Skip to main content
All measures

Measure · ISO 27001

Manage cryptography and keys securely

Select suitable safeguards, implement them and control keys from generation through secure retirement.

Accountable: IT operations with the responsible security roleReviewed

Reuse existing records

Shared requirements remain in the operations policy. Specific profiles, certificates and key references stay in existing service or key-management records; secret keys do not belong in an ordinary inventory.

What to do

  1. 1

    Define protection and an approved profile

    Identify where confidentiality, integrity or authenticity requires protection. Use suitable current vendor profiles and recognised guidance for methods, parameters and required duration; examine legal and contractual requirements and cross-border use. Keep approved methods and ownership authoritative in one place. Include storage, transmission, mobile devices and effects on other safeguards.

  2. 2

    Implement the key lifecycle

    Use secure generation and issue, protected distribution and storage, and appropriately restricted access. Check authenticity of public keys and certificates. Define activation, renewal, recovery, backup, archiving, revocation and destruction, including compromised keys and lawful disclosure requests. Log relevant management actions and protect private or secret keys against disclosure, loss and changes.

  3. 3

    Check implementation and failure scenarios

    Compare actual settings against the approved profile. Check access, expiry and certificate renewal. Where required, exercise recovery and revocation with suitable test material without exposing production secrets. Handle failures in existing operational or incident records and review profiles after relevant changes and new findings.

Worked example

An operational example

Fictional example: A service uses a certificate and encrypted backups. Operations checks renewal and protected access to necessary recovery material.

Prepare for key loss
DecisionAn authorised substitute can perform the appropriate replacement or recovery procedure while the ordinary asset record contains only the protected repository reference.
EvidenceChecked role, profile version and recovery result in the existing operational record.

Record the result

  • Approved current profile, ownership and bounded key reference.
  • Actual secure configuration and checked required lifecycle steps.

Common implementation mistakes

Leaving keys openly beside protected data

Separate access and storage according to risk. The inventory points to the protected location rather than containing the secret.

Related requirement

The references below show which requirements the measure contributes to.

View controls and standards
  • A.8.24 · Einsatz von KryptographieGerman guide

    The workflow connects suitable effective cryptography, legal and contractual requirements, secure implementation and the full applicable key lifecycle.

Templates for your implementation

Sources and further reading