What it asks for. This control expects rules for the effective use of cryptography, including cryptographic key management, to be defined and implemented. Its purpose is to make sure cryptography is used properly to protect the confidentiality, authenticity or integrity of information.
In practice. Good practice is a topic-specific policy stating where encryption is required, for example data at rest and in transit, which algorithms and key lengths are acceptable and how keys are generated, stored, rotated and revoked. Legal restrictions on cryptography in different countries are considered. Auditors expect the policy, a key and certificate inventory and configuration evidence that encryption is applied as required.
Common gaps. Common gaps are expired or unmanaged certificates, outdated protocols left enabled and no plan for moving to newer algorithms, including post-quantum options.