Skip to content
Cryptography
ASD ISMISM-1770

ASD ISM 1770 Utilise strong AES encryption algorithms

What it says

When using AES for encryption, AES-192 or AES-256 is used, preferably AES-256.

Quoted as published. Everything else on this page is written by Control Stack.

What it means

In plain English

When encrypting with AES, use stronger versions like AES-192 or preferably AES-256 for better security.

This control is about using strong encryption to protect your data when it is being stored or sent over the internet. By choosing a stronger form of encryption like AES-256, you make it much harder for hackers to access your sensitive information. If you don't do this, your data could be stolen, leading to financial loss, reputational damage, or privacy breaches.

Why it matters

Using weak AES encryption can expose sensitive data to breaches, resulting in financial loss and eroded trust.

How to implement

  1. IT team should review current encryption setups: Check what version of AES (Advanced Encryption Standard) is currently in use for encrypting data.

    Make sure the version is either AES-192 or AES-256, with a preference for AES-256 for the highest security.

  2. System administrators should update encryption settings: For systems using older or weaker encryption, upgrade to AES-256.

    This often involves changing settings in software configurations or updating encryption keys to ensure compliance.

  3. Procurement should specify encryption requirements in contracts: When purchasing new software or systems, include a requirement for AES-256 encryption.

    This can be done by adding it as a clause in contracts with software vendors.

  4. IT security team should conduct regular audits of encryption practices: Regularly check and verify that all systems are using AES-256 for encryption.

    Set up a schedule to review these settings at least annually.

  5. Train staff on the importance of strong encryption: Provide training sessions for employees to help them understand why strong encryption, like AES-256, is critical for safeguarding data.

    Use real-world examples to illustrate potential risks of using weaker encryption methods.

Keep it running

Regularly audit systems and crypto libraries to ensure AES-256 (or at least AES-192) is enforced for all AES use, and block any AES-128 configurations.

Evidence and audit

  1. Check 1 of 5What an auditor asks for

    Ask for

    The encryption policy document: Request a copy of the organisation's policy on encryption standards. Look to confirm it specifies the use of AES-192 or AES-256 for all relevant data.

    Good evidence

    Document will clearly state AES-256 as the preferred method with clear guidelines on when it should be used.

  2. Check 2 of 5What an auditor asks for

    Ask for

    A recent encryption audit report: Request recent audit findings on encryption implementations within the organisation.

    Look at

    Confirmation that all systems are using AES-256, with details of any non-compliance rectified.

    Good evidence

    Report will show all systems meet the AES-256 requirement with evidence of recent checks.

  3. Check 3 of 5What an auditor asks for

    Ask for

    Purchase contracts for new systems: Verify if the contracts specify encryption requirements.

    Look at

    Clauses directing the use of AES-256.

    Good evidence

    Contract will clearly mandate AES-256 as part of technical specifications.

  4. Check 4 of 5What an auditor asks for

    Ask for

    System configuration logs: Request proof of system configurations that show encryption settings.

    Look at

    The settings to ensure AES-256 is listed as the encryption method. Good logs will clearly indicate AES-256 is in use across all encrypting systems.

  5. Check 5 of 5What an auditor asks for

    Ask for

    Staff training records: Request documentation of staff training sessions on encryption.

    Look at

    Records of attendance and training materials focused on AES encryption. Good training records will show that relevant employees understand the importance of AES-256 encryption.

Mappings

Closest match in ISO/IEC 27001: A.8.24, Effective use of cryptography and key management, which this control partially meets.

ISO 27001

ISO/IEC 27001: 1 mapping

  • A.8.24Effective use of cryptography and key managementPartially meets

Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.