Cryptographic Key Establishment and Management
✓ LOW ✓ MODERATE ✓ HIGHRequirements NIST SOURCE
Establish and manage cryptographic keys when cryptography is employed within the system in accordance with the following key management requirements: [requirements].
Discussion (NIST Supplemental Guidance)
Cryptographic key management and establishment can be performed using manual procedures or automated mechanisms with supporting manual procedures. Organizations define key management requirements in accordance with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines and specify appropriate options, parameters, and levels. Organizations manage trust stores to ensure that only approved trust anchors are part of such trust stores. This includes certificates with visibility external to organizational systems and certificates related to the internal operations of systems. NIST CMVP and NIST CAVP provide additional information on validated cryptographic modules and algorithms that can be used in cryptographic key management and establishment.
Enhancements NIST SOURCE
SC-12(1) Availability LOW MODERATE ✓ HIGH
Maintain availability of information in the event of the loss of cryptographic keys by users.
Discussion
Escrowing of encryption keys is a common practice for ensuring availability in the event of key loss. A forgotten passphrase is an example of losing a cryptographic key.
SC-12(2) Symmetric Keys LOW MODERATE HIGH
Produce, control, and distribute symmetric cryptographic keys using [one of: NIST FIPS-validated; NSA-approved] key management technology and processes.
Discussion
SP 800-56A, SP 800-56B , and SP 800-56C provide guidance on cryptographic key establishment schemes and key derivation methods. SP 800-57-1, SP 800-57-2 , and SP 800-57-3 provide guidance on cryptographic key management.
SC-12(3) Asymmetric Keys LOW MODERATE HIGH
Produce, control, and distribute asymmetric cryptographic keys using [one of: NSA-approved key management technology and processes; prepositioned keying material; DoD-approved or DoD-issued Medium Assurance PKI certificates; DoD-approved or DoD-issued Medium Hardware Assurance PKI certificates and hardware security tokens that protect the user’s private key; certificates issued in accordance with organization-defined requirements].
Discussion
SP 800-56A, SP 800-56B , and SP 800-56C provide guidance on cryptographic key establishment schemes and key derivation methods. SP 800-57-1, SP 800-57-2 , and SP 800-57-3 provide guidance on cryptographic key management.
SC-12(4) PKI Certificates WITHDRAWN
Withdrawn. Incorporated into SC-12(3).
SC-12(5) PKI Certificates / Hardware Tokens WITHDRAWN
Withdrawn. Incorporated into SC-12(3).
SC-12(6) Physical Control of Keys LOW MODERATE HIGH
Maintain physical control of cryptographic keys when stored information is encrypted by external service providers.
Discussion
For organizations that use external service providers (e.g., cloud service or data center providers), physical control of cryptographic keys provides additional assurance that information stored by such external providers is not subject to unauthorized disclosure or modification.
Implementation Guidance
Original engineering commentary written for this explorer — not NIST source text and not authoritative guidance.
No engineering interpretation has been authored for SC-12 yet. This section is architected to receive it — see the Requirements and Assessment sections above for the authoritative NIST source content in the meantime.
Assessment
Assessment Objectives
- requirements for key generation, distribution, storage, access, and destruction are defined;
- cryptographic keys are established when cryptography is employed within the system in accordance with <SC-12_ODP requirements>;
- cryptographic keys are managed when cryptography is employed within the system in accordance with <SC-12_ODP requirements>.
Examine
[SELECT FROM: System and communications protection policy; procedures addressing cryptographic key establishment and management; system design documentation; cryptographic mechanisms; system configuration settings and associated documentation; system audit records; system security plan; other relevant documents or records].
Interview
[SELECT FROM: System/network administrators; organizational personnel with information security responsibilities; organizational personnel with responsibilities for cryptographic key establishment and/or management].
Test
[SELECT FROM: Mechanisms supporting and/or implementing cryptographic key establishment and management].
Overlays
STIGs & CCIs
No STIG checks or CCI mappings are currently loaded for SC-12. This section is architected to display, per product: STIG ID, Finding ID, Severity, Title, Description, Check, Fix, CCI, and NIST control mapping — but nothing is populated here until a real DISA STIG/CCI dataset is ingested.
Learn more about STIG/CCI integration →Evidence
Categorized from the SP 800-53A "Examine"/"Test" artifact list above by keyword — not an authoritative NIST evidence list.
Policy
- System and communications protection policy
- system security plan
Configuration
- system design documentation
- system configuration settings and associated documentation
Testing
- Mechanisms supporting and/or implementing cryptographic key establishment and management
Other Records
- procedures addressing cryptographic key establishment and management
- cryptographic mechanisms
- system audit records
- other relevant documents or records