ISO/IEC 27701:2025·Annex A A.3.26·critical·Component: Security considerations

What this control requires

Define and implement rules for effective use of cryptography and key management. Implementation: Define cryptographic policy, key management and provide info to customers about usage. Justification: Cryptography protects confidentiality and integrity of PII.
— ISO/IEC 27701:2025, Annex A A.3.26

In plain English

Define and implement rules for effective use of cryptography and key management. In practice, this means you can prove you implement use of cryptography-level controls on a defined cadence.

Why it matters

ISO 27701 is the international way to evidence the GDPR principle of accountability: certified PIMS controls translate directly into the records, contracts and rights-handling that supervisory authorities want, and into the privacy-engineering evidence SOC 2 + Privacy auditors and enterprise procurement teams ask for.

This control is rated critical in the source catalogue. Treat gaps here as production incidents in the risk register, not housekeeping.

What an auditor looks for

PIMS auditors expect ISO 27001 to be implemented first and then the 27701-additional controls tested. For PII controllers they look at lawful-basis and rights-handling evidence; for PII processors they look at customer-instructions, sub-processor controls and return/transfer/disposal evidence.

Within Security considerations, the assessor will trace your implementation back to the catalogue reference (Annex A A.3.26) and look for objective evidence on the latest two assessment cycles.

How to implement

  1. Write a short policy stating intent, scope and named owner.
  2. Encode it as a platform guardrail — SCP, Azure Policy initiative, Organisation Policy, or repository policy.
  3. Wire a monitoring signal that catches drift (CSPM rule, SIEM rule, scheduled query, Workspace alert) and ticket it.
  4. Review on a documented cadence and capture the review in the risk register or compliance tracker.

Operational checklist

  • Implement. Document the trigger, the owner and the cadence.
  • Define. Document the trigger, the owner and the cadence.
  • Provide. Document the trigger, the owner and the cadence.
  • Scope: use of cryptography.

Evidence to collect

  • Infra Scan. Continuous infrastructure-posture telemetry — AWS Config, Azure Policy compliance, GCP Organisation Policy, Wiz / Prisma findings.
  • Policy Document. A signed and version-controlled policy / standard / procedure document.

Signed policies, procedures, and registers document the safeguard. Infrastructure posture tooling (AWS/Azure/GCP configuration, encryption, backup, logging) verifies technical enforcement. Focus: Use of cryptography.

How it maps to other frameworks

Computed from shared tags, control component and key-operation subjects — handy when you are reconciling controls across an audit.

Related controls in ISO/IEC 27701:2025

References

Topics: data protectionencryption at restencryption in transitkey management