A.8.24 Audit Evidence Pack

What the auditor wants to verify

Evidence to request

Strong evidence

• Cryptographic decisions trace to risk and classification.
• Algorithms, key lengths, and protocols are approved and current.
• Keys have owners, purpose, lifecycle status, and rotation/expiry dates.
• Secret/private keys are protected by approved mechanisms.
• Public keys and certificates are protected against unauthorized replacement.
• CA or third-party KMS trust is reviewed.
• Key escrow/recovery is authorized, tested, and monitored.

Weak evidence

• Encryption exists but no one can explain the rules.
• Algorithms are selected by individual developers.
• Keys are stored in code, tickets, spreadsheets, or shared drives.
• Certificates expire without warning.
• Key rotation and revocation are informal.
• Legal restrictions are not assessed.

Sample interview questions

• When must cryptography be used?
• Which algorithms and key lengths are approved?
• Who owns cryptographic keys?
• How are private keys protected?
• How are keys rotated, revoked, and destroyed?
• How are certificates and CAs reviewed?
• What happens if a key is lost or compromised?
• Are legal restrictions on cryptography assessed?

Common nonconformities

• No cryptographic policy or standard.
• Weak or deprecated algorithms are used.
• Key inventory is missing.
• Secret/private keys are inadequately protected.
• Key rotation, revocation, or destruction is not performed.
• Certificate authority trust is not reviewed.
• Key escrow exists without authorization or monitoring.

Related notes

• A.8.24 Use of Cryptography
• Cryptographic Controls Policy
• Cryptographic Use Case and Algorithm Register
• Cryptographic Key Management Register
• Certificate Authority and Certificate Review
• Key Escrow and Emergency Recovery Checklist
• Cryptographic Legal Requirements Assessment
• A.8.24 Audit Checklist