CCI-002444

Control symmetric cryptographic keys using NIST FIPS-validated or NSA-approved key management technology and processes.

Implementation Guidance

The organization being inspected/assessed documents and implements a process to control symmetric cryptographic keys using NIST FIPS-compliant or NSA-approved key management technology and processes. An example process would be implementation of Key Management Infrastructure (KMI). DoD requires a minimum of NIST approved cryptography for unclassified systems. Classified systems require NSA approved cryptography.

Validation Procedures

The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed controls appropriate symmetric cryptographic keys using NIST FIPS-compliant or NSA-approved key management technology and processes.

Compelling Evidence

1.) Signed and dated System Security Plan (SSP).

The controls below (if any) were marked by NIST as being related to CCI-002444.