CMMC Practice SC.L2-3.13.10 – Key Management: Establish and manage cryptographic keys for cryptography employed in organizational systems.
Links to Publicly Available Resources
Discussion [NIST SP 800-171 R2]
Cryptographic key management and establishment can be performed using manual procedures or mechanisms supported by manual procedures. Organizations define key management requirements in accordance with applicable federal laws, Executive Orders, policies, directives, regulations, and standards specifying appropriate options, levels, and parameters.
NIST SP 800-56A and NIST SP 800-57-1 provide guidance on cryptographic key management and key establishment.
Develop processes and technical mechanisms to protect the cryptographic keys’ confidentiality, authenticity, and authorized use in accordance with industry standards and regulations. Key management systems provide oversight, assurance, and the capability to demonstrate the cryptographic keys are created in a secure manner and protected from loss or misuse throughout their lifecycle (e.g., active, expired, revoked). For a small number of keys, this can be accomplished with manual procedures and mechanisms. As the number of keys and cryptographic units increase, automation and tool support will be required.
The first intent of this practice is to ensure cryptographic keys are properly created in a secure manner that prevents them from being reproduced by an adversary. The second intent of this practice is to ensure cryptographic keys are managed in a secure manner that prevents them from being stolen by an adversary.
Key establishment involves the creation of keys and coordination among parties that will use the keys of the methodology for generating the final keying material. This is discussed in detail in SP 800-56A, B, and C.
Key management involves protecting keys when they are distributed, when they are stored, when they are being used, and when they are being recovered.
Key establishment best practices are identified in NIST SP 800-56A, B, and C. Key management best practices are identified in NIST SP 800-57 Parts 1, 2, and 3.
This practice, SC.L2-3.13.10, complements AC.L2-3.1.19 by specifying that any cryptographic keys in use must be protected.