Does ISO/IEC 27001 require ISO/IEC 11770-8?

Not by name. The 2022 cryptography control requires a policy and a key management approach, and it does not cite this part. A contract, a regulator, a scheme or your own ISMS can make the part binding. Treat it as a named route to evidence, not a certification requirement.

What the 2022 control asks for

The cryptography control in Annex A asks for a policy on the use of cryptography, including a key management approach. It does not prescribe a particular algorithm or a particular standard. An auditor will ask how you chose, how you recorded the choice and how you know the keys are still protected.

Where the new part fits

Part 8 gives a named route for one case: a key derived from a human-memorised password. If that is your case, citing it is a clear way to answer the algorithm question. If it is not your case, citing it adds nothing and may confuse the scope.

What makes it binding

A standard is voluntary until something else adopts it. A customer contract can name it. A regulator can point at it. A scheme can require it. Your own ISMS can adopt it as the method for password-based derivation. The site cannot tell you which of those applies; it can tell you what the document says.

How to record the answer

Write one line in the standards register: the part, its status, the date read, and the decision (adopted, not adopted with reason, or watch). Link the parameter record to it. That line is what turns a voluntary standard into an auditable decision, without overclaiming that 27001 requires it.

The short answer, with its limit

No clause of ISO/IEC 27001:2022 names this part. The cryptography control requires a policy and a key management approach, so the part can be the named method for password-derived keys if you adopt it. Adoption is a decision, not an obligation created by 27001.

Where the public record is silent, this page says so and does not fill the gap. The register carries the clause-level detail.

All answers Check your scope →