[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:iso-27001\u002Fa-8-24":3},{"item":4,"lessons":16,"controls":66,"related":95},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"iso-27001","a-8-24","Annex A 8.24","ISO\u002FIEC 27001:2022 Annex A 8.24: Use of cryptography",13,"International Organization for Standardization (ISO) and IEC","**What it asks for.** This control expects rules for the effective use of cryptography, including cryptographic key management, to be defined and implemented. Its purpose is to make sure cryptography is used properly to protect the confidentiality, authenticity or integrity of information.\n\n**In practice.** Good practice is a topic-specific policy stating where encryption is required, for example data at rest and in transit, which algorithms and key lengths are acceptable and how keys are generated, stored, rotated and revoked. Legal restrictions on cryptography in different countries are considered. Auditors expect the policy, a key and certificate inventory and configuration evidence that encryption is applied as required.\n\n**Common gaps.** Common gaps are expired or unmanaged certificates, outdated protocols left enabled and no plan for moving to newer algorithms, including post-quantum options.",null,"https:\u002F\u002Fwww.iso.org\u002Fstandard\u002F27001","See the standard at ISO","2026-10-18T15:18:43.663+00:00",{"total":9,"list":17},[18,22,26,30,34,38,42,46,50,54,58,62],{"slug":19,"title":20,"published_at":21},"gobalance-key-exposure-flaw-enables-onion-address-hijacking","GoBalance Key Exposure Flaw Enables .onion Address Hijacking","2026-10-09T10:20:58.801+00:00",{"slug":23,"title":24,"published_at":25},"quantum-computing-threatens-todays-encryption-act-now","Quantum Computing Threatens Today's Encryption — Act Now","2026-10-08T12:21:46.771+00:00",{"slug":27,"title":28,"published_at":29},"openai-ai-agents-leaked-user-images-to-third-party-hosts","OpenAI AI Agents Leaked User Images to Third-Party Hosts","2026-09-26T20:21:57.994+00:00",{"slug":31,"title":32,"published_at":33},"vodafone-espaa-fined-750k-for-gdpr-failures-including-false-encryption-claims","Vodafone España Fined €750K for GDPR Failures Including False Encryption Claims","2026-09-23T10:21:14.93+00:00",{"slug":35,"title":36,"published_at":37},"g7-urges-urgent-shift-to-post-quantum-cryptography","G7 Urges Urgent Shift to Post-Quantum Cryptography","2026-09-03T20:20:23.464+00:00",{"slug":39,"title":40,"published_at":41},"post-quantum-cryptography-organizations-must-act-now-before-quantum-computing-breaks-todays-encrypti","Post-Quantum Cryptography: Organizations Must Act Now Before Quantum Computing Breaks Today's Encryption","2026-09-03T16:21:16.12+00:00",{"slug":43,"title":44,"published_at":45},"irish-hospital-fined-300k-after-ransomware-exposes-84000-patients-health-data","Irish Hospital Fined €300K After Ransomware Exposes 84,000 Patients' Health Data","2026-08-19T10:20:51.934+00:00",{"slug":47,"title":48,"published_at":49},"google-clouds-2029-post-quantum-cryptography-deadline-signals-urgent-crypto-migration-need","Google Cloud's 2029 Post-Quantum Cryptography Deadline Signals Urgent Crypto Migration Need","2026-08-14T12:21:14.711+00:00",{"slug":51,"title":52,"published_at":53},"ai-assisted-cryptanalysis-exposes-weaknesses-in-aes-variants-and-post-quantum-schemes","AI-Assisted Cryptanalysis Exposes Weaknesses in AES Variants and Post-Quantum Schemes","2026-07-28T20:20:37.736+00:00",{"slug":55,"title":56,"published_at":57},"confidential-computing-protecting-data-in-use-with-tees-on-cpus-and-gpus","Confidential Computing: Protecting Data in Use with TEEs on CPUs and GPUs","2026-07-28T12:20:34.412+00:00",{"slug":59,"title":60,"published_at":61},"gdpr-violation-sharing-personal-data-via-facebook-message-ruled-unlawful","GDPR Violation: Sharing Personal Data via Facebook Message Ruled Unlawful","2026-07-06T08:20:37.464+00:00",{"slug":63,"title":64,"published_at":65},"quantum-computing-forces-cryptography-overhaul-by-2029","Quantum Computing Forces Cryptography Overhaul by 2029","2026-07-01T12:21:07.439+00:00",[67,72,77,82,86,91],{"slug":68,"name":69,"problem":70,"stories":71},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",8,{"slug":73,"name":74,"problem":75,"stories":76},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",3,{"slug":78,"name":79,"problem":80,"stories":81},"patch-management","Automated patch management","Known holes get closed in days, not months.",2,{"slug":83,"name":84,"problem":85,"stories":81},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",{"slug":87,"name":88,"problem":89,"stories":90},"ai-security","AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",1,{"slug":92,"name":93,"problem":94,"stories":90},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",[96,101,107,113,117,122,126,131],{"family":97,"item":98,"code":99,"title":100,"together":9},"cis","3","Control 3","Data Protection",{"family":102,"item":103,"code":104,"title":105,"together":106},"gdpr","32","Article 32","Security of processing",11,{"family":108,"item":109,"code":110,"title":111,"together":112},"nist-csf","pr-ds","PR.DS-1","Data Security",7,{"family":97,"item":114,"code":115,"title":116,"together":112},"16","Control 16","Application Software Security",{"family":102,"item":118,"code":119,"title":120,"together":121},"25","Article 25","Data protection by design and by default",5,{"family":123,"item":124,"code":125,"title":125,"together":121},"itil","overview","ITIL",{"family":127,"item":128,"code":129,"title":130,"together":121},"nist-sp","800-208","SP 800-208","SP 800-208: Recommendation for Stateful Hash-Based Signature Schemes",{"family":102,"item":132,"code":133,"title":134,"together":76},"5","Article 5(1)(f)","Principles relating to processing of personal data"]