Cryptography Encryption and Key Management (CEK)
Level N/A
Audit encryption and key management systems, policies, and processes with a frequency that is proportional to the risk exposure of the system with audit occurring preferably continuously but at least annually and after any security event(s).
Cryptography Encryption and Key Management (CEK)
Level N/A
Generate Cryptographic keys using industry accepted cryptographic libraries specifying the algorithm strength and the random number generator used.
Cryptography Encryption and Key Management (CEK)
Level N/A
Manage cryptographic secret and private keys that are provisioned for a unique purpose.
Cryptography Encryption and Key Management (CEK)
Level N/A
Rotate cryptographic keys in accordance with the calculated cryptoperiod, which includes provisions for considering the risk of information disclosure and legal and regulatory requirements.
Cryptography Encryption and Key Management (CEK)
Level N/A
Define, implement and evaluate processes, procedures and technical measures to revoke and remove cryptographic keys prior to the end of its established cryptoperiod, when a key is compromised, or an entity is no longer part of the organization, which include provisions for legal and regulatory requirements.
Cryptography Encryption and Key Management (CEK)
Level N/A
Define, implement and evaluate processes, procedures and technical measures to destroy keys stored outside a secure environment and revoke keys stored in Hardware Security Modules (HSMs) when they are no longer needed, which include provisions for legal and regulatory requirements.
Cryptography Encryption and Key Management (CEK)
Level N/A
Define, implement and evaluate processes, procedures and technical measures to create keys in a pre-activated state when they have been generated but not authorized for use, which include provisions for legal and regulatory requirements.
Cryptography Encryption and Key Management (CEK)
Level N/A
Define, implement and evaluate processes, procedures and technical measures to monitor, review and approve key transitions from any state to/from suspension, which include provisions for legal and regulatory requirements.
Cryptography Encryption and Key Management (CEK)
Level N/A
Define, implement and evaluate processes, procedures and technical measures to deactivate keys at the time of their expiration date, which include provisions for legal and regulatory requirements.
Cryptography Encryption and Key Management (CEK)
Level N/A
Define, implement and evaluate processes, procedures and technical measures to manage archived keys in a secure repository requiring least privilege access, which include provisions for legal and regulatory requirements.
