Rules by market

The rules a buyer is actually subject to

This product is about a technical standard, so the ISMS control is the anchor and the national instruments are named references. We scanned the available frameworks for the four markets in the order the estate uses: the United States, the European Union, the United Kingdom and Australia. Where a regime is named but not in the public preview, the page says so and does not state its text.

The anchor for every market

ISO/IEC 27001:2022 Annex A 8.24 is the control that asks an organisation to define and apply rules for cryptography and for key management. ISO/IEC 27002:2022 8.24 is the guidance for the same control. A new edition of an algorithm standard is one of the changes those rules have to account for. That is the obligation most buyers actually carry, and it applies in all four markets.

United States

A US buyer usually reaches this amendment through a module validation file or a federal algorithm transition question, not through a certification scheme. The action is to check the module and the claim, and to record the answer.

Instrument	Status here	Why it matters to this buyer
NIST SP 800-131A Rev. 2	named reference, not in the public preview	The transition guidance federal and regulated buyers cite for algorithm strength and key length. It does not name this amendment.
FIPS 140-3	named reference, not in the public preview	The module validation standard a US buyer asks about when a cipher is sold into a regulated market.
ISO/IEC 27001:2022 Annex A 8.24	read here	The control that asks for rules on cryptography and key management, whatever the algorithm standard.

European Union

An EU buyer meets the amendment through supplier due diligence and, where a scheme applies, through certification evidence. The record names the instruments and does not state their text.

Instrument	Status here	Why it matters to this buyer
ISO/IEC 27001:2022 Annex A 8.24	read here	The ISMS control for cryptography and key management.
Regulation (EU) 2019/881 (Cybersecurity Act)	named reference, not in the public preview	The certification framework under which an EU scheme may reference a standard. It does not name this amendment.
NIS2 Directive (EU) 2022/2555	named reference, not in the public preview	The incident and supply chain duties that make a supplier s crypto claim part of due diligence.

United Kingdom

A UK buyer usually treats the amendment as a supplier and design question, with the ISMS control as the anchor. The record does not state the national guidance.

Instrument	Status here	Why it matters to this buyer
ISO/IEC 27001:2022 Annex A 8.24	read here	The ISMS control, adopted in the UK through the ISO route.
NCSC cryptographic guidance	named reference, not in the public preview	The national guidance a UK buyer checks for algorithm and key length expectations.
UK GDPR and the Data Protection Act 2018	named reference, not in the public preview	The security principle that makes encryption an expected control for personal data.

Australia

An Australian buyer meets the amendment through the privacy and ISMS route, and through supplier questions. The record names the instruments and does not state their text.

Instrument	Status here	Why it matters to this buyer
ISO/IEC 27001:2022 Annex A 8.24	read here	The ISMS control for cryptography and key management.
Privacy Act 1988 and the Australian Privacy Principles	named reference, not in the public preview	APP 11 expects reasonable security, which is where encryption evidence is asked for.
ACSC cryptographic guidance	named reference, not in the public preview	The national guidance on algorithm selection and key length.

How to use this page

Pick your market, then pick the instrument that governs you. If the instrument is one we can read, the clause is cited on the unit page. If it is named, the page says so and you should read the instrument itself. The record does not state a regime it does not cover.

Market scan recorded on 20 October 2026. Not legal advice; does not certify.