In ISO/IEC 27001, what must organizations define regarding cryptography?

• A. Technical and organisational measures appropriate to risk
• B. Only the cryptographic algorithms to use
• C. Only the key lengths to support
• D. Only the encryption methods for data at rest

Answer: (A)

In ISO / IEC 27001, cryptography is managed through policies and controls that are tailored to the organization’s risk. The requirement is to define technical and organizational measures appropriate to the identified risks. This means not just picking a single algorithm or key length, but establishing a formal approach that covers how cryptographic controls are used, who can authorize them, how keys are generated and managed, where encryption is applied, and how those decisions align with data classifications, regulatory requirements, and business needs. The emphasis is on a risk-based framework that guides both the selection and the governance of cryptographic practices, including key management, rather than isolated choices like algorithms, key lengths, or data-at-rest methods alone.