Cryptography policy

Define and implement rules for effective use of cryptography and key management.

What the ISO 27002 guidance expects the document to say: Requires defined and implemented rules on using cryptography effectively, including how cryptographic keys are managed.

The organization's rules on the use of cryptography shall recognise that some jurisdictions require cryptography to protect particular kinds of PII, such as health data, resident registration numbers, passport numbers and driver's licence numbers, and the organization shall provide information to the customer about the circumstances in which it uses cryptography to protect the PII it processes and about any capabilities it provides that can help the customer apply their own cryptographic protection.

Financial entities shall continuously monitor and control the security and functioning of ICT systems and tools, and minimise ICT risk through appropriate ICT security policies, procedures, protocols and tools ensuring resilience, continuity and availability, and preserving confidentiality, integrity and authenticity of data (incl access management, encryption, secure configuration, network security).

The obligation is to have decided, in writing, where cryptography is used and how it is governed. That covers which algorithms and key lengths are permitted, where data is encrypted at rest and in transit, how certificates and keys are generated, stored, rotated and revoked, and who may access key material. Encryption is qualified by where appropriate, which means the entity is expected to reach a reasoned position rather than encrypt everything or nothing. Key management is where this obligation usually fails in practice, because encryption can be deployed correctly while the keys sit somewhere that removes the protection. Expired certificates and forgotten key owners are also the common route by which an availability incident starts.