CEK-12 Key Rotation
Rotate keys on the cryptoperiod calculated for them, accounting for the risk of information disclosure and any legal or regulatory requirement.
4
artefacts
1
held by a system
0
at each review
moderate
to go live
Key management / PKI
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Rotation records showing keys rotated on schedule · Key management / PKI
periodic reviewEvidence produced at each review
none for this control
governing documentDocuments that govern the control
- The cryptoperiod calculated per key type and the reasoning behind it · Policy repository / GRC workspace
- Alerting or automation that triggers rotation · Policy repository / GRC workspace
- Legal or regulatory requirements that constrain the cryptoperiod · Policy repository / GRC workspace
First move
Start with the 1 of 4 artefacts that already live in a system (Key management / PKI); keep the periodic reviews but log each one as a dated record with a named reviewer.
Common gaps auditors find
- Rotation schedule defined but manual and routinely missed
- Cryptoperiod set to a round number with no analysis
- Keys embedded in systems that cannot rotate without an outage, so they never do
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet