"Is data encrypted?" is the easy question. "Who can decrypt it, and how would you know?" is the one that finds problems. Cloud platforms made encryption a checkbox, which means encryption is rarely the gap - key management almost always is.
The three states, and where each is usually weak
- In transit - generally the strongest. TLS is well understood. Weak points: internal service-to-service traffic left unencrypted on the assumption the network is trusted, and legacy protocol versions still enabled.
- At rest - widely enabled, often with provider-managed keys. That satisfies most requirements, but understand what it protects against: it defends against physical media theft, not against an attacker with valid application credentials.
- In use - the emerging frontier. Confidential computing and similar approaches matter for highly sensitive workloads but are not yet a general expectation.
Be honest about the threat model. Provider-managed at-rest encryption does not protect data from a compromised application account - and claiming otherwise in a questionnaire is the kind of overstatement that unravels during due diligence.
The key lifecycle
Every stage needs a defined, evidenced practice:
- Generation - sufficient entropy, appropriate algorithm and length, generated in a protected environment.
- Distribution - never in source code, configuration files, or a shared drive.
- Storage - a key management service or hardware security module, not the same store as the data.
- Use - access restricted to the services that need it, with logging of key use.
- Rotation - on a defined schedule and on compromise, with a tested process.
- Revocation and destruction - including how you prove a key was destroyed, which is how "cryptographic erasure" of data is evidenced.
- Backup and recovery - because losing a key destroys the data as effectively as any attacker.
Evidence your cryptographic controls
GRC Copilot connects to your cloud and key management services to evidence encryption and key controls continuously - mapped across ISO 27001, PCI DSS, the NCA ECC and more.
Try GRC Copilot free Generate an AI-powered assessment Download checklist Book a demo
Who holds the keys
- Provider-managed - simplest, satisfies most baseline requirements, least control.
- Customer-managed keys - you control lifecycle and can revoke, within the provider's key service. The common middle ground, and increasingly expected by enterprise buyers.
- Customer-supplied or hold-your-own key - maximum control, maximum operational risk. Losing the key loses the data.
- Hardware security modules - required in some regulated contexts, particularly payments.
Choose based on your obligations and your operational maturity, not on which sounds strongest. Customer-managed keys with no key recovery process is a self-inflicted availability risk.
Separation of duties - the control auditors probe
The key question: can one person access both the encrypted data and the keys that decrypt it? If a database administrator can also administer the key service, encryption provides limited protection against insider risk. Expect an assessor to trace exactly that path, and to ask for the access review covering the key service specifically.
What frameworks require
- PCI DSS is most prescriptive - strong cryptography, documented key management procedures, split knowledge and dual control for manual clear-text key operations, and defined cryptoperiods.
- ISO 27001 requires a policy on cryptographic controls and key management across the lifecycle.
- HIPAA treats encryption as addressable - implement it or document an equivalent alternative.
- NCA ECC and SAMA CSF expect cryptography policies with evidenced implementation.
- Privacy law treats encryption as a risk-reducing measure that can affect breach notification obligations.
Crypto-agility
Algorithms weaken over time, and post-quantum migration is now a live planning question for long-lived data. Practical steps today: inventory where cryptography is used, avoid hard-coding algorithms in application logic, ensure certificate and key rotation is routine rather than exceptional, and identify data whose confidentiality must survive a decade.
Frequently asked questions
Is provider-managed encryption enough?
For many baseline requirements, yes. Enterprise buyers and regulated contexts increasingly expect customer-managed keys so you can demonstrate control and revocation.
How often should keys be rotated?
Define a cryptoperiod per key type and stick to it - annual is common for data encryption keys. PCI DSS expects defined cryptoperiods; other frameworks expect a documented, followed policy.
Do we need an HSM?
Only where regulation or the payment context requires it. A managed key service satisfies most organisations and is far easier to operate correctly.
What is cryptographic erasure?
Destroying the key so encrypted data becomes unrecoverable. It is an accepted deletion method in some contexts - but you must be able to evidence key destruction and that no copies remain.
Key takeaways
- Encryption is rarely the gap; key management is.
- At-rest encryption does not protect against compromised application credentials.
- Separation between data administrators and key administrators is heavily probed.
- Key backup and recovery matters as much as key protection.