ASD ISM 1769 Using AES encryption with strong key lengths
What it says
When using AES for encryption, AES-128, AES-192 or AES-256 is used, preferably AES-256.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishUse AES encryption with a strong key length, preferably AES-256, for enhanced security.
Using AES encryption with a strong key, like AES-256, keeps your data safe from hackers. If your data isn't well protected, cybercriminals could steal sensitive information, leading to financial losses and damage to your reputation.
Free. Save your status, tasks and notes.
Why it matters
Using AES with weak or non-approved variants can enable data compromise, leading to unauthorised disclosure, financial loss and reputational damage. Prefer AES-256 for stronger protection.
How to implement
The IT team should choose AES-256 for encrypting sensitive data.
You can do this by configuring your software and systems to use this encryption method to secure data, especially for customer information and business-sensitive files.
Business owners should consult IT providers to ensure they use software that supports AES-256 encryption.
They should ask their IT provider to confirm that the systems are set up correctly to achieve high security.
Managers should train staff on why using strong encryption is crucial.
This involves organising training sessions to explain the importance of encryption in protecting company data and how to follow procedures that maintain high data security standards.
Procurement officers should verify that any new software or service purchase supports AES-256 encryption.
This means checking product specifications and asking vendors for documentation that confirms compliance with this requirement.
System owners should conduct regular check-ups on their systems to ensure AES-256 encryption is in use.
This includes performing routine audits or assessments and logging results to confirm that encryption standards are consistently applied.
Keep it running
Regularly audit encryption configurations to ensure AES-128/192/256 only (prefer AES-256), and block legacy/weak cipher suites in applications, libraries and TLS settings.
Evidence and audit
- Check 1 of 4What an auditor asks for
Ask for
The IT policies documentation.
Look at
Whether they specify the use of AES-256 encryption for sensitive data.
Good evidence
Includes clear requirements stating AES-256 must be used for all data encryption processes.
- Check 2 of 4What an auditor asks for
Ask for
System configuration reports from IT. These should show which encryption standards are currently applied.
Good evidence
Is documentation confirming that AES-256 is configured as the standard for all necessary systems.
- Check 3 of 4What an auditor asks for
Good evidence
Record will detail that AES-256 was a purchase condition.
- Check 4 of 4What an auditor asks for
Ask for
Logs of regular system assessments.
Look at
Whether these assessments include checks on encryption settings, specifically for AES-256. A satisfactory answer is a recent log showing that AES-256 is actively in use.
Mappings
Closest match in ISO/IEC 27001: A.8.24, Effective use of cryptography and key management, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.24.
ISM-1769 requires that when AES is used for encryption it uses strong key lengths (AES-128/192/256), preferably AES-256. This relates to Annex A 8.24, which requires organisations to define and implement rules for effective use of cryptography and cryptographic key management, within which specifying approved algorithms and key lengths (including AES-256) is a core requirement. Annex A 8.24 is broader because it covers the full cryptography policy and key management lifecycle, not just AES key length selection.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.