ASD ISM 0455 Enable data recovery for encrypted data
What it says
Where practical, cryptographic equipment, applications and libraries provide a means of data recovery to allow for circumstances where the encryption key is unavailable due to loss, damage or failure.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure encrypted data can be accessed if the encryption key is lost or damaged.
This control ensures that your important data remains accessible even if something happens to damage or lose the encryption key, which is needed to unlock the data. If you don't plan for this, you could lose all your encrypted data permanently, leading to loss of critical business information, customer trust, and financial implications.
Free. Save your status, tasks and notes.
Why it matters
Loss of encryption keys without a recovery method can render critical encrypted data inaccessible, crippling operations and damaging business credibility.
How to implement
IT teams should regularly back up encryption keys in a secure manner to prevent loss.
Use a secure, off-site storage service like a trusted cloud provider or a physical safe to keep these backups safe.
The IT manager should implement a key management policy outlining how keys are stored, accessed, and recovered.
Include steps for manually recovering data if the primary key is lost, ensuring this policy is documented and accessible to the necessary personnel.
Organisations should test recovery procedures regularly to confirm they work when needed.
Conduct a trial recovery process once a quarter and document the steps and results, ensuring any issues are addressed immediately.
System owners must ensure any application or tool that handles encryption includes a built-in method for key recovery.
Verify this feature by reviewing the vendor's service agreement or product documentation and keep a copy of the relevant sections.
Keep it running
Regularly test backup key recovery processes to ensure data remains accessible even when primary encryption keys are lost.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The encryption key management policy document: Request to see any written policies that explain how encryption keys are backed up and recovered.
Look at
The document to verify the procedures are clearly outlined.
Good evidence
A detailed and accessible policy document with clear steps for key backup and recovery.
- Check 2 of 5What an auditor asks for
Ask for
To see records of a simulated data recovery test: Request evidence that data recovery procedures have been successfully tested.
Look at
Notes or reports from these tests, including dates and outcomes.
Good evidence
Dated test results indicating that recovery processes were successfully completed and any issues were resolved.
- Check 3 of 5What an auditor asks for
Ask for
Vendor contracts or product documentation: Request any agreements or manuals detailing the encryption tool's recovery features.
Look at
Explicit mentions of data recovery capabilities in case of key loss.
Good evidence
A clear mention in the documentation or contract that supports key recovery features.
- Check 4 of 5What an auditor asks for
Ask for
A demonstration of the key recovery process: Request a live or recorded demonstration showing how data can be retrieved without the primary key.
Look at
Steps followed and how data is accessed.
Good evidence
A clear, step-by-step process that successfully retrieves data as expected.
- Check 5 of 5What an auditor asks for
Ask for
To review encryption key backup logs: Request log files or records showing regular backup of encryption keys.
Look at
Scheduling frequency and completion status in logs.
Good evidence
Logs that show consistent, successful backups as per the defined policy.
Mappings
Closest match in ISO/IEC 27001: A.8.24, Effective use of cryptography and key management, which partially overlaps with this control.
ISO/IEC 27001: 1 mapping
This control partially overlaps A.8.24.
Annex A 8.24 requires rules for cryptographic use and cryptographic key management, including availability considerations for keys and encrypted information. ISM-0455 overlaps by requiring a means of data recovery when encryption keys are unavailable, which is a key management and operational resiliency consideration that should be addressed in Annex A 8.24 key management rules. ISM-0455 focuses specifically on recovery mechanisms, while Annex A 8.24 also covers broader topics such as algorithm selection, key protection, rotation and revocation.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.