Title

Establish a mechanism or put a procedure in place for key and/or data recovery to prevent loss of data if the user losses the encryption key. (Cat III impact)

Discussion

Without a mechanism for key recovery, any data that was encrypted with the key could be lost.

Check Content

Interview the IAO to verify data loss prevention procedures for encrypted data on remote access devices. These procedures may be as simple as a requirement for users to backup or an automated backup to an unencrypted folder on the network. Alternative but more expensive methods are third party key storage and multiple key access. If procedures do not exist for key or data recovery, this is a finding.

Fix Text

Develop a recovery plan for key recovery or data recovery in the event of a lost key.

Additional Identifiers

Rule ID: SV-6818r1_rule

Vulnerability ID: V-6670

Group Title:

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.