ISO 27001:2022 Annex A Control 8.24

General Guidance on ISO 27001:2022 Annex A 8.24 Compliance

ISO 27001:2022 Annex A Control 8.24 stipulates seven requirements organisations must observe when employing cryptographic methods:

1. Organisations should have a policy in place regarding the use of cryptography, to maximise its benefits and reduce risks. This policy should also outline general principles of protecting information.
2. Organisations must take into account how delicate their information resources are, as well as the information classification level appointed to them, when selecting the type, strength, and quality of the encryption algorithm.
3. Organisations ought to utilise cryptographic approaches when transferring info to portable devices, media equipment, or when it is stored thereon.
4. Organisations need to tackle any matters connected to key management, like forming and shielding cryptographic keys and having a scheme of data recovery in the event that the keys are missing or vulnerable.
5. Organisations should define the roles and responsibilities for the following:
• The rules for using cryptographic techniques must be established and enforced.
• Handling of keys, including their generation.
6. The organisation adopts and approves standards encompassing the cryptographic algorithms, cipher strength, and usage practices of cryptography.
7. Organisations should consider the potential impact of encryption on the efficacy of the content inspection controls, such as malware detection.

ISO 27001:2022 Annex A 8.24 emphasises that organisations should consider legal requirements and restrictions that may impact the use of cryptography, including the international transfer of encrypted information.

Organisations should take into consideration liability and continuity of services when they enter into service agreements with external providers of cryptographic services.

Guidance on Key Management

Organisations must set up and follow secure processes for the generation, storage, fetching, and disposal of cryptographic keys.

Organisations ought to install a solid key management system that features regulations, procedures, and criteria for:

• Generating cryptographic keys for a variety of systems and applications is necessary.
• The issuing and obtaining of public-key certificates.
• Distribute keys to intended receivers, including the procedure of key activation.
• Keys are to be stored securely. Those authorised to access them may do so with the necessary credentials.
• Changing of keys.
• Handling of compromised keys should be taken seriously.
• If keys are compromised or an authorised personnel leaves an organisation, they should be revoked.
• Recovery of lost keys.
• Key backup and archival should be performed regularly.
• Destroying keys.
• Maintain a record of all activities linked to each key.
• Establishing the activation and deactivation dates for keys.
• Accessing keys in response to legal requests.

Finally, it is essential that organisations are aware of the three main risks that this supplementary guidance outlines:

1. Secure and private keys ought to be safeguarded against unauthorised usage.
2. Protecting equipment used for creating or storing encryption keys should be done with physical security measures.
3. Organisations should ensure the validity of their public keys.

What Are the Benefits of Cryptography?

ISO 27001:2022 Annex A 8.24 states that cryptography can be used to help organisations attain four information security objectives. These objectives include verifying the authenticity of public keys through public key management processes:

1. Cryptography ensures the confidentiality of data, both in transit and when stored, is preserved.
2. Digital signatures and authentication codes guarantee information communicated is genuine and reliable.
3. Cryptographic methods give assurance that all events or actions taken, including receipt of information, will not be disavowed.
4. Authentication through cryptographic methods allows organisations to validate the identity of users seeking access to systems and applications.

Changes and Differences from ISO 27001:2013

ISO 27001:2022 Annex A 8.24 replaces ISO 27001:2013 Annex A 10.1.1 and 10.1.2 in the revised 2022 standard.

The content of the two is nearly the same, though there are some structural modifications.

Whereas the 2013 version had two separate controls, 10.1.1 and 10.1.2, for the use of cryptography, the 2022 version consolidated these into one Annex A Control, 8.24.

Table of All ISO 27001:2022 Annex A Controls

In the table below you’ll find more information on each individual ISO 27001:2022 Annex A Control.

How ISMS.online Help

ISMS.Online is the foremost ISO 27001 management system software, aiding companies in adhering to ISO 27001:2022 and ensuring their security policies and procedures comply with the standard.

This cloud-based platform offers a comprehensive set of tools to aid organisations in implementing an Information Security Management System (ISMS) in line with ISO 27001.

Reach out and book a demonstration today.