Use of encryption and ISO 27001

Answer:

According to ISO 27001, you only have to implement any kind of encryption, as well as other types of controls, in the following situations:
- There are unacceptable risks that justify the application of the control (i.e., based on the risk assessment results)
- There are legal requirements (e.g., laws or contract clauses) to which the organization must comply with, that demands the application of the control
- There is a management decision to implement the control, by considering it as good practice.

If none of the above conditions happen, there is no need to implement a control.

This article will provide you further explanation about selecting controls:
- The basic logic of ISO 27001: How does information security work? https://advisera.com/27001academy/knowledgebase/the-basic-logic-of-iso-27001-how-does-information-security-work/