Taking into account the state of the art [...] the controller and the processor shall implement [...] as appropriate [...] encryption of personal data;
In assessing the appropriate level of security account shall be taken in particular of the risks that are presented by processing, in particular from accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data transmitted, stored or otherwise processed. [highlights added]
(ii) Encryption (Addressable). Implement a mechanism to encrypt electronic protected health information whenever deemed appropriate.
Mapping to ISO 27001 Controls
Compliant Kubernetes Cryptography Dashboard
The Compliant Kubernetes Cryptography Dashboard allows to quickly audit the status of cryptography. It shows, amongst others, the public Internet endpoints (Ingresses) that are encrypted and the expiry time. Default Compliant Kubernetes configurations automatically review certificates before expiry.
In case there is a violation of cryptography policies:
- If a certificate is expired and was not renewed, ask the operator to check the status of
- If an endpoint is not encrypted, ask the developers to set the necessary Ingress annotations.