ComplianceNIST 800-53 control

NIST-SC-12 Cryptographic Key Establishment and Management

Official page ↗
Framework
NIST SP 800-53 rev5 (5.2.0)
Family
SC System and Communications Protection
Control
SC-12
ATT&CK techniques mitigated
11

Control statement

Establish and manage cryptographic keys when cryptography is employed within the system in accordance with the following key management requirements: [Assignment: requirements].

Discussion

Cryptographic key management and establishment can be performed using manual procedures or automated mechanisms with supporting manual procedures. Organizations define key management requirements in accordance with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines and specify appropriate options, parameters, and levels. Organizations manage trust stores to ensure that only approved trust anchors are part of such trust stores. This includes certificates with visibility external to organizational systems and certificates related to the internal operations of systems. [NIST CMVP](#1acdc775-aafb-4d11-9341-dc6a822e9d38) and [NIST CAVP](#84dc1b0c-acb7-4269-84c4-00dbabacd78c) provide additional information on validated cryptographic modules and algorithms that can be used in cryptographic key management and establishment.

ATT&CK mappings (CTID)

• T1072 Software Deployment Tools • T1098.004 SSH Authorized Keys • T1521.003 SSL Pinning • T1552 Unsecured Credentials • T1552.001 Credentials In Files • T1552.002 Credentials in Registry • T1552.004 Private Keys • T1563.001 SSH Hijacking • T1573 Encrypted Channel • T1573.001 Symmetric Cryptography • T1573.002 Asymmetric Cryptography

Related

Mitigates · MITRE ATT&CK (11)

  • T1521.003 SSL Pinning sub-technique
  • T1098.004 SSH Authorized Keys sub-technique
  • T1573 Encrypted Channel technique
  • T1573.001 Symmetric Cryptography sub-technique
  • T1573.002 Asymmetric Cryptography sub-technique
  • T1563.001 SSH Hijacking sub-technique
  • T1552 Unsecured Credentials technique
  • T1552.001 Credentials In Files sub-technique
  • T1552.002 Credentials in Registry sub-technique
  • T1552.004 Private Keys sub-technique
  • T1072 Software Deployment Tools technique

Related control · Compliance (19)

  • NIST-AC-17 Remote Access NIST 800-53 control
  • NIST-AU-10 Non-repudiation NIST 800-53 control
  • NIST-AU-9 Protection of Audit Information NIST 800-53 control
  • NIST-CM-3 Configuration Change Control NIST 800-53 control
  • NIST-IA-13 Identity Providers and Authorization Servers NIST 800-53 control
  • NIST-IA-3 Device Identification and Authentication NIST 800-53 control
  • NIST-IA-7 Cryptographic Module Authentication NIST 800-53 control
  • NIST-SA-4 Acquisition Process NIST 800-53 control
  • NIST-SA-8 Security and Privacy Engineering Principles NIST 800-53 control
  • NIST-SA-9 External System Services NIST 800-53 control
  • NIST-SC-11 Trusted Path NIST 800-53 control
  • NIST-SC-13 Cryptographic Protection NIST 800-53 control
  • NIST-SC-17 Public Key Infrastructure Certificates NIST 800-53 control
  • NIST-SC-20 Secure Name/Address Resolution Service (Authoritative Source) NIST 800-53 control
  • NIST-SC-37 Out-of-band Channels NIST 800-53 control
  • NIST-SC-40 Wireless Link Protection NIST 800-53 control
  • NIST-SC-8 Transmission Confidentiality and Integrity NIST 800-53 control
  • NIST-SI-3 Malicious Code Protection NIST 800-53 control
  • NIST-SI-7 Software, Firmware, and Information Integrity NIST 800-53 control

Referenced by Compliance · enhancement of (4)

Referenced by Compliance · has member (1)

  • NIST-SC System and Communications Protection NIST 800-53 family

Referenced by Compliance · related control (51)

  • NIST-AC-16(8) Association Techniques and Technologies NIST 800-53 enhancement
  • NIST-AC-17 Remote Access NIST 800-53 control
  • NIST-AC-17(10) Authenticate Remote Commands NIST 800-53 enhancement
  • NIST-AC-17(2) Protection of Confidentiality and Integrity Using Encryption NIST 800-53 enhancement
  • NIST-AC-17(4) Privileged Commands and Access NIST 800-53 enhancement
  • NIST-AC-18(1) Authentication and Encryption NIST 800-53 enhancement
  • NIST-AC-19(5) Full Device or Container-based Encryption NIST 800-53 enhancement
  • NIST-AC-2 Account Management NIST 800-53 control
  • NIST-AC-3 Access Enforcement NIST 800-53 control
  • NIST-AU-10 Non-repudiation NIST 800-53 control
  • NIST-AU-9(3) Cryptographic Protection NIST 800-53 enhancement
  • NIST-CM-14 Signed Components NIST 800-53 control
  • NIST-CM-3(6) Cryptography Management NIST 800-53 enhancement
  • NIST-CP-9 System Backup NIST 800-53 control
  • NIST-CP-9(8) Cryptographic Protection NIST 800-53 enhancement
  • NIST-IA-13(1) Protection of Cryptographic Keys NIST 800-53 enhancement
  • NIST-IA-3(1) Cryptographic Bidirectional Authentication NIST 800-53 enhancement
  • NIST-IA-5 Authenticator Management NIST 800-53 control
  • NIST-IA-7 Cryptographic Module Authentication NIST 800-53 control
  • NIST-MA-4(6) Cryptographic Protection NIST 800-53 enhancement
  • NIST-MP-2 Media Access NIST 800-53 control
  • NIST-MP-4 Media Storage NIST 800-53 control
  • NIST-MP-5 Media Transport NIST 800-53 control
  • NIST-SA-4(6) Use of Information Assurance Products NIST 800-53 enhancement
  • NIST-SA-4(7) NIAP-approved Protection Profiles NIST 800-53 enhancement
  • NIST-SA-8(18) Trusted Communications Channels NIST 800-53 enhancement
  • NIST-SA-8(26) Performance Security NIST 800-53 enhancement
  • NIST-SA-9(6) Organization-controlled Cryptographic Keys NIST 800-53 enhancement
  • NIST-SC-11 Trusted Path NIST 800-53 control
  • NIST-SC-13 Cryptographic Protection NIST 800-53 control
Show all 51 ›