Habit 11 of 18
Devices and systems
Encrypted laptops and phones
If a laptop or phone is lost, nobody can read what is on it.
A lost laptop is an inconvenience if it is encrypted, and possibly a reportable breach if it is not.
Switch it on in the map Counts towards 6 articles, controls and categories
§1 How to do it
How a small firm does it
- Turn on full-disk encryption on every laptop (BitLocker on Windows, FileVault on Mac).
- Make sure phones used for work have a passcode, which turns on their encryption.
- Keep the recovery keys somewhere safe that is not the laptop itself.
- Check encryption status every few months.
Evidence that shows it
- A device report showing encryption is on
- Where recovery keys are kept
Ireland: NCSC Ireland guidance on cryptography applies here. Irish NIS2 law is still pending.
§2 What it counts towards
What it counts towards
Most links are “supports”: doing this helps you show you meet the reference, without matching it exactly. None of them means “compliant”.
EU NIS2 Directive 1 item
-
21(2)(h) Cryptography and encryption · supports
policies and procedures regarding the use of cryptography and, where appropriate, encryption
This measure asks for policies on cryptography and, where appropriate, encryption. Encrypting laptops and phones is one use of them.
Read Art 21(2)(h) on EUR-Lex
General Data Protection Regulation 2 items
-
32(1)(a) Pseudonymisation and encryption · intersects
the pseudonymisation and encryption of personal data
Encryption is named in Article 32(1)(a), which also covers pseudonymisation. Device encryption is one use of it.
Read Art 32(1)(a) on EUR-Lex -
Art 34 Telling affected people about a high-risk breach · supports
in particular those that render the personal data unintelligible to any person who is not authorised to access it, such as encryption
If a lost device was encrypted, you may not have to tell every affected person about the breach: Article 34(3)(a) names encryption as a protection that can remove that duty.
Read Art 34(3)(a) on EUR-Lex
ISO/IEC 27001:2022 2 items
-
A.8.1 Laptops and phones used for work · supports
ISO text is copyrighted. Control number and our own description only. Not yet read against the standard.
Protecting laptops and phones used for work is the subject of this control.
About ISO/IEC 27001:2022 on ISO -
A.8.24 Use of cryptography · supports
ISO text is copyrighted. Control number and our own description only. Not yet read against the standard.
The control is about using cryptography in a planned way.
About ISO/IEC 27001:2022 on ISO
NIST Cybersecurity Framework 2.0 1 item
-
PR.DS Data security · subset
PR.DS-01: The confidentiality, integrity, and availability of data-at-rest are protected
Encrypting laptops and phones protects the confidentiality of data at rest.
Read PR.DS-01 on NIST
§3 Questions it answers
Indicative mapping, written by hand from public sources. Not legal advice and not a compliance test. Check anything important against the official texts.