CCI-005156

Cryptographic keys that protect access tokens are generated, managed, and protected from disclosure and misuse.

Implementation Guidance

​Determine if:- cryptographic keys that protect access tokens are generated;- cryptographic keys that protect access tokens are managed;- cryptographic keys that protect access tokens are managed; and- cryptographic keys that protect access tokens are managed.

Validation Procedures

Examine: [SELECT FROM: Identification and authentication policy; procedures addressing cryptographic key establishment and management; system design documentation; cryptographic mechanisms; system configuration settings and associated documentation; system security plan; other relevant documents or records]. Interview: [SELECT FROM: System/network administrators; organizational personnel with information security responsibilities; organizational personnel with responsibilities for cryptographic key establishment and/or management]. Test: [SELECT FROM: Organizational processes for cryptographic key management; cryptographic modules generating, storing, and using cryptographic keys].

The controls below (if any) were marked by NIST as being related to CCI-005156.