💼 SC-12 Cryptographic Key Establishment and Management (L)(M)(H)

• Contextual name: 💼 SC-12 Cryptographic Key Establishment and Management (L)(M)(H)
• ID: /frameworks/fedramp-high-security-controls/sc/12
• Located in: 💼 System and Communications Protection

Description

Establish and manage cryptographic keys when cryptography is employed within the system in accordance with the following key management requirements: [FedRAMP Assignment: In accordance with Federal requirements].

SC-12 Additional FedRAMP Requirements and Guidance:

Guidance: See references in NIST 800-53 documentation.

Guidance: Must meet applicable Federal Cryptographic Requirements. See References Section of control.

Guidance: Wildcard certificates may be used internally within the system, but are not permitted for external customer access to the system.

Similar

• Sections
  • /frameworks/nist-sp-800-53-r5/sc/12
• Internal
  • ID: dec-c-c577f67c

Similar Sections (Take Policies From)

Section	Sub Sections	Internal Rules	Policies	Flags
💼 NIST SP 800-53 Revision 5 → 💼 SC-12 Cryptographic Key Establishment and Management	6	1	3

Similar Sections (Give Policies To)

Section	Sub Sections	Internal Rules	Policies	Flags
💼 FedRAMP Low Security Controls → 💼 SC-12 Cryptographic Key Establishment and Management (L)(M)(H)			11
💼 FedRAMP Moderate Security Controls → 💼 SC-12 Cryptographic Key Establishment and Management (L)(M)(H)			11

Sub Sections

Section	Sub Sections	Internal Rules	Policies	Flags
💼 SC-12(1) Availability (H)

Policies (11)

Policy	Logic Count	Flags
📝 AWS IAM User Access Keys are not rotated every 90 days or less 🟢	1	🟢 x6
📝 AWS IAM User has more than one active access key 🟢	1	🟢 x6
📝 AWS IAM User with console and programmatic access set during the initial creation 🟢		🟢 x3
📝 AWS KMS Symmetric CMK Rotation is not enabled 🟢	1	🟢 x6
📝 Azure Key Vault Soft Delete and Purge Protection functions are not enabled 🟢	1	🟢 x6
📝 Azure Non-RBAC Key Vault stores Keys without expiration date 🟢	1	🟢 x6
📝 Azure Non-RBAC Key Vault stores Secrets without expiration date 🟢	1	🟢 x6
📝 Azure RBAC Key Vault stores Keys without expiration date 🟢	1	🟢 x6
📝 Azure RBAC Key Vault stores Secrets without expiration date 🟢	1	🟢 x6
📝 Azure SQL Server Transparent Data Encryption Protector is not encrypted with Customer-managed key 🟢	1	🟢 x6
📝 Azure Storage Account With Critical Data is not encrypted with customer managed key 🟢		🟢 x3

Internal Rules

Rule	Policies	Flags
✉️ dec-x-0be4dfe5	1
✉️ dec-x-0feec790	2
✉️ dec-x-4d6fee7a	1
✉️ dec-x-82ca4127	2
✉️ dec-x-230b5e35	1
✉️ dec-x-30795016	1
✉️ dec-x-aef11ebd	1
✉️ dec-x-b10e98af	1
✉️ dec-x-bcb0c78f	1