CEK-21 Key Inventory Management
Have the key management system track every item of cryptographic material and report each change in its status.
4
artefacts
1
held by a system
0
at each review
moderate
to go live
Policy repository / GRC workspace
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Status change reporting output · Policy repository / GRC workspace
periodic reviewEvidence produced at each review
none for this control
governing documentDocuments that govern the control
- The key inventory produced by the key management system · Policy repository / GRC workspace
- Coverage evidence showing all key stores feed the inventory · Policy repository / GRC workspace
- Reconciliation between the inventory and keys actually present in systems · Policy repository / GRC workspace
First move
Start with the 1 of 4 artefacts that already live in a system (Policy repository / GRC workspace); keep the periodic reviews but log each one as a dated record with a named reviewer.
Common gaps auditors find
- Inventory covers the central key store while application-held keys are invisible
- Status changes not reported, only current state shown
- Inventory maintained by hand in a spreadsheet and out of date
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetCEK-20 Key Recovery · DCS-01 Off-Site Equipment Disposal Policy and Procedures