Draft v0.1.06 of 6 frameworks
Encryption at rest and key management
Sensitive data is encrypted or otherwise rendered unreadable where stored, with managed cryptographic keys.
Where it appears
- SOC 2
CC6.1Logical access security (encryption of data at rest)- PCI DSS 4.0
3.5Primary account number is secured wherever it is stored3.6Cryptographic keys used to protect stored account data are secured3.7Key management processes and procedures are defined and implemented- NIST CSF 2.0
PR.DS-01The confidentiality, integrity and availability of data-at-rest are protected- ISO 27001:2022
A.8.24Use of cryptography- HIPAA Security Rule
164.312(a)(2)(iv)Encryption and decryption (addressable)- NIST 800-53 r5
SC-28Protection of information at restSC-12Cryptographic key establishment and managementSC-13Cryptographic protection
Evidence auditors usually ask for
A typical starting list. Your assessor's request list is the one that counts.
- Cryptography / key management policy
- Configuration evidence of encryption on databases, storage and backups
- Key management procedures: generation, rotation, storage, retirement
- Inventory of where sensitive data is stored and the protection method for each
Crosswalks that include this
SOC 2 to PCI DSS 4.0SOC 2 to NIST CSF 2.0SOC 2 to ISO 27001:2022SOC 2 to HIPAA Security RuleSOC 2 to NIST 800-53 r5PCI DSS 4.0 to SOC 2PCI DSS 4.0 to NIST CSF 2.0PCI DSS 4.0 to ISO 27001:2022PCI DSS 4.0 to HIPAA Security RulePCI DSS 4.0 to NIST 800-53 r5NIST CSF 2.0 to SOC 2NIST CSF 2.0 to PCI DSS 4.0