BCN-T2-DAT-001Tier 2 · RegulatoryData Protection

Encryption Below Regulatory Standard

Data is encrypted, but with algorithms, key lengths, or key management that fail the applicable requirement.

Remediation SLA: 30 days
Tier: 2 · Regulatory
Domain: Data
Escalation: Security manager review at 14 days

What this finding is

Encryption is present but does not meet the mandated standard: deprecated algorithms or protocol versions (TLS 1.0/1.1, 3DES, RSA-1024), keys below the required length, keys stored alongside the data they protect, or the absence of a documented key-management lifecycle covering generation, rotation, and destruction.

Why it is Tier 2

Assessors test cipher configuration directly and key management is a substantial control area in its own right — PCI DSS devotes a full requirement section to it. Deficiencies here are reliably cited. It is Tier 2 rather than Tier 1 because data is protected against casual exposure; the gap is that the protection does not meet the standard you are contractually or legally held to, and in most cases does not qualify for breach-notification safe harbour.

Most common misclassification

Conflated with BCN-T1-DAT-003. Absent encryption on a reachable store is Tier 1; encryption that is present but non-conforming is Tier 2.

How to detect it

1Scan TLS endpoints for protocol versions, cipher suites, and certificate key sizes, covering internal endpoints as well as external.
2Review at-rest encryption algorithms and key lengths against the applicable requirement.
3Determine where key material is stored — keys held in the same system, account, or backup as the data provide substantially less assurance than the configuration implies.
4Ask for the key-management procedure and rotation records; absence of documentation is itself the deficiency for several frameworks.

How to remediate it

Steps are ordered. The first step is the one that reduces exposure fastest, which is not always the one that closes the finding.

1Disable deprecated protocols and cipher suites at the edge, then work inward to internal services.
2Move key material into a managed KMS or HSM with access control independent of the data plane.
3Establish and document the key lifecycle — generation, rotation, escrow, destruction — with defined custodians and split knowledge where required.
4Re-encrypt data held under deprecated algorithms rather than only changing the setting for new writes.
5Retain scan output and rotation records as evidence.

How to verify the fix

An external and internal TLS scan reports only approved protocol versions and ciphers, at-rest configuration meets the required algorithm and key length, and a rotation record exists for the current period.