How should encryption controls for data at rest and in transit be evaluated during cyber audits?

• A. Focus exclusively on TLS in transit and AES at rest.
• B. Audit only key rotation practices.
• C. Assess cryptographic algorithms, key management lifecycle, encryption in transit (TLS), data at rest (AES or equivalent), key rotation, and access controls.
• D. Evaluate only access controls for encrypted data.

Answer: (C)

Evaluating encryption controls requires a comprehensive view of protection for data both in transit and at rest, plus how keys are managed and who can access them. You should verify that data in transit uses proven protections like current TLS configurations and valid certificates, and that data at rest is encrypted with strong algorithms (such as AES) across all storage locations and backups. The key management lifecycle is central: how keys are generated, stored securely, rotated on a defined schedule, revoked when needed, and destroyed, ideally with protective hardware like HSMs and robust access controls. Access controls around the encrypted data and the keys themselves must be tested to ensure only authorized personnel can decrypt or access key material. This holistic approach—covering cryptographic algorithms, key management lifecycle, encryption in transit and at rest, key rotation, and access controls—provides the thorough protection and governance needed in cyber audits. Focusing on only one aspect, like transport encryption or key rotation, leaves important gaps in confidentiality and control.