Cryptographic Controls
The policies, procedures, and technical mechanisms governing the use of cryptography to protect the confidentiality, integrity, and authenticity of information, including encryption algorithms, key management, digital signatures, and certificate management.
Cryptographic controls are essential security mechanisms that protect information through mathematical algorithms. They serve multiple security objectives: confidentiality (encryption makes data unreadable to unauthorized parties), integrity (hash functions and digital signatures detect unauthorized modifications), authentication (digital certificates and cryptographic protocols verify identity), and non-repudiation (digital signatures provide evidence that a specific party performed an action). Common applications include TLS/SSL for data in transit, AES encryption for data at rest, hashing for password storage, digital signatures for code and document integrity, and certificate-based authentication.
ISO 27001 Annex A control A.8.24 specifically addresses the use of cryptography, requiring organizations to define and implement rules for the effective use of cryptography, including cryptographic key management. SOC 2 evaluates encryption controls as part of the Security and Confidentiality criteria, examining whether data is encrypted in transit and at rest using appropriate algorithms and key lengths. GDPR Article 32 identifies encryption as an appropriate technical measure for ensuring the security of personal data, and encryption can serve as a safeguard that mitigates the impact of a data breach (Article 34(3)(a) provides that breach notification to individuals may not be required if the data was encrypted). NIS2 references the use of cryptography and encryption as core cybersecurity measures.
Effective cryptographic controls extend beyond simply enabling encryption. Organizations must establish a cryptographic policy that defines approved algorithms and key lengths (avoiding deprecated algorithms like DES, MD5, or SHA-1), key management procedures covering the entire key lifecycle (generation, distribution, storage, rotation, revocation, destruction), certificate management processes (including monitoring for certificate expiration), and procedures for responding to cryptographic vulnerabilities. Key management is often the most challenging aspect — keys must be protected at least as strongly as the data they protect, and loss of encryption keys can result in permanent data loss. Hardware Security Modules (HSMs) and cloud-based key management services provide tamper-resistant key storage for sensitive applications.
Related frameworks
Related terms
Access Control
The set of policies, procedures, and technical mechanisms that govern who can access which information assets, systems, and resources. Access control ensures that only authorized individuals can view, modify, or interact with sensitive data and systems.
Data Loss Prevention
A set of strategies, tools, and processes designed to detect and prevent the unauthorized transmission, exfiltration, or leakage of sensitive data outside an organization's controlled environment.
Encryption
The process of converting data into an encoded format that can only be read by authorized parties who possess the correct decryption key. Encryption protects data confidentiality both at rest (stored data) and in transit (data being transmitted over networks).
Privacy by Design
An approach to system engineering and business practices that embeds privacy protections into the design and architecture of IT systems, processes, and products from the outset, rather than adding them as an afterthought.
Assess your compliance posture
Run a free self-assessment for ISO 27001, SOC 2, GDPR, NIS2, or Tech DD and see exactly where you stand.
Start free assessment