ASD ISM 0507 Develop and maintain cryptographic key management processes
What it says
Cryptographic key management processes, and supporting cryptographic key management procedures, are developed, implemented and maintained.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure systems have established processes for managing cryptographic keys securely and efficiently.
This control is about making sure your organisation properly manages the keys used in cryptography, which is the method of encoding and decoding information to keep it safe. If these keys aren't handled correctly, sensitive data can be exposed to unauthorised people, leading to data breaches, legal issues, and damage to your reputation.
Free. Save your status, tasks and notes.
Why it matters
Weak cryptographic key management can expose sensitive data, leading to severe breaches, financial loss, and reputational damage.
How to implement
The IT team should set up a secure method for generating cryptographic keys.
This involves using a reputable cryptographic tool to generate keys according to industry standards and ensuring these keys are kept confidential during the process.
Managers must establish clear policies outlining who can access cryptographic keys and how this access is logged.
This can be done by defining roles and responsibilities within a formal document and ensuring all staff are trained on these procedures.
The system owner should implement a regular review of the key management process to identify any weaknesses.
This can be done by scheduling quarterly check-ins where current practices are evaluated against the latest security standards issued by the Australian Cyber Security Centre (ACSC).
The security team should ensure that all keys are stored securely and are backed up in a safe location.
This involves using protected servers or dedicated hardware solutions designed for key storage, and maintaining an up-to-date inventory of all keys.
IT staff should implement procedures for regular key rotation to reduce the risk of keys being compromised over time.
This involves developing a schedule for replacing old keys with new ones and documenting these changes in a key management log.
Keep it running
Define key lifecycle procedures: secure generation, storage (HSM/KMS), rotation, revocation, backups, access logging and regular recovery testing.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The cryptographic key management policy document: This should detail how keys are generated, used, and stored.
Look at
Whether it specifies access control measures and key rotation policies.
Good evidence
Includes a comprehensive policy that aligns with ACSC guidelines and has been reviewed within the last year.
- Check 2 of 5What an auditor asks for
Look at
Timestamps and user identities.
Good evidence
Shows logs with authorised access only and no suspicious activity.
- Check 3 of 5What an auditor asks for
Ask for
To see the latest key rotation records: Verify that key changes have been documented with dates and responsible personnel.
Look at
A pattern of regular key updates.
Good evidence
Includes a log showing routine key changes and notification of necessary stakeholders.
- Check 4 of 5What an auditor asks for
Look at
The use of secure servers or hardware security modules.
Good evidence
Includes confirmation that only authorised personnel have access to these storage solutions.
- Check 5 of 5What an auditor asks for
Ask for
About training records for staff handling cryptographic keys: Ensure there is evidence of regular training sessions.
Look at
The topics covered and attendance records.
Good evidence
Consists of documentation showing consistent and current training aligned with changes in key management practices.
Mappings
Closest match in ISO/IEC 27001: A.8.24, Effective use of cryptography and key management, which asks for the same thing.
ISO/IEC 27001: 1 mapping
This control is equivalent to A.8.24.
ISM-0507 requires cryptographic key management processes and supporting procedures to be developed, implemented and maintained across the organisation. ISO/IEC 27001:2022 Annex A 8.24 similarly requires organisations to define and implement rules for the effective use of cryptography, explicitly including cryptographic key management. Both controls cover establishing governance/processes for key lifecycle handling (e.g. generation, distribution, storage, rotation and revocation), with ISO framing it as rules for cryptography use and ISM framing it as mandatory processes/procedures.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.