Navigate

SC-12

SC-12: Cryptographic Key Establishment And Management

The organization establishes and manages cryptographic keys for required cryptography employed within the information system in accordance with [Assignment: organization-defined requirements for key generation, distribution, storage, access, and destruction].

Supplemental

Cryptographic key management and establishment can be performed using manual procedures or automated mechanisms with supporting manual procedures. Organizations define key management requirements in accordance with applicable federal laws, Executive Orders, directives, regulations, policies, standards, and guidance, specifying appropriate options, levels, and parameters. Organizations manage trust stores to ensure that only approved trust anchors are in such trust stores. This includes certificates with visibility external to organizational information systems and certificates related to the internal operations of systems.

CIA Levels
Confidentiality	low
Integrity	low
Availability	unknown

Overlays
Privacy (High), Privacy (Low), Privacy (Mod), Privacy (PHI)

Related Controls

The controls below (if any) were marked by NIST as being related to SC-12.

Control	Description
SC-13	The information system implements [Assignment: organization-defined cryptographic uses and type of cryptography required for each use] in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.
SC-17	The organization issues public key certificates under an [Assignment: organization-defined certificate policy] or obtains public key certificates from an approved service provider.

Enhancements

The controls below (if any) add on to the requirements of SC-12.

Control	Description
SC-12 (1)	The organization maintains availability of information in the event of the loss of cryptographic keys by users.
SC-12 (2)	The organization produces, controls, and distributes symmetric cryptographic keys using [Selection: NIST FIPS-compliant; NSA-approved] key management technology and processes.
SC-12 (3)	The organization produces, controls, and distributes asymmetric cryptographic keys using [Selection: NSA-approved key management technology and processes; approved PKI Class 3 certificates or prepositioned keying material; approved PKI Class 3 or Class 4 certificates and hardware security tokens that protect the user�s private key].
SC-12 (4)	[Withdrawn: Incorporated into SC-12].
SC-12 (5)	[Withdrawn: Incorporated into SC-12].

Related CCIs

The CCIs below are tied to SC-12.

CCI	Definition
CCI-002428	The organization defines the requirements for cryptographic key generation to be employed within the information system.
CCI-002429	The organization defines the requirements for cryptographic key distribution to be employed within the information system.
CCI-002430	The organization defines the requirements for cryptographic key storage to be employed within the information system.
CCI-002431	The organization defines the requirements for cryptographic key access to be employed within the information system.
CCI-002432	The organization defines the requirements for cryptographic key destruction to be employed within the information system.
CCI-002433	The organization establishes cryptographic keys for required cryptography employed within the information system in accordance with organization-defined requirements for key generation.
CCI-002434	The organization establishes cryptographic keys for required cryptography employed within the information system in accordance with organization-defined requirements for key distribution.
CCI-002435	The organization establishes cryptographic keys for required cryptography employed within the information system in accordance with organization-defined requirements for key storage.
CCI-002436	The organization establishes cryptographic keys for required cryptography employed within the information system in accordance with organization-defined requirements for key access.
CCI-002437	The organization establishes cryptographic keys for required cryptography employed within the information system in accordance with organization-defined requirements for key destruction.
CCI-002438	The organization manages cryptographic keys for required cryptography employed within the information system in accordance with organization-defined requirements for key generation.
CCI-002439	The organization manages cryptographic keys for required cryptography employed within the information system in accordance with organization-defined requirements for key distribution.
CCI-002440	The organization manages cryptographic keys for required cryptography employed within the information system in accordance with organization-defined requirements for key storage.
CCI-002441	The organization manages cryptographic keys for required cryptography employed within the information system in accordance with organization-defined requirements for key access.
CCI-002442	The organization manages cryptographic keys for required cryptography employed within the information system in accordance with organization-defined requirements for key destruction.