Skip to main content

💼 SC-12 Cryptographic Key Establishment and Management (L)(M)(H)

  • Contextual name: 💼 SC-12 Cryptographic Key Establishment and Management (L)(M)(H)
  • ID: /frameworks/fedramp-low-security-controls/sc/12
  • Located in: 💼 System and Communications Protection

Description​

Establish and manage cryptographic keys when cryptography is employed within the system in accordance with the following key management requirements: [FedRAMP Assignment: In accordance with Federal requirements].

SC-12 Additional FedRAMP Requirements and Guidance:

Guidance: See references in NIST 800-53 documentation.

Guidance: Must meet applicable Federal Cryptographic Requirements. See References Section of control.

Guidance: Wildcard certificates may be used internally within the system, but are not permitted for external customer access to the system.

Similar​

  • Sections
    • /frameworks/nist-sp-800-53-r5/sc/12
    • /frameworks/fedramp-high-security-controls/sc/12
  • Internal
    • ID: dec-c-c577f67c

Similar Sections (Take Policies From)​

SectionSub SectionsInternal RulesPoliciesFlags
💼 FedRAMP High Security Controls → 💼 SC-12 Cryptographic Key Establishment and Management (L)(M)(H)1911
💼 NIST SP 800-53 Revision 5 → 💼 SC-12 Cryptographic Key Establishment and Management617

Sub Sections​

SectionSub SectionsInternal RulesPoliciesFlags

Policies (11)​

PolicyLogic CountFlags
📝 AWS IAM User Access Keys are not rotated every 90 days or less 🟢1🟢 x6
📝 AWS IAM User has more than one active access key 🟢1🟢 x6
📝 AWS IAM User with console and programmatic access set during the initial creation 🟢🟢 x3
📝 AWS KMS Symmetric CMK Rotation is not enabled 🟢1🟢 x6
📝 Azure Key Vault Soft Delete and Purge Protection functions are not enabled 🟢1🟢 x6
📝 Azure Non-RBAC Key Vault stores Keys without expiration date 🟢1🟢 x6
📝 Azure Non-RBAC Key Vault stores Secrets without expiration date 🟢1🟢 x6
📝 Azure RBAC Key Vault stores Keys without expiration date 🟢1🟢 x6
📝 Azure RBAC Key Vault stores Secrets without expiration date 🟢1🟢 x6
📝 Azure SQL Server Transparent Data Encryption Protector is not encrypted with Customer-managed key 🟢1🟢 x6
📝 Azure Storage Account With Critical Data is not encrypted with customer managed key 🟢🟢 x3