Cryptography and key management audit program.
How to audit whether encryption is used according to a concept with recognised algorithms and whether keys and certificates are protected across their whole life cycle.
Last updated: 13 October 2026 · Sample, not legal advice
Download the sample as PDF 8 pages, no sign-up
Download as Excel template with columns for result and notes, no sign-up
Audit objective
The audit assesses whether the organisation governs the use of cryptography in a cryptographic concept, uses only recognised algorithms and key lengths and encrypts data in transit and at rest according to its protection needs. It also assesses whether keys and certificates are managed in a controlled way from generation to destruction and whether the organisation is prepared for future changes of algorithms.
Scope
- Encryption of data in transit and at rest in applications, databases, storage media and backups
- Key management including hardware security modules, key vaults and cloud key services
- Internal and external certificates and an own public key infrastructure, where present
- Out of scope: cryptanalysis of individual algorithms
Audit program
| No. | Criterion | Reference | Audit procedure | Expected evidence |
|---|---|---|---|---|
| 1 | A cryptographic concept defines where and how cryptography is used and is approved. | NIS2 Directive Art. 21(2)(h); § 30(2) no. 8 BSIG; BSI CON.1 | Read the concept, check approval and currency and compare it with the systems in use. | Cryptographic concept with approval note |
| 2 | Permitted algorithms and key lengths follow recognised recommendations; outdated algorithms are excluded. | BSI TR-02102-1 | Compare the list of permitted algorithms with current recommendations and read actual settings on three systems. | List of permitted algorithms, configuration extracts |
| 3 | A register of cryptographic algorithms, keys and certificates in use is maintained. | BSI CON.1; ISO/IEC 27001:2022 Annex A 8.24 | Review the register and check completeness against a sample of applications and interfaces. | Crypto inventory, certificate list |
| 4 | Data is encrypted in transit over networks; the TLS configuration meets the requirements. | BSI TR-02102-2; ISO/IEC 27001:2022 Annex A 8.24 | Test external and internal services with a tool for protocol versions and cipher suites. | TLS configuration test results, actions on deviations |
| 5 | Stored data is encrypted according to protection needs and risk assessment, including backups. | ISO/IEC 27001:2022 Annex A 8.24; DORA Art. 9(4)(d) | For three data sets with high protection needs, trace encryption of database, storage and backup. | Protection needs assessment, encryption configuration |
| 6 | The key life cycle is governed: generation, distribution, storage, rotation, revocation and destruction. | ISO/IEC 27001:2022 Annex A 8.24; BSI CON.1 | Read the rule and trace the life cycle of two keys including the date of the last rotation. | Key management rule, key rotation records |
| 7 | Keys are stored in protected form, for example in hardware security modules or key vaults, with tightly limited access. | DORA Art. 9(4)(d); ISO/IEC 27001:2022 Annex A 8.24 | Ask where keys are stored, have a search run for keys in source code or configuration files and check access rights. | Key vault permission extract, result of the search for embedded keys |
| 8 | Certificates are monitored centrally, renewed in time and revoked when compromised. | ISO/IEC 27001:2022 Annex A 8.24 | Have expiry monitoring demonstrated and ask about outages caused by expired certificates in the last twelve months. | Certificate overview with expiry dates, renewal records, incident list |
| 9 | Duties in key management are segregated; critical operations require dual control. | ISO/IEC 27001:2022 Annex A 5.3 | Check roles in key management and records of critical operations such as generating master keys. | Role concept, records with two participants |
| 10 | Keys are backed up so that encrypted data and backups can be restored. | BSI CON.1; ISO/IEC 27001:2022 Annex A 8.13 | Have key backup explained and review the last restore test of encrypted data. | Key backup concept, restore test record |
| 11 | Legal requirements on the use and export of cryptography are taken into account. | ISO/IEC 27001:2022 Annex A 5.31 | Check whether legal restrictions have been identified for sites and travel outside the EU. | Register of legal requirements, rule for sites abroad |
| 12 | The organisation plans the transition to new algorithms, including quantum-resistant cryptography. | BSI TR-02102-1 | Ask whether systems with long-lived data and hard-coded algorithms are recorded and whether a transition plan exists. | Crypto agility analysis, migration plan |
Documents to request
- Cryptographic concept
- List of permitted algorithms and key lengths
- Crypto inventory and certificate overview
- TLS configuration test results
- Key management rule with roles
- Permission extract of key vaults or hardware security modules
- Record of the last restore test of encrypted data
- Plan for the transition of cryptographic algorithms
Typical findings
- A cryptographic concept is missing or lists algorithms that are no longer recommended.
- Keys and passwords are kept in source code or configuration files.
- Certificates expire unnoticed and cause outages.
- Internal services accept outdated protocol versions.
- Backups are encrypted, but the key is not backed up separately.
- There is no overview of which systems would be affected by a change of algorithms.
Note on references
The references point to laws, regulations and standards so that you can read the requirement in the original. No normative text is reproduced. Criteria and procedures are original wording and replace neither the text of the provisions nor legal advice. Whether and to what extent a provision applies to your organisation should be clarified before the audit.
The complete package
This sample shows the objective, the audit steps and the document list on one page. For your own audit topic, ProAuditMap creates the complete package: audit plan, audit program per audit dimension, document request list, interview guides, schedule, communication and report template. You review the draft, approve it and export to Excel and Word.
Create account View a complete sample package View pricing