TISAX - Trusted Information Security Assessment Exchange
Technical and Operational Security

TISAX - Trusted Information Security Assessment Exchange TISAX-TECH-02: Cryptography

Implement cryptographic controls for data protection including encryption policies, key management, and protection of data in transit and at rest.

Maintained by Gerard BlokdykVerified against the published standard Control text last updated

What else in your programme already covers this

This control maps to 104 controls across 41 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

ISO/IEC 27043:2015 · 4 controls

  • ISO27043-17 Encryption of data at rest
  • ISO27043-18 Encryption of data in transit
  • ISO27043-19 Certificate management
  • ISO27043-20 Key lifecycle management

ISO/SAE 21434 · 4 controls

  • ISO21434-16 Cryptographic policy and key management
  • ISO21434-17 Encryption of data at rest
  • ISO21434-18 Encryption of data in transit
  • ISO21434-19 Certificate management

CISA Cross-Sector Cybersecurity Performance Goals (CPG) 2.0 · 3 controls

FedRAMP Rev 5 · 3 controls

  • FEDRAMP-SC-13 Cryptographic Protection
  • FEDRAMP-SC-28 Protection of Information at Rest
  • FEDRAMP-SC-8 Transmission Confidentiality and Integrity

ISO/IEC 23837:2023 · 3 controls

  • 23837-1.2 Normative references
  • 23837-1.5.2 Cryptographic module requirements
  • 23837-1.5.3 Network device testing requirements

NIST SP 800-124 Revision 2 - Guidelines for Managing the Security of Mobile Devices · 3 controls

NIST SP 800-53 Rev 5 · 3 controls

NSA Guidance for Transition to Quantum-Resistant Cryptography · 3 controls

  • QRCM-1.2 Quantum-Vulnerable Identification
  • QRCM-3.1 Hybrid Solution Deployment (2025-2030)
  • QRCM-4.2 TLS 1.3 Adoption

3GPP 5G Security Architecture (TS 33.501) · 2 controls

AWWA Cybersecurity Guidance for the Water Sector (American Water Works Association) · 2 controls

  • AWWA-3.2 Remote Access Security
  • AWWA-3.4 Encryption and Data Protection

FBI CJIS Security Policy · 2 controls

  • CJIS-8 Media Protection
  • CJIS-9 System and Communications Protection

ISO 27799:2025 · 2 controls

  • ISO27799-02 ePHI encryption at rest and in transit
  • ISO27799-16 Transmission security and encryption

UK Open Banking Standard · 2 controls

  • OB-SEC.2 Transport Layer Security
  • OB-SEC.4 Certificate Management

US ITAR and EAR - Export Control and Data Security · 2 controls

  • US-ITAR-EAR-DS-01 Technical Data Protection
  • US-ITAR-EAR-DS-02 Cloud and Storage

APPI · 1 control

  • APPI-A34 Request for Correction, Addition or Deletion

ASD Strategies to Mitigate Cyber Security Incidents · 1 control

  • ASD37-17 TLS encryption between email servers (Limited)

BSI IT-Grundschutz · 1 control

  • BSI-08 Cryptographic protection of data

Bahrain PDPL · 1 control

FFIEC IT Examination Handbook · 1 control

  • FFIEC-09 Encryption and key management

Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL) · 1 control

  • UAE-PDPL-Art.4_5 Lawful basis and principles for processing personal data (UAE PDPL Articles 4-5)

IEC 62351 - Power Systems Communication Security · 1 control

  • 62351-9 Cyber security key management

ISO/IEC 27010:2015 · 1 control

  • 27010-10.1 Cryptographic Protection

ISO/IEC 27011:2024 · 1 control

  • 27011-8.3 Cryptography and key management

ISO/IEC 27400:2022 · 1 control

  • 27400-6.2 Device Identity and Authentication

ISO/IEC 29115:2013 - Entity Authentication Assurance Framework · 1 control

  • 29115-7.4 Level of Assurance 4 (LoA4)

NIST SP 800-190 · 1 control

PCI P2PE · 1 control

  • PCI-P2PE-09 Encryption and key management

PCI PIN Security · 1 control

  • PCI-PIN-09 Encryption and key management

PCI SSF · 1 control

  • PCI-SSF-09 Encryption and key management

SOC for Cybersecurity - Cybersecurity Risk Management Examination · 1 control

  • SOC-CY-C2 Encryption and Data Protection

Saudi Arabia PDPL · 1 control

  • SA-PDPL-13 Encryption of personal data

Secure by Design: A Guide for Manufacturers (CISA) · 1 control

  • SBD-DEV-04 Phishing-Resistant Authentication

Sigstore - Software Artifact Signing and Verification · 1 control

Singapore Government Instruction Manual on ICT&SS Management (IM8) · 1 control

  • IM8-CLD.2 Cloud Security Controls

South Korea ISMS-P · 1 control

  • ISMSP-SYS-02 Encryption Implementation

Switzerland New Federal Act on Data Protection (nFADP/nDSG, 2023) · 1 control

Taiwan PDPA · 1 control

  • TAIWAN-2 Consent, Notice, Sensitive Data

Texas Data Privacy and Security Act (TDPSA) · 1 control

  • TEXASTDPSA-2 Consumer Rights

Uruguay DPL · 1 control

  • URUGUAY-3 Sensitive Data, Health Data, Children

Virginia CDPA · 1 control

  • VIRGINIAVCDPA-2 Consumer Rights

W3C Verifiable Credentials (VC) Data Model 2.0 · 1 control

  • VP-2 Holder Binding

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in Technical and Operational Security

Query this from an agent

The graph holds this control, the 104 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll TISAX - Trusted Information Security Assessment Exchange controls