Cyber Security: Identification, Protection, Detection, Response, Recovery

OWASP API Security Top 10 - 2023 · 1 control

OWASPAPI-6 Security Misconfiguration and Secure API Design

OWASP SAMM · 1 control

OWASPSAMM-2 Design: Threat Assessment, Security Requirements, Security Architecture

Oman National Cybersecurity Framework · 1 control

OMANCS-4 Data Protection, Cryptography, and Privacy Alignment

Open Banking Security · 1 control

OPENBANK-3 Mutual TLS, Token Binding, Request Signing (JWS), Key Management

OpenSSF Scorecard · 1 control

OSSFSC-6 Signed Releases, Provenance, Trusted Publishing, Binary Artifacts

Oregon Consumer Privacy Act · 1 control

OREGONCPA-7 Processor Contracts, Cross-Border Transfers, DPAs

PAS 1192-5:2015 - Security-Minded Approach to BIM and Digital Built Environments · 1 control

PASONE-4 Technical Security: CDE Configuration, BIM Tools, Encryption, Aggregation, Mobile Working

PCI P2PE · 1 control

PCI-P2PE-09 Encryption and key management

PCI PIN Security · 1 control

PCI-PIN-09 Encryption and key management

PCI SSF · 1 control

PCI-SSF-09 Encryption and key management

PDPA Singapore · 1 control

PDPASG-5 Protection, Accuracy, and Security of Personal Data

PDPA Thailand · 1 control

PDPATH-5 Security Measures and Data Protection

POPIA · 1 control

POPIASA-5 Security Safeguards, Encryption, Access Control, Operator Obligations

PSD2 SCA · 1 control

PSDTWO-2 SCA Exemptions and Risk-Based Authentication

Personal Data Act (personopplysningsloven) · 1 control

NORWAY-5 Security of Processing, Encryption, Pseudonymization, Access Control

Peru DPL · 1 control

PERU-7 DPO, Records, Retention, Marketing, Training

Privacy Act 1988 (Australia) · 1 control

AUPRV-4 APP 10-11 Quality, Security of Personal Information

Privacy Act 2020 · 1 control

NZPRV-2 IPP 5 Storage and Security of Personal Information

Qatar DPL · 1 control

QATAR-5 Security of Processing

SIG (Shared Assessments) · 1 control

SHAREASSESS-3 Network Security, Endpoint, Data Protection

SLSA · 1 control

SUPCHAIN-2 Source Integrity - Branch Protection, Code Review, Two-Person Rule

SOC for Cybersecurity - Cybersecurity Risk Management Examination · 1 control

SOC-CY-C2 Encryption and Data Protection

Saudi Arabia PDPL · 1 control

SA-PDPL-13 Encryption of personal data

Sigstore - Software Artifact Signing and Verification · 1 control

SIGSTORE-3 Sigstore for Containers and Artifacts (Cosign)

Singapore Government Instruction Manual on ICT&SS Management (IM8) · 1 control

IM8-CLD.2 Cloud Security Controls

South Korea ISMS-P · 1 control

ISMSP-SYS-02 Encryption Implementation

Switzerland New Federal Act on Data Protection (nFADP/nDSG, 2023) · 1 control

CH-FADP-13 Right to object and request blocking

Taiwan PDPA · 1 control

TAIWAN-2 Consent, Notice, Sensitive Data

Texas Data Privacy Act · 1 control

TEXASTDPSA-2 Consumer Rights

Turkey KVKK · 1 control

TURKEYKVKK-2 Information Notice and Data Subject Rights

Uruguay DPL · 1 control

URUGUAY-3 Sensitive Data, Health Data, Children

Vietnam PDPD · 1 control

VIETNAMPDP-2 Consent and Notice

Virginia CDPA · 1 control

VIRGINIAVCDPA-2 Consumer Rights

W3C Verifiable Credentials (VC) Data Model 2.0 · 1 control

VP-2 Holder Binding

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.