Encryption requirements compared: what frameworks specify and what they leave to you

Encryption is one of the few controls every security framework expects in some form. Read the requirements closely, though, and they differ on three things that matter far more than algorithm choice: when encryption is mandatory, whether you must use validated cryptographic modules, and how much key management they spell out.

Who requires what

Framework	Encryption	Link
NIST CSF 2.0	PR.DS-01PR.DS-02	Topic definition
ISO 27001	A.8.24	Crosswalk
CIS v8.1	CIS 3.10CIS 3.11CIS 3.6CIS 3.9	Crosswalk
SOC 2	CC6.1CC6.7	Editorial
PCI DSS	3.5.13.6.14.2.13.7.13.7.44.2.1.1	Crosswalk
CMMC	SC.L2-3.13.8SC.L2-3.13.11SC.L2-3.13.16AC.L2-3.1.13AC.L2-3.1.19SC.L2-3.13.10MP.L2-3.8.6	Crosswalk
800-53	SC-8SC-12SC-13SC-28	Crosswalk
HIPAA	§164.312(a)(2)(iv)§164.312(e)(2)(ii)	Crosswalk
GDPR	Art.32(1)(a)Art.34(3)(a)	Editorial
NIS2	9.1	Crosswalk
Essential Eight	—	No mapping in our data

Full detail and the reason for every link: Encryption across frameworks →

When encryption is mandatory

• PCI DSS is unambiguous. Stored primary account numbers must be rendered unreadable (3.5.1), and PAN must be protected with strong cryptography when sent over open, public networks (4.2.1).
• CMMC Level 2 requires cryptographic protection of CUI in transit (SC.L2-3.13.8), at rest (SC.L2-3.13.16), on mobile devices (AC.L2-3.1.19) and on portable storage (MP.L2-3.8.6).
• HIPAA makes encryption at rest and in transit addressable: implement it, or document why an equivalent alternative is reasonable. In practice, unencrypted ePHI on a lost laptop is hard to defend, and HHS proposed in January 2025 to make encryption required.
• GDPR names encryption as a measure to consider (Article 32(1)(a)) and gives it a concrete benefit: if breached data was encrypted, you may not need to notify the people affected (Article 34(3)(a)).
• ISO 27001 (A.8.24), SOC 2 (CC6.1, CC6.7) and NIS2 (point 9.1, a cryptography policy) require you to decide where cryptography is needed and apply it, rather than mandating it everywhere.

Validated cryptography

Only the US federal family insists on validated modules. CMMC Level 2 requires FIPS-validated cryptography to protect CUI confidentiality (SC.L2-3.13.11), and SP 800-53 systems use FIPS-validated modules (SC-13). Everyone else asks for "strong" or "appropriate" cryptography. For a contractor, that difference decides which libraries, VPNs and disk encryption products you can use.

Key management

Key management is where frameworks differ most in depth. PCI DSS spells it out across 3.6 and 3.7: generation, distribution, storage, changing keys at the end of their cryptoperiod, retiring compromised keys, split knowledge and dual control, and custodian acknowledgements. It also requires an inventory of trusted keys and certificates (4.2.1.1). SP 800-53 (SC-12) and CMMC (SC.L2-3.13.10) require key establishment and management. ISO 27001 asks for rules on the effective use of cryptography, including key management, and leaves the detail to you.

Key takeaways

• Frameworks rarely name algorithms; they differ on when encryption is mandatory, validated modules and key management.
• PCI DSS and CMMC are the strictest; HIPAA's encryption specifications are addressable.
• Use PCI's key-management detail as the checklist, whatever applies to you.

What to do

1. Encrypt by default at rest and in transit for sensitive data; it's mandatory somewhere in almost every framework family, and the exceptions are hard to justify.
2. Check whether you need validated modules before buying products (CMMC, FedRAMP and other federal work).
3. Write key management down to PCI's level of detail even if PCI doesn't apply; it's the most complete checklist available.
4. Record cryptographic decisions in a cryptography policy (NIS2 9.1, ISO A.8.24) and review cipher suites periodically (PCI 12.3.3 asks for annual reviews).

The Encryption topic page lists every requirement with its source, and the gap analysis compares any two frameworks requirement by requirement.

Questions

Does HIPAA require encryption?

Encryption of ePHI at rest (§164.312(a)(2)(iv)) and in transit (§164.312(e)(2)(ii)) are addressable specifications under the current Security Rule: you must implement them or document why an equivalent measure is reasonable. HHS proposed in January 2025 to make encryption required.

Which frameworks require FIPS-validated cryptography?

CMMC Level 2 requires FIPS-validated cryptography to protect the confidentiality of CUI (SC.L2-3.13.11), and US federal systems under SP 800-53 use FIPS-validated modules (SC-13).

Which encryption algorithms do frameworks require?

Very few name algorithms. PCI DSS requires strong cryptography based on industry-accepted algorithms and key lengths; US federal systems use FIPS-validated modules; ASD's ISM lists approved algorithms and protocols. Most other frameworks leave the choice to you, guided by current standards.