ASD ISM 1080 Use AACA or high assurance algorithms for data encryption
What it says
An AACA or high assurance cryptographic algorithm is used when encrypting data at rest.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure that data at rest is encrypted using strong cryptographic algorithms like AACA for high security.
Using strong cryptographic algorithms like Advanced Encryption Standard (AES) protects your stored data from unauthorised access. If data isn't well-protected, it could be stolen or altered, leading to potential financial loss or reputational damage.
Free. Save your status, tasks and notes.
Why it matters
Poor encryption can lead to severe data breaches, exposing sensitive business or customer information, thus causing financial and reputational harm.
How to implement
The IT team should identify which data is sensitive and requires encryption.
They can start by reviewing the types of data stored and prioritising anything that could harm the business if leaked.
Managers should brief staff on the importance of encrypting data at rest and ensure they know how to handle and store sensitive data correctly.
This could involve setting clear guidelines and regular team check-ins to reinforce practices.
Procurement teams should ensure that any new software or services purchased support high assurance encryption methods.
They should verify this by checking documentation or seeking assurances from vendors.
System owners should coordinate with IT to apply strong cryptographic algorithms to all stored data.
This might involve setting up routines or scripts that automatically encrypt data as it is saved.
The IT security team should conduct regular audits of existing systems to verify that data remains encrypted with strong algorithms.
They can use tools to scan systems and confirm encryption settings and check logs for any issues.
Keep it running
Regularly update encryption practices as threats evolve, ensuring all team members understand their role in protecting data using approved algorithms.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
encryption policy documents: Request policies that define how and when encryption must be applied to data at rest.
Look at
the inclusion of strong algorithms like AES.
Good evidence
should have a clear policy listing approved algorithms.
- Check 2 of 5What an auditor asks for
Ask for
the latest report summarising encryption compliance.
Look at
system names and encryption status.
Good evidence
A report showing all systems compliant with encryption policies.
- Check 3 of 5What an auditor asks for
Ask for
IT team training records: Verify documentation showing that team members have been trained in encryption techniques.
Look at
course completion certificates or signed attendance records.
Good evidence
will show recent, relevant training for key staff.
- Check 4 of 5What an auditor asks for
Ask for
to see how data is encrypted on a system. Ensure strong algorithms are being used.
Good evidence
would show data being automatically encrypted without manual intervention.
- Check 5 of 5What an auditor asks for
Ask for
vendor documentation: When third-party services are involved, request their encryption compliance documents.
Look at
proof of high assurance algorithm use.
Good evidence
will be certified documentation showing their encryption standards.
Mappings
Closest match in ISO/IEC 27001: A.8.24, Effective use of cryptography and key management, which partially overlaps with this control.
ISO/IEC 27001: 2 mappings
This control partially overlaps A.8.24.
ISM-1080 requires that when encrypting media (data at rest), organisations use an ASD-Approved Cryptographic Algorithm (AACA) or other high assurance cryptographic algorithm. This overlaps with ISO/IEC 27001:2022 Annex A 8.24, which requires rules for effective use of cryptography and cryptographic key management to be defined and implemented, providing the governance and key-handling practices needed to implement approved encryption correctly. Annex A 8.24 is broader (covers cryptography use generally, including key management and potentially data in transit), while ISM-1080 is more specific about approved algorithms for encryption of stored media.
This control depends on A.8.1.
ISM-1080 requires use of ASD-approved/high assurance algorithms when encrypting media to protect data at rest from unauthorised access. This supports ISO/IEC 27001:2022 Annex A 8.1 by providing a concrete mechanism (strong, approved encryption) to protect information stored on or accessible via endpoint devices. Annex A 8.1 is broader because it includes multiple endpoint protections beyond encryption (e.g. configuration, access restrictions, malware controls), whereas ISM-1080 addresses the cryptographic strength of encryption for stored data.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.