ISO 27001:2022 Annex A 8.24 – Use of Cryptography Explained

Encryption is not a “nice to have”.
Used properly, it is one of the most effective controls for protecting information.
Used poorly, it creates risk, fragility, and false confidence.

Annex A 8.24 exists to ensure organisations use cryptography in a controlled, consistent, and risk-appropriate way, protecting information confidentiality, integrity, authenticity, and availability.

This control is about governance of cryptography, not just switching encryption on.

Quick Guide: Annex A 8.24 at a Glance

Annex A 8.24 of ISO 27001:2022 focuses on the use of cryptographic techniques.

At a practical level, this means:

Defining when and how cryptography is used
Selecting appropriate cryptographic methods based on risk
Managing cryptographic keys securely
Considering legal, regulatory, and contractual constraints
Assigning clear responsibility for cryptographic controls

The control does not mandate specific algorithms or products. It expects clear rules, ownership, and disciplined implementation.

In-Depth Guide to Annex A 8.24

What Is Annex A 8.24 and Why Does It Matter?

Cryptography is used to:

Protect data in transit
Protect data at rest
Authenticate users and systems
Ensure integrity of information
Support non-repudiation

However, cryptography introduces risk when:

Algorithms are weak or outdated
Keys are poorly managed
Encryption is applied inconsistently
Legal or export restrictions are ignored
Encrypted data becomes unrecoverable

Annex A 8.24 ensures organisations use cryptography deliberately and safely, rather than relying on ad hoc or default implementations.

This control replaces ISO 27001:2013 Annex A 10.1.1 and 10.1.2, consolidating cryptographic use and key management into a single, clearer requirement.

How to Implement Annex A 8.24 Effectively

A pragmatic approach to Annex A 8.24 typically includes the following elements.

1. Define a Cryptography Policy

Organisations should establish a policy covering:

When cryptography is required
What it is used to protect
Approved cryptographic approaches
Roles and responsibilities

The policy should align with:

Information classification
Risk assessment outcomes
Legal and regulatory obligations

Cryptography without policy quickly becomes inconsistent.

2. Identify Where Cryptography Is Required

Cryptography should be applied where it supports security objectives, such as:

Protecting sensitive data in transit over networks
Protecting data stored on devices, media, or cloud platforms
Authenticating systems, users, or services
Protecting backups and archives

Not all information requires the same level of cryptographic protection.

3. Select Cryptographic Methods Based on Risk

Organisations should consider:

Sensitivity of the information
Threat environment
Likelihood and impact of compromise

This informs:

Choice of algorithm
Key length and strength
Whether encryption, signing, or hashing is appropriate

Strong cryptography applied in the wrong place is still ineffective.

4. Establish Clear Rules for Cryptographic Use

Annex A 8.24 expects organisations to define and enforce rules covering:

Approved algorithms and standards
Acceptable cryptographic implementations
Prohibited or deprecated techniques

This prevents:

Use of weak or obsolete encryption
Inconsistent implementations across systems
Vendor-specific shortcuts that increase risk

Standards reduce variability — and variability is risk.

5. Implement Robust Key Management

Key management is central to Annex A 8.24.

Organisations should define processes for:

Key generation
Key storage and protection
Key distribution and activation
Key rotation and expiry
Revocation of compromised keys
Secure destruction of keys

Poor key management undermines even the strongest encryption.

6. Protect Cryptographic Keys Appropriately

Keys should be protected against:

Unauthorised access
Loss or corruption
Accidental disclosure

Controls may include:

Access restriction
Hardware or software protection mechanisms
Separation of duties

Keys often require stronger protection than the data they protect.

7. Define Roles and Responsibilities

Annex A 8.24 expects clarity on:

Who approves cryptographic standards
Who manages cryptographic keys
Who is responsible for implementation and oversight

Cryptography without ownership degrades rapidly.

8. Consider Impact on Other Security Controls

Encryption can affect:

Malware inspection
Content monitoring
Data loss prevention

Organisations should ensure:

Compensating controls exist where visibility is reduced
Encryption does not unintentionally disable other protections

Security controls should work together, not blind each other.

9. Address Legal, Regulatory, and Contractual Constraints

Cryptography is subject to:

Export and import controls
National legislation
Sector-specific regulation

Organisations should consider:

Cross-border data transfer implications
Lawful access and disclosure requirements
Contractual obligations with suppliers and customers

Ignoring legal constraints creates compliance risk.

10. Manage Use of External Cryptographic Services

Where cryptography is provided by third parties, organisations should ensure:

Security responsibilities are defined
Key ownership and access are clear
Continuity and availability are considered

Outsourced cryptography is still organisational risk.

11. Review Cryptographic Controls Regularly

Cryptographic effectiveness changes over time.

Organisations should periodically review:

Algorithms and key lengths
Compliance with current standards
Emerging vulnerabilities or weaknesses

Cryptography that was strong yesterday may be weak tomorrow.

In-Depth Guide to Annex A 5.1

What is Annex A 5.1 and Why Does It Matter?

Annex A 5.1 is a foundational governance control. It sets the tone for the entire Information Security Management System (ISMS).

Policies define:

What the organisation values
How security decisions are approached
Where accountability sits

Without clear policies, security becomes inconsistent. Teams improvise. Decisions vary depending on who’s involved. Risk acceptance becomes informal and undocumented.

From a security perspective, that inconsistency is often where incidents start.

From a business perspective, unclear policies lead to friction — security teams blocking work, delivery teams bypassing controls, and leadership stepping in only when something breaks.

A well-designed policy framework:

Aligns security with business objectives
Supports proportionate, risk-based decisions
Provides a reference point during incidents and disputes
Creates consistency without bureaucracy

A common real-world scenario we see is organisations with technically strong controls but weak policy direction. When an exception arises — a supplier request, a new platform, a rushed delivery — there’s no agreed framework to guide the decision. That’s when risk is introduced quietly and unintentionally.

How to Implement Annex A 5.1 Effectively

A practical, security-first approach usually includes the following steps.

1. Define a Comprehensive Information Security Policy

Policies exist to set direction, not to document every control.Start by being clear about what your policies are there to achieve:

Scope: What the policy applies to (systems, data, people).
Objectives: Why security is important for the business.
Roles & Responsibilities: Who is accountable for security.
Key Principles: Risk management, access control, and data protection.

2. Secure Senior Management Approval

Leadership support is critical. Without it, policies remain words on paper without real enforcement. Senior executives should:

Review and approve policies.
Ensure resources are allocated for implementation.
Lead by example in enforcing security policies.

3. Communicate and Train Employees

A policy is useless if no one reads or understands it.

Include security policies in onboarding and ongoing training.
Ensure policies are easily accessible to all employees.
Encourage acknowledgment and acceptance of security responsibilities.

4. Regular Review & Continuous Improvement

Information security threats evolve, and so should your policies.

Set a schedule for periodic policy reviews (at least annually).
Update policies based on business changes, new threats, or regulatory updates.
Conduct audits to ensure compliance and effectiveness.

5. Integrate Policies into the ISMS

Your information security policy should be the backbone of your ISMS (Information Security Management System).

Use it to develop more detailed security procedures.
Ensure policies align with other Annex A controls and broader risk management practices.

Key Differences: ISO 27001:2013 vs ISO 27001:2022

Aspect	ISO 27001:2013	ISO 27001:2022
Control Structure	Two separate controls: 5.1.1 & 5.1.2	Merged into one control (5.1)
Implementation Guidance	Less prescriptive	More detailed guidance for policy creation and alignment
Awareness & Training	Not explicitly mentioned	Explicitly requires policies to be part of training programmes
Attributes Table	Not included	ew attributes table for mapping policies to industry terms

The new approach in ISO 27001:2022 ensures that policies are not just created but actively integrated into business operations, improving security culture across organisations.

Common Challenges & How to Overcome Them

Challenge: Employees don’t follow security policies.
Solution: Make policies practical and relevant to daily work. Use real-world examples in training.
Challenge: Policies are outdated or too generic.
Solution: Schedule annual reviews and update policies based on real threats and business changes.
Challenge: Policies are written in technical jargon.
Solution: Use plain language that all employees can understand.
Challenge: Lack of leadership buy-in.
Solution: Show how weak security affects business objectives—costs of breaches, loss of client trust, and legal penalties.

Final Recommendations

Make security policies living documents—review, refine, and update regularly.
Use policy training and awareness to create a security-conscious workforce.
Ensure policies are accessible, relevant, and easy to understand.
Keep policies aligned with business strategy and regulatory requirements.
Engage leadership in driving security culture from the top down.

By embedding strong security policies into your business operations, you don’t just tick a compliance box—you build a robust security posture that protects your organisation from real-world threats.

Practical Considerations

Annex A 8.24 does not require:

Encryption everywhere
Constant algorithm changes
Specialist cryptographic expertise for all staff

It does require organisations to:

Apply cryptography where it matters
Manage keys properly
Understand the consequences of encrypted data

Lost keys can be as damaging as stolen data.

Common Challenges and How to Overcome Them

Encryption enabled without key management
Define and enforce end-to-end key lifecycle controls

Different systems using inconsistent standards
Establish approved cryptographic standards

Keys accessible to too many people
Restrict and monitor key access

Ignoring legal restrictions on encryption
Assess regulatory and contractual constraints early

Cryptography fails most often through governance gaps.

In-Depth Guide to Annex A 5.1

What is Annex A 5.1 and Why Does It Matter?

Annex A 5.1 is a foundational governance control. It sets the tone for the entire Information Security Management System (ISMS).

Policies define:

What the organisation values
How security decisions are approached
Where accountability sits

Without clear policies, security becomes inconsistent. Teams improvise. Decisions vary depending on who’s involved. Risk acceptance becomes informal and undocumented.

From a security perspective, that inconsistency is often where incidents start.

From a business perspective, unclear policies lead to friction — security teams blocking work, delivery teams bypassing controls, and leadership stepping in only when something breaks.

A well-designed policy framework:

Aligns security with business objectives
Supports proportionate, risk-based decisions
Provides a reference point during incidents and disputes
Creates consistency without bureaucracy

A common real-world scenario we see is organisations with technically strong controls but weak policy direction. When an exception arises — a supplier request, a new platform, a rushed delivery — there’s no agreed framework to guide the decision. That’s when risk is introduced quietly and unintentionally.

How to Implement Annex A 5.1 Effectively

A practical, security-first approach usually includes the following steps.

1. Define a Comprehensive Information Security Policy

Policies exist to set direction, not to document every control.Start by being clear about what your policies are there to achieve:

Scope: What the policy applies to (systems, data, people).
Objectives: Why security is important for the business.
Roles & Responsibilities: Who is accountable for security.
Key Principles: Risk management, access control, and data protection.

2. Secure Senior Management Approval

Leadership support is critical. Without it, policies remain words on paper without real enforcement. Senior executives should:

Review and approve policies.
Ensure resources are allocated for implementation.
Lead by example in enforcing security policies.

3. Communicate and Train Employees

A policy is useless if no one reads or understands it.

Include security policies in onboarding and ongoing training.
Ensure policies are easily accessible to all employees.
Encourage acknowledgment and acceptance of security responsibilities.

4. Regular Review & Continuous Improvement

Information security threats evolve, and so should your policies.

Set a schedule for periodic policy reviews (at least annually).
Update policies based on business changes, new threats, or regulatory updates.
Conduct audits to ensure compliance and effectiveness.

5. Integrate Policies into the ISMS

Your information security policy should be the backbone of your ISMS (Information Security Management System).

Use it to develop more detailed security procedures.
Ensure policies align with other Annex A controls and broader risk management practices.

Key Differences: ISO 27001:2013 vs ISO 27001:2022

Aspect	ISO 27001:2013	ISO 27001:2022
Control Structure	Two separate controls: 5.1.1 & 5.1.2	Merged into one control (5.1)
Implementation Guidance	Less prescriptive	More detailed guidance for policy creation and alignment
Awareness & Training	Not explicitly mentioned	Explicitly requires policies to be part of training programmes
Attributes Table	Not included	ew attributes table for mapping policies to industry terms

The new approach in ISO 27001:2022 ensures that policies are not just created but actively integrated into business operations, improving security culture across organisations.

Common Challenges & How to Overcome Them

Challenge: Employees don’t follow security policies.
Solution: Make policies practical and relevant to daily work. Use real-world examples in training.
Challenge: Policies are outdated or too generic.
Solution: Schedule annual reviews and update policies based on real threats and business changes.
Challenge: Policies are written in technical jargon.
Solution: Use plain language that all employees can understand.
Challenge: Lack of leadership buy-in.
Solution: Show how weak security affects business objectives—costs of breaches, loss of client trust, and legal penalties.

Final Recommendations

Make security policies living documents—review, refine, and update regularly.
Use policy training and awareness to create a security-conscious workforce.
Ensure policies are accessible, relevant, and easy to understand.
Keep policies aligned with business strategy and regulatory requirements.
Engage leadership in driving security culture from the top down.

By embedding strong security policies into your business operations, you don’t just tick a compliance box—you build a robust security posture that protects your organisation from real-world threats.

Final Recommendations

Annex A 8.24 is about using cryptography as a controlled security capability, not a checkbox.

When cryptography is implemented effectively:

Confidentiality is preserved
Integrity can be verified
Authentication is stronger
Trust in information systems increases

Encryption protects information.
Governance protects encryption.

Annex A 8.24 ensures organisations do both.

In-Depth Guide to Annex A 5.1

What is Annex A 5.1 and Why Does It Matter?

Annex A 5.1 is a foundational governance control. It sets the tone for the entire Information Security Management System (ISMS).

Policies define:

What the organisation values
How security decisions are approached
Where accountability sits

Without clear policies, security becomes inconsistent. Teams improvise. Decisions vary depending on who’s involved. Risk acceptance becomes informal and undocumented.

From a security perspective, that inconsistency is often where incidents start.

From a business perspective, unclear policies lead to friction — security teams blocking work, delivery teams bypassing controls, and leadership stepping in only when something breaks.

A well-designed policy framework:

Aligns security with business objectives
Supports proportionate, risk-based decisions
Provides a reference point during incidents and disputes
Creates consistency without bureaucracy

A common real-world scenario we see is organisations with technically strong controls but weak policy direction. When an exception arises — a supplier request, a new platform, a rushed delivery — there’s no agreed framework to guide the decision. That’s when risk is introduced quietly and unintentionally.

How to Implement Annex A 5.1 Effectively

A practical, security-first approach usually includes the following steps.

1. Define a Comprehensive Information Security Policy

Policies exist to set direction, not to document every control.Start by being clear about what your policies are there to achieve:

Scope: What the policy applies to (systems, data, people).
Objectives: Why security is important for the business.
Roles & Responsibilities: Who is accountable for security.
Key Principles: Risk management, access control, and data protection.

2. Secure Senior Management Approval

Leadership support is critical. Without it, policies remain words on paper without real enforcement. Senior executives should:

Review and approve policies.
Ensure resources are allocated for implementation.
Lead by example in enforcing security policies.

3. Communicate and Train Employees

A policy is useless if no one reads or understands it.

Include security policies in onboarding and ongoing training.
Ensure policies are easily accessible to all employees.
Encourage acknowledgment and acceptance of security responsibilities.

4. Regular Review & Continuous Improvement

Information security threats evolve, and so should your policies.

Set a schedule for periodic policy reviews (at least annually).
Update policies based on business changes, new threats, or regulatory updates.
Conduct audits to ensure compliance and effectiveness.

5. Integrate Policies into the ISMS

Your information security policy should be the backbone of your ISMS (Information Security Management System).

Use it to develop more detailed security procedures.
Ensure policies align with other Annex A controls and broader risk management practices.

Key Differences: ISO 27001:2013 vs ISO 27001:2022

Aspect	ISO 27001:2013	ISO 27001:2022
Control Structure	Two separate controls: 5.1.1 & 5.1.2	Merged into one control (5.1)
Implementation Guidance	Less prescriptive	More detailed guidance for policy creation and alignment
Awareness & Training	Not explicitly mentioned	Explicitly requires policies to be part of training programmes
Attributes Table	Not included	ew attributes table for mapping policies to industry terms

The new approach in ISO 27001:2022 ensures that policies are not just created but actively integrated into business operations, improving security culture across organisations.

Common Challenges & How to Overcome Them

Challenge: Employees don’t follow security policies.
Solution: Make policies practical and relevant to daily work. Use real-world examples in training.
Challenge: Policies are outdated or too generic.
Solution: Schedule annual reviews and update policies based on real threats and business changes.
Challenge: Policies are written in technical jargon.
Solution: Use plain language that all employees can understand.
Challenge: Lack of leadership buy-in.
Solution: Show how weak security affects business objectives—costs of breaches, loss of client trust, and legal penalties.

Final Recommendations

Make security policies living documents—review, refine, and update regularly.
Use policy training and awareness to create a security-conscious workforce.
Ensure policies are accessible, relevant, and easy to understand.
Keep policies aligned with business strategy and regulatory requirements.
Engage leadership in driving security culture from the top down.

By embedding strong security policies into your business operations, you don’t just tick a compliance box—you build a robust security posture that protects your organisation from real-world threats.

ISO 27001:2022 Annex A 8.24 – Use of Cryptography Explained

Quick Guide: Annex A 8.24 at a Glance

In-Depth Guide to Annex A 8.24

What Is Annex A 8.24 and Why Does It Matter?

How to Implement Annex A 8.24 Effectively

1. Define a Cryptography Policy

2. Identify Where Cryptography Is Required

3. Select Cryptographic Methods Based on Risk

4. Establish Clear Rules for Cryptographic Use

5. Implement Robust Key Management

6. Protect Cryptographic Keys Appropriately

7. Define Roles and Responsibilities

8. Consider Impact on Other Security Controls

9. Address Legal, Regulatory, and Contractual Constraints

10. Manage Use of External Cryptographic Services

11. Review Cryptographic Controls Regularly

In-Depth Guide to Annex A 5.1

What is Annex A 5.1 and Why Does It Matter?

How to Implement Annex A 5.1 Effectively

1. Define a Comprehensive Information Security Policy

2. Secure Senior Management Approval

3. Communicate and Train Employees

4. Regular Review & Continuous Improvement

5. Integrate Policies into the ISMS

Key Differences: ISO 27001:2013 vs ISO 27001:2022

Common Challenges & How to Overcome Them

Final Recommendations

Practical Considerations

Common Challenges and How to Overcome Them

In-Depth Guide to Annex A 5.1

What is Annex A 5.1 and Why Does It Matter?

How to Implement Annex A 5.1 Effectively

1. Define a Comprehensive Information Security Policy

2. Secure Senior Management Approval

3. Communicate and Train Employees

4. Regular Review & Continuous Improvement

5. Integrate Policies into the ISMS

Key Differences: ISO 27001:2013 vs ISO 27001:2022

Common Challenges & How to Overcome Them

Final Recommendations

Final Recommendations

In-Depth Guide to Annex A 5.1

What is Annex A 5.1 and Why Does It Matter?

How to Implement Annex A 5.1 Effectively

1. Define a Comprehensive Information Security Policy

2. Secure Senior Management Approval

3. Communicate and Train Employees

4. Regular Review & Continuous Improvement

5. Integrate Policies into the ISMS

Key Differences: ISO 27001:2013 vs ISO 27001:2022

Common Challenges & How to Overcome Them

Final Recommendations

The Annex Control Table

ISO 27001:2022 Organisational Controls

ISO 27001:2022 People Controls

ISO 27001:2022 Physical Controls

ISO 27001:2022 Technological Controls

Solutions

Quick Links

Follow Us On:

Solutions

Quick Links

Follow Us On:

Unsure where to start, lets talk!