ASD ISM 1091 Change keying material when compromised
What it says
Keying material is changed when compromised or suspected of being compromised.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishChange encryption keys if they are compromised to maintain security.
If someone gets their hands on the keys to your safe, they can take whatever is inside. In the digital world, encryption keys protect your sensitive information, just like a safe does. If these keys are compromised, you need to change them immediately to prevent unauthorised access to your data.
Free. Save your status, tasks and notes.
Why it matters
Failure to replace compromised encryption keys promptly can lead to unauthorised data access, resulting in data breaches and loss of sensitive information.
How to implement
The IT team should regularly monitor for signs of compromised encryption keys.
They can do this by setting up alerts for unusual access patterns or failed login attempts, which can indicate that someone is trying to use stolen keys.
System administrators should have a plan in place for quickly changing encryption keys if they suspect compromise.
This involves knowing which systems use the keys and how to update them without interrupting business operations.
Managers should ensure that staff are aware of the importance of reporting suspected key compromises immediately.
They can educate staff by organising regular training sessions that explain the risks and demonstrate what to do if a compromise is suspected.
The IT security officer should ensure that old keys are securely destroyed once new ones are issued.
This can be done by using a secure data erasure tool that overwrites the old keys, making them impossible to recover.
Business owners should coordinate with their IT provider to perform regular security reviews.
This involves checking if encryption keys are stored securely and if proper procedures are in place for changing them when needed.
Keep it running
Monitor for key compromise indicators and, when suspected, revoke and rotate affected keys immediately; re-encrypt data and update dependent systems to prevent continued unauthorised access.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The incident response procedure: Request documentation that outlines the steps for responding to compromised encryption keys. Look to ensure it includes who to contact, how quickly to respond, and the steps to change the keys.
Good evidence
Includes a clear, step-by-step plan with named responsible parties.
- Check 2 of 5What an auditor asks for
Ask for
Evidence of recent key changes: Request logs or reports showing when encryption keys were last changed.
Look at
The dates and reasons for the changes to understand if they align with any suspected or detected compromises.
Good evidence
Includes records of timely key changes with documented reasons.
- Check 3 of 5What an auditor asks for
Ask for
Training records on key compromise protocols: Request records from recent staff training sessions focused on recognising and reporting key compromises.
Look at
The attendance and training content to confirm staff are informed and prepared.
Good evidence
Contains up-to-date training records with full participation.
- Check 4 of 5What an auditor asks for
Ask for
A log of security alerts: Request logs that demonstrate the monitoring of signs that could indicate compromised keys.
Look at
Consistent alerting and a process for handling these alerts.
Good evidence
Includes regular alerts and a clear incident handling process.
- Check 5 of 5What an auditor asks for
Ask for
The encryption key management policy: Request the policy document detailing how encryption keys are managed, including how often they are rotated and how compromise is addressed.
Look at
Details on access control, rotation, and response actions.
Good evidence
Is a comprehensive policy that aligns with best practices.
Mappings
Closest match in ISO/IEC 27001: A.8.24, Effective use of cryptography and key management, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.24.
Annex A 8.24 requires rules for cryptographic key management to be defined and implemented, including responding to key compromise. ISM-1091 specifically requires changing keying material when compromised or suspected of compromise, which is a direct key lifecycle requirement that would be included in Annex A 8.24 key management rules. ISM-1091 covers one event-driven key management action, while Annex A 8.24 covers the broader set of key management practices.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.