[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-800-53\u002Fsc-12":3},{"item":4,"lessons":18,"controls":68,"related":97},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"nist-800-53","sc-12","SC-12","Cryptographic Key Establishment and Management",17,"US National Institute of Standards and Technology (NIST)","**What it asks for.** Cryptographic keys must be established and managed according to defined requirements for key generation, distribution, storage, access and destruction.\n\n**In practice.** Doing this well means a key management standard, central key management services or hardware security modules for sensitive keys, defined key lifetimes and rotation, separation of duties for key custodians and procedures for compromise. Auditors expect the standard, key inventories, rotation records and access controls on key stores. ISO\u002FIEC 27001 cryptographic key management sets similar expectations.\n\n**Common gaps.** Keys and secrets are often stored alongside the data they protect or embedded in code. Many organisations cannot list all their keys and certificates. Key custodians may also leave without a handover. Rotation is also frequently postponed indefinitely because nobody knows what would break.","Establish and manage cryptographic keys when cryptography is employed within the system in accordance with the following key management requirements: [Assignment: organization-defined requirements].\nDiscussion: Cryptographic key management and establishment can be performed using manual procedures or automated mechanisms with supporting manual procedures. Organizations define key management requirements in accordance with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines and specify appropriate options, parameters, and levels. Organizations manage trust stores to ensure that only approved trust anchors are part of such trust stores. This includes certificates with visibility external to organizational systems and certificates related to the internal operations of systems. [NIST CMVP](#1acdc775-aafb-4d11-9341-dc6a822e9d38) and [NIST CAVP](#84dc1b0c-acb7-4269-84c4-00dbabacd78c) provide additional information on validated cryptographic modules and algorithms that can be used in cryptographic key management and establishment.","From NIST SP 800-53 Rev. 5, a work of the US government in the public domain.","https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Fsp\u002F800\u002F53\u002Fr5\u002Fupd1\u002Ffinal","Open SP 800-53 at NIST",null,"2026-10-18T15:18:43.663+00:00",{"total":9,"list":19},[20,24,28,32,36,40,44,48,52,56,60,64],{"slug":21,"title":22,"published_at":23},"gobalance-key-exposure-flaw-enables-onion-address-hijacking","GoBalance Key Exposure Flaw Enables .onion Address Hijacking","2026-10-09T10:20:58.801+00:00",{"slug":25,"title":26,"published_at":27},"slim-spider-targets-brazilian-fintechs-to-steal-cloud-credentials-and-crypto-secrets","Slim Spider Targets Brazilian Fintechs to Steal Cloud Credentials and Crypto Secrets","2026-09-08T18:22:01.558+00:00",{"slug":29,"title":30,"published_at":31},"critical-ebyte-na111-m-firmware-flaws-enable-full-device-compromise","Critical Ebyte NA111-M Firmware Flaws Enable Full Device Compromise","2026-08-27T18:22:44.28+00:00",{"slug":33,"title":34,"published_at":35},"encryption-key-exposed-in-api-leads-to-startup-platform-data-breach","Encryption Key Exposed in API Leads to Startup Platform Data Breach","2026-08-24T16:21:17.656+00:00",{"slug":37,"title":38,"published_at":39},"n-able-passportal-flaw-exposes-password-vault-master-keys","N-able Passportal Flaw Exposes Password Vault Master Keys","2026-08-20T18:20:40.6+00:00",{"slug":41,"title":42,"published_at":43},"mozillas-signing-key-accidentally-committed-to-code-repo","Mozilla's Signing Key Accidentally Committed to Code Repo","2026-08-11T14:22:57.948+00:00",{"slug":45,"title":46,"published_at":47},"mozilla-gpg-key-exposed-in-private-github-repo-supply-chain-near-miss","Mozilla GPG Key Exposed in Private GitHub Repo — Supply Chain Near-Miss","2026-08-11T08:20:39.58+00:00",{"slug":49,"title":50,"published_at":51},"accenture-breach-exposes-ssh-keys-rsa-keys-azure-credentials","Accenture Breach Exposes SSH Keys, RSA Keys & Azure Credentials","2026-07-08T00:20:23.122+00:00",{"slug":53,"title":54,"published_at":55},"post-quantum-cryptography-mandates-force-cisos-to-act-now","Post-Quantum Cryptography Mandates Force CISOs to Act Now","2026-06-29T10:20:52.917+00:00",{"slug":57,"title":58,"published_at":59},"federal-post-quantum-encryption-mandate-accelerates-cryptographic-modernization","Federal Post-Quantum Encryption Mandate Accelerates Cryptographic Modernization","2026-06-22T22:21:28.924+00:00",{"slug":61,"title":62,"published_at":63},"malicious-browser-extensions-bypass-app-store-security-controls","Malicious Browser Extensions Bypass App Store Security Controls","2026-06-13T02:20:16.954+00:00",{"slug":65,"title":66,"published_at":67},"covert-military-key-distribution-via-gps-satellites-exposes-sensitive-operations","Covert Military Key Distribution via GPS Satellites Exposes Sensitive Operations","2026-06-09T17:21:17.469+00:00",[69,74,79,84,89,93],{"slug":70,"name":71,"problem":72,"stories":73},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",9,{"slug":75,"name":76,"problem":77,"stories":78},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",7,{"slug":80,"name":81,"problem":82,"stories":83},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",6,{"slug":85,"name":86,"problem":87,"stories":88},"patch-management","Automated patch management","Known holes get closed in days, not months.",3,{"slug":90,"name":91,"problem":92,"stories":88},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":94,"name":95,"problem":96,"stories":88},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[98,104,110,114,119,123,127,132],{"family":99,"item":100,"code":101,"title":102,"together":103},"gdpr","32","Article 32","Security of processing",11,{"family":105,"item":106,"code":107,"title":108,"together":109},"cis","4","Control 4","Secure Configuration of Enterprise Assets and Software",8,{"family":105,"item":111,"code":112,"title":113,"together":109},"3","Control 3","Data Protection",{"family":105,"item":115,"code":116,"title":117,"together":118},"16","Control 16","Application Software Security",5,{"family":120,"item":121,"code":122,"title":122,"together":118},"itil","overview","ITIL",{"family":105,"item":124,"code":125,"title":126,"together":118},"7","Control 7","Continuous Vulnerability Management",{"family":105,"item":128,"code":129,"title":130,"together":131},"2","Control 2","Inventory and Control of Software Assets",4,{"family":133,"item":134,"code":135,"title":136,"together":131},"nist-sp","800-57","SP 800-57","SP 800-57: Recommendation for Key Management"]