What it covers. A multi-part NIST recommendation on managing cryptographic keys. Part 1 gives general guidance on key types, cryptoperiods, key states and algorithm strengths; Part 2 covers best practices for key management organisations; Part 3 gives application-specific guidance for protocols and systems.
In practice. Applying it well means maintaining an inventory of keys and certificates, defining cryptoperiods and protection for each key type, and managing generation, distribution, storage, rotation, revocation and destruction under documented procedures. High-value keys are protected in hardware security modules or equivalent, with separation of duties. Evidence includes a key management policy, key inventories, rotation records and access controls on key material.
Common gaps. Typical gaps are unknown keys and certificates spread across systems, keys that are never rotated, and no plan to replace algorithms that become weak.