Part 29 - A10 Cryptography
This objective of the clauses in A.10 in the annex of ISO 27001 is to ensure the proper and effective use of cryptography to protect the confidentiality, authenticity and/or integrity of your information.
This one tales a while to work out and may require specialist advice from your IT Department or from a consultant.
Here at Mango we use encryption and decryption extensively in our Mango product. We are constantly making sure it isn’t compromised.
So let’s look at this small clause in some detail.
A.10 Cryptographic Controls
This clause is separated into two sub-clauses.
- Firstly, you need to develop and implement a policy on the use of cryptographic controls.
- Here at Mango we have a policy that we will use cryptographic controls if they have been proven to be resilient to attack and strong enough to protect our assets.
- Secondly, you need to develop and implement a policy on the use, protection and lifetime of cryptographic through their whole lifecycle.
- Here at Mango we have a policy on how we will use keys for managing encryption and decryption.
So there you have it.
This is a simple clause but does require specialist knowledge to develop and implement policies around encryption and key management.
- Seek specialist advice for this clause.
- Develop a simple policy for both cryptographic controls and for the lifecycle of cryptography for your business
- Implement the policy.
View previous blogs in this series "ISO 27001 Information Security Management Standard":