SC-12 Cryptographic key establishment and management
Requires cryptographic keys to be established and managed in line with organization-defined key management requirements wherever cryptography is used in the system, covering generation, distribution, storage, access, rot
4
artefacts
0
held by a system
2
at each review
hard
to go live
Policy repository / GRC workspace
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Evidence of protected key generation and storage, such as a key management service or hardware module · Key management / PKI
- Key rotation and destruction records · Key management / PKI
governing documentDocuments that govern the control
- Documented key management requirements covering the full key life cycle · Policy repository / GRC workspace
- Key inventory identifying keys, owners, purposes and expiry · Policy repository / GRC workspace
First move
This control is evidenced by people and documents, not systems. Put the document under version control with an owner and review date, and log each review as a record with reviewer and date. Do not try to automate it.
Common gaps auditors find
- Keys and secrets embedded in code or configuration files
- Rotation defined but never performed because usage is undocumented
- No destruction step, so retired keys remain available in backups
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetSC-11 Trusted Path. Provide a [organization-defined] isolated trusted communications path for communications between the user and the trusted components of the system; and Permit users to invoke the trusted communications path for communications between the · SC-13 Cryptographic protection