Crossfoot
Crossfoot / Controls / Encryption in transit
Draft v0.1.06 of 6 frameworks

Encryption in transit

Data transmitted over public or untrusted networks, and administrative access, is protected with strong cryptography.

Where it appears

SOC 2
CC6.7Restricts transmission, movement and removal of information
PCI DSS 4.0
4.2PAN is protected with strong cryptography during transmission
2.2.7All non-console administrative access is encrypted
NIST CSF 2.0
PR.DS-02The confidentiality, integrity and availability of data-in-transit are protected
ISO 27001:2022
A.5.14Information transfer
A.8.24Use of cryptography
HIPAA Security Rule
164.312(e)(1)Transmission security
NIST 800-53 r5
SC-8Transmission confidentiality and integrity
SC-13Cryptographic protection

Evidence auditors usually ask for

A typical starting list. Your assessor's request list is the one that counts.

  • Policy or standard requiring TLS 1.2+ (or current minimum) for transmission
  • TLS scan results for public endpoints
  • Configuration evidence for VPN / encrypted admin access (SSH, RDP gateways)
  • Inventory of external data transmissions and the protection used

Crosswalks that include this

SOC 2 to PCI DSS 4.0SOC 2 to NIST CSF 2.0SOC 2 to ISO 27001:2022SOC 2 to HIPAA Security RuleSOC 2 to NIST 800-53 r5PCI DSS 4.0 to SOC 2PCI DSS 4.0 to NIST CSF 2.0PCI DSS 4.0 to ISO 27001:2022PCI DSS 4.0 to HIPAA Security RulePCI DSS 4.0 to NIST 800-53 r5NIST CSF 2.0 to SOC 2NIST CSF 2.0 to PCI DSS 4.0