[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-sp\u002F800-57":3},{"item":4,"lessons":16,"controls":66,"related":96},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"nist-sp","800-57","SP 800-57","SP 800-57: Recommendation for Key Management",34,"US National Institute of Standards and Technology (NIST)","**What it covers.** A multi-part NIST recommendation on managing cryptographic keys. Part 1 gives general guidance on key types, cryptoperiods, key states and algorithm strengths; Part 2 covers best practices for key management organisations; Part 3 gives application-specific guidance for protocols and systems.\n\n**In practice.** Applying it well means maintaining an inventory of keys and certificates, defining cryptoperiods and protection for each key type, and managing generation, distribution, storage, rotation, revocation and destruction under documented procedures. High-value keys are protected in hardware security modules or equivalent, with separation of duties. Evidence includes a key management policy, key inventories, rotation records and access controls on key material.\n\n**Common gaps.** Typical gaps are unknown keys and certificates spread across systems, keys that are never rotated, and no plan to replace algorithms that become weak.",null,"https:\u002F\u002Fcsrc.nist.gov\u002Fpublications\u002Fsp800","Find it among NIST SP 800 publications","2026-10-18T15:18:43.663+00:00",{"total":9,"list":17},[18,22,26,30,34,38,42,46,50,54,58,62],{"slug":19,"title":20,"published_at":21},"cctld-hijacks-expose-dns-and-certificate-authority-weaknesses","ccTLD Hijacks Expose DNS and Certificate Authority Weaknesses","2026-10-09T12:20:22.268+00:00",{"slug":23,"title":24,"published_at":25},"gobalance-key-exposure-flaw-enables-onion-address-hijacking","GoBalance Key Exposure Flaw Enables .onion Address Hijacking","2026-10-09T10:20:58.801+00:00",{"slug":27,"title":28,"published_at":29},"organizations-must-begin-testing-post-quantum-certificate-ecosystems-now","Organizations Must Begin Testing Post-Quantum Certificate Ecosystems Now","2026-10-08T22:21:07.63+00:00",{"slug":31,"title":32,"published_at":33},"enterprises-unprepared-for-ai-and-quantum-cyber-threats","Enterprises Unprepared for AI and Quantum Cyber Threats","2026-10-01T16:21:09.7+00:00",{"slug":35,"title":36,"published_at":37},"500000-active-credentials-exposed-in-public-github-repos","500,000 Active Credentials Exposed in Public GitHub Repos","2026-10-01T10:20:32.463+00:00",{"slug":39,"title":40,"published_at":41},"543000-valid-credentials-exposed-in-public-github-repos-for-over-2-years","543,000+ Valid Credentials Exposed in Public GitHub Repos for Over 2 Years","2026-09-30T20:21:00.802+00:00",{"slug":43,"title":44,"published_at":45},"hard-coded-cryptographic-keys-expose-wrtsil-marine-software-to-remote-code-execution","Hard-Coded Cryptographic Keys Expose Wärtsilä Marine Software to Remote Code Execution","2026-09-15T17:21:26.741+00:00",{"slug":47,"title":48,"published_at":49},"encryption-key-exposed-in-api-leads-to-startup-platform-data-breach","Encryption Key Exposed in API Leads to Startup Platform Data Breach","2026-08-24T16:21:17.656+00:00",{"slug":51,"title":52,"published_at":53},"spectre-side-channel-attack-leaks-secrets-from-cloudflare-workers-via-shared-process-isolation-weakn","Spectre Side-Channel Attack Leaks Secrets from Cloudflare Workers via Shared Process Isolation Weaknesses","2026-08-19T20:20:19.86+00:00",{"slug":55,"title":56,"published_at":57},"ad-certificate-services-flaw-enables-full-domain-compromise-via-privilege-escalation","AD Certificate Services Flaw Enables Full Domain Compromise via Privilege Escalation","2026-08-17T16:20:24.698+00:00",{"slug":59,"title":60,"published_at":61},"google-clouds-2029-post-quantum-cryptography-deadline-signals-urgent-crypto-migration-need","Google Cloud's 2029 Post-Quantum Cryptography Deadline Signals Urgent Crypto Migration Need","2026-08-14T12:21:14.711+00:00",{"slug":63,"title":64,"published_at":65},"mozillas-signing-key-accidentally-committed-to-code-repo","Mozilla's Signing Key Accidentally Committed to Code Repo","2026-08-11T14:22:57.948+00:00",[67,72,77,82,87,91],{"slug":68,"name":69,"problem":70,"stories":71},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",17,{"slug":73,"name":74,"problem":75,"stories":76},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",9,{"slug":78,"name":79,"problem":80,"stories":81},"patch-management","Automated patch management","Known holes get closed in days, not months.",7,{"slug":83,"name":84,"problem":85,"stories":86},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",6,{"slug":88,"name":89,"problem":90,"stories":86},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",{"slug":92,"name":93,"problem":94,"stories":95},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",5,[97,103,109,114,119,124,128,133],{"family":98,"item":99,"code":100,"title":101,"together":102},"cis","3","Control 3","Data Protection",21,{"family":104,"item":105,"code":106,"title":107,"together":108},"gdpr","32","Article 32","Security of processing",20,{"family":98,"item":110,"code":111,"title":112,"together":113},"4","Control 4","Secure Configuration of Enterprise Assets and Software",12,{"family":115,"item":116,"code":117,"title":117,"together":118},"itil","overview","ITIL",11,{"family":98,"item":120,"code":121,"title":122,"together":123},"7","Control 7","Continuous Vulnerability Management",10,{"family":98,"item":125,"code":126,"title":127,"together":123},"16","Control 16","Application Software Security",{"family":129,"item":130,"code":131,"title":132,"together":123},"nist-csf","pr-ds","PR.DS-1","Data Security",{"family":5,"item":134,"code":135,"title":136,"together":123},"800-208","SP 800-208","SP 800-208: Recommendation for Stateful Hash-Based Signature Schemes"]