ASD ISM 1996 Using hybrid schemes for secure encryption
What it says
When a post-quantum traditional hybrid scheme is used, either the post-quantum cryptographic algorithm, the traditional cryptographic algorithm or both are AACAs.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure at least one encryption method is approved for strong protection against future quantum threats.
This control is about using a combination of current and new methods to keep your data safe from future threats, including those posed by advanced computers yet to come. It matters because if you don't prepare now, your sensitive information could be at risk when these powerful new technologies become available, potentially leading to data breaches or loss of customer trust.
Free. Save your status, tasks and notes.
Why it matters
If neither algorithm in a post-quantum/traditional hybrid is an AACA, encrypted data may be compromised as cryptanalysis improves or quantum attacks emerge.
How to implement
System owners should coordinate with cyber security experts to understand the basics of hybrid encryption.
This involves learning about traditional and post-quantum algorithms to comprehend their significance in protecting information against potential future threats.
The IT team should assess current encryption processes and identify opportunities to implement hybrid encryption methods.
This can be done by first auditing existing systems to check which encryption algorithms are already in use and consulting cyber security guidelines from the Australian Cyber Security Centre (ACSC).
Procurement officers should ensure any new software or systems being acquired support hybrid encryption technologies.
They should ask vendors whether their products incorporate both traditional and post-quantum algorithms and require evidence or certifications that these meet standards set by the Australian Signals Directorate (ASD).
Managers should arrange for regular training sessions for staff to understand the importance of encryption in the context of hybrid schemes.
These sessions should focus on what encryption is, why it's important, and what's being done within the business to protect data today and in the future.
The IT security manager should establish a monitoring system to consistently check the effectiveness of hybrid schemes in place.
They can use performance metrics and regular reviews against the latest ACSC guidelines to ensure ongoing protection even as threats evolve.
Keep it running
Regularly review your PQ/traditional hybrid so that at least one component algorithm is an AACA, and replace any component that is no longer assessed as AACA.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Documentation of the encryption technologies currently in use: Request a report that lists all encryption algorithms applied across systems.
Look at
Mention of both traditional and post-quantum algorithms being used as part of a hybrid approach.
Good evidence
Should clearly show the integration of both algorithm types with explanations of how they protect against modern and future threats.
- Check 2 of 5What an auditor asks for
Look at
The frequency and content of training sessions provided to staff. Good results will show regular (e.g., quarterly) training updates with clear, understandable materials explaining hybrid encryption concepts and their importance.
- Check 3 of 5What an auditor asks for
Ask for
To see procurement records for technology purchases: Review the criteria and responses from vendors regarding encryption capabilities.
Look at
Evidence that vendors have confirmed support for hybrid encryption methods.
Good evidence
Includes documented responses or certifications from vendors ensuring compliance with encryption standards.
- Check 4 of 5What an auditor asks for
Good evidence
Will be a recent (e.g., annual) report confirming the integration and effectiveness of both traditional and post-quantum encryption algorithms.
- Check 5 of 5What an auditor asks for
Ask for
Monitoring logs or reports showing the ongoing evaluation of encryption technologies.
Look at
Regular entries and summaries assessing the strength and performance of hybrid schemes.
Good evidence
Is a consistent record showing proactive checks and updates made in alignment with evolving security guidance.
Mappings
Closest match in ISO/IEC 27001: A.8.24, Effective use of cryptography and key management, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.24.
ISM-1996 requires that when using a post-quantum/traditional hybrid encryption scheme, at least one of the component algorithms is an AACA (quantum-safe assurance). Annex A 8.24 requires organisations to define and implement rules for cryptography use and cryptographic key management, under which algorithm selection/approval and hybrid scheme rules would be governed. Annex A 8.24 is broader because it covers cryptography and key management generally (e.g. key lifecycle, roles, key protection), while ISM-1996 is a specific constraint on algorithm approval within hybrid encryption.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.