1. Home
  2. FedRAMP
  3. SC-12

BRACKETOLOGY | FEDRAMP

SC-12: CRYPTOGRAPHIC KEY ESTABLISHMENT AND MANAGEMENT

  • FedRAMP Baseline Membership SC-12:
  • LOW
  • MODERATE
  • HIGH

FedRAMP Bracketology

Use the FedRAMP Control Membership information above to determine if a control or control enhancement is required for each Impact Baseline — LOW, MODERATE, or HIGH

Click on the panel below each control or control enhancement to review the FedRAMP Impact Baseline-specific control configuration requirements for each of the [BRACKETS] in each control and/or control enhancement.

Review and use Additional Requirements and Guidance to build FedRAMP-compliant controls for your risk-based cybersecurity program.

To change the baseline view in the panel, click on LOW, MODERATE, or HIGH when the panel is open

Panels only appear where there are [BRACKETS] in the control or enhancement or where there is FedRAMP-specific requirements or guidance available.

The organization establishes and manages cryptographic keys for required cryptography employed within the information system in accordance with [Assignment: organization-defined requirements for key generation, distribution, storage, access, and destruction].

Click Low | Moderate | High below to see FedRAMP control configuration information. It's in BOLD.

FedRAMP GUIDANCE:

Federally approved and validated cryptography.

FedRAMP GUIDANCE:

Federally approved and validated cryptography.

FedRAMP GUIDANCE:

Federally approved and validated cryptography.

SUPPLEMENTAL GUIDANCE

Cryptographic key management and establishment can be performed using manual procedures or automated mechanisms with supporting manual procedures. Organizations define key management requirements in accordance with applicable federal laws, Executive Orders, directives, regulations, policies, standards, and guidance, specifying appropriate options, levels, and parameters. Organizations manage trust stores to ensure that only approved trust anchors are in such trust stores. This includes certificates with visibility external to organizational information systems and certificates related to the internal operations of systems.

CONTROL ENHANCEMENTS

SC-12 (1) CRYPTOGRAPHIC KEY ESTABLISHMENT AND MANAGEMENT | AVAILABILITY
  • FedRAMP Baseline Membership SC-12 (1):
  • HIGH

The organization maintains availability of information in the event of the loss of cryptographic keys by users.

Supplemental Guidance:

Escrowing of encryption keys is a common practice for ensuring availability in the event of loss of keys (e.g., due to forgotten passphrase).

SC-12 (2) CRYPTOGRAPHIC KEY ESTABLISHMENT AND MANAGEMENT | SYMMETRIC KEYS
  • FedRAMP Baseline Membership SC-12 (2):
  • MODERATE
  • HIGH

The organization produces, controls, and distributes symmetric cryptographic keys using [Selection: NIST FIPS-compliant; NSA-approved] key management technology and processes.

Click Low | Moderate | High below to see FedRAMP control configuration information. It's in BOLD.

There are no FedRAMP-specific requirements if this control is used for a LOW Impact system.

The organization produces, controls, and distributes symmetric cryptographic keys using NIST FIPS-compliant key management technology and processes.

The organization produces, controls, and distributes symmetric cryptographic keys using NIST FIPS-compliant key management technology and processes.

Supplemental Guidance: NONE

SC-12 (3) CRYPTOGRAPHIC KEY ESTABLISHMENT AND MANAGEMENT | ASYMMETRIC KEYS
  • FedRAMP Baseline Membership SC-12 (3):
  • MODERATE
  • HIGH

The organization produces, controls, and distributes asymmetric cryptographic keys using [Selection: NSA-approved key management technology and processes; approved PKI Class 3 certificates or prepositioned keying material; approved PKI Class 3 or Class 4 certificates and hardware security tokens that protect the user's private key].

Click Low | Moderate | High below to see FedRAMP control configuration information. It's in BOLD.

There are no FedRAMP-specific requirements if this control is used for a LOW Impact system.

There are no FedRAMP-specific requirements if this control is used for a MODERATE Impact system.

There are no FedRAMP-specific requirements if this control is used for a HIGH Impact system.


Supplemental Guidance: NONE

SC-12 (4) CRYPTOGRAPHIC KEY ESTABLISHMENT AND MANAGEMENT | PKI CERTIFICATES

[Withdrawn: Incorporated into SC-12]. (See above.)

SC-12 (5) CRYPTOGRAPHIC KEY ESTABLISHMENT AND MANAGEMENT | PKI CERTIFICATES / HARDWARE TOKENS

[Withdrawn: Incorporated into SC-12]. (See above.)

REFERENCES:

  • NIST Special Publication 800-56
  • NIST Special Publication 800-57