Skip to content
Cryptography
ASD ISMISM-1446

ASD ISM 1446 Use approved elliptic curves for encryption

What it says

When using elliptic curve cryptography, a suitable curve from NIST SP 800-186 is used.

Quoted as published. Everything else on this page is written by Control Stack.

What it means

In plain English

Ensure secure cryptography by using NIST-approved elliptic curves for encryption.

When using elliptic curve cryptography, it's important to choose the right mathematical curve to ensure data security. If you don't use curves approved by experts like those at NIST, your encrypted messages could be vulnerable to hackers who might steal sensitive information or cause financial harm.

Why it matters

If non‑NIST SP 800‑186 curves are used, ECC may be weaker or noncompliant, enabling decryption, MITM attacks, or undetected data tampering.

How to implement

  1. IT team should review current encryption setup: Examine which elliptic curves are being used for encrypting sensitive data.

    Ensure they match the ones listed in NIST SP 800-186, which is a trusted guideline by the National Institute of Standards and Technology.

  2. System owners should coordinate with cyber security advisors: Arrange a session to understand why NIST-approved elliptic curves are essential and how they improve security for your systems.

    This can involve a workshop or a detailed briefing with your security provider to ensure awareness and compliance.

  3. Procurement officers should ensure new systems use compliant encryption: When acquiring new software or systems that involve encryption, specify the requirement for NIST-approved elliptic curves in procurement documents.

    This ensures that any new purchases are secured right from the start.

  4. IT managers must update existing policies: Revise organisational policies related to encryption to include the mandate for NIST-approved elliptic curves.

    Communicate updates to all relevant staff so everyone is aware and understands the importance of this measure.

  5. Internal audit teams should perform regular checks: Set up a schedule for auditing cryptographic implementations.

    This includes checking that the implemented elliptic curves are on the NIST-approved list and ensuring adherence over time.

Keep it running

Restrict TLS/crypto configurations to NIST SP 800‑186 curves only; regularly audit libraries and settings to prevent non‑approved curve negotiation.

Evidence and audit

  1. Check 1 of 5What an auditor asks for

    Ask for

    The list of elliptic curves currently in use: Request a document from the IT department detailing which curves are employed for encryption.

    Look at

    Whether these match those listed in NIST SP 800-186.

    Good evidence

    Shows exact matches and indicates review dates.

  2. Check 2 of 5What an auditor asks for

    Ask for

    The procurement policy regarding encryption standards: Request to see the procurement guidelines that mention encryption requirements.

    Look at

    Sections that specify using NIST-approved elliptic curves.

    Good evidence

    Will highlight these in the acquisition criteria.

  3. Check 3 of 5What an auditor asks for

    Ask for

    The internal encryption policy: Request the organisational encryption policy to review its contents.

    Look at

    Whether it explicitly references using NIST-approved elliptic curves.

    Good evidence

    Is clear policy wording matching this requirement.

  4. Check 4 of 5What an auditor asks for

    Ask for

    Recent training or briefing records: Request documentation of recent training sessions concerning encryption standards.

    Look at

    Attendance records and content that covers NIST elliptic curves.

    Good evidence

    Includes detailed session summaries and attendance lists.

  5. Check 5 of 5What an auditor asks for

    Ask for

    The results of the latest audit or review on cryptographic implementations: Request findings or audit results related to encryption methods.

    Look at

    Specific references to verifying NIST-approved elliptic curve usage.

    Good evidence

    Showcases thorough checks and compliance notes.

Mappings

Closest match in ISO/IEC 27001: A.8.24, Effective use of cryptography and key management, which this control partially meets.

ISO 27001

ISO/IEC 27001: 1 mapping

  • A.8.24Effective use of cryptography and key managementPartially meets

Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.