ISO 27701, Clause 6.7 – Cryptography

ISO 27701 Clause 6.7.1.1 – Policy on the Use of Cryptographic Controls

References ISO 27002 Control 8.24

Organisations should use encryption to protect the confidentiality, authenticity and integrity of PII and privacy-related information, and to adhere to their various contractual, legal or regulatory obligations.

Encryption is a far-reaching concept – there is no ‘one size fits all’ approach. Organisations should assess their needs and choose a cryptographic solution that meets their unique commercial and operational objectives.

General Guidance

Organisations should consider:

• Develop a topic-specific approach to cryptography, that takes into account various departmental, role-based and operational requirements.
• The appropriate level of protection (along with the type of information to be encrypted).
• Mobile devices and storage media.
• Cryptographic key management (storage, processing etc).
• Specialised roles and responsibilities for cryptographic functions, including implementation and and key management (see ISO 27002 8.24).
• The technical encryption standards that are to be adopted, including algorithms, cipher strength, best practice guidelines.
• How encryption will work alongside other cybersecurity efforts, such as malware protection and gateway security.
• Cross-border and cross-jurisdictional laws and guidelines (see ISO 27002 5.31).
• Contracts with third-party cryptography partners that cover all or part liability, reliability and response times.

Key Management

Key management procedures should be spread out over 7 main functions:

1. Generation.
2. Storage.
3. Archiving.
4. Retrieval.
5. Distribution.
6. Retiring.
7. Destruction.

Organisational key management systems should:

• Manage key generation for all encryption methods.
• Implement public key certificates.
• Ensure that all all relevant human and non-human entities are issued with the requisite keys.
• Store keys.
• Amend keys, as required.
• Have procedures in place to deal with potentially compromised keys.
• Decommission keys, or revoke access on a user-by-user basis.
• Recover lost or malfunctioning keys, either from backups and key archives.
• Destroy keys that are no longer required.
• Manage the activation and deactivation lifecycle, so that certain keys are only available for the period of time that they are needed.
• Process official requests for access, from law enforcement agencies or, in certain circumstances, regulatory agencies.
• Contain access controls that protect physical access to keys and encrypted information.
• Consider the authenticity of public keys, prior to implementation (certificate authorities and public certificates).

Relevant ISO 27002 Controls

• ISO 27002 5.31
• ISO 27002 8.24

Applicable GDPR Articles

• Article 32 – (1)(a)

ISO 27701 Clause 6.7.1.2 – Key Management

References ISO 27002 Control 8.24

See above section on Key Management (ISO 27701 6.7.1.1).

Supporting Controls From ISO 27002 and GDPR

How ISMS.online Helps

How do we help?

ISO 27701 shows you how to build a Privacy Information Management System that complies with most privacy regulations, including the EU’s GDPR, BS 10012 and South Africa’s POPIA.

Our simplified, secure, sustainable software helps you easily follow the approach outlined by the internationally recognised standard.

All the features you need:

• ROPA made easy
• Built in Risk Bank
• Secure space for DRR

Find out how much time and money you’ll save on your journey to a combined ISO 27002 and 27701 certification using ISMS.online by booking a demo.