[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-800-53\u002Fsc-12":3},{"item":4,"lessons":18,"controls":69,"related":99},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"nist-800-53","sc-12","SC-12","Cryptographic Key Establishment and Management",17,"US National Institute of Standards and Technology (NIST)","**What it asks for.** Cryptographic keys must be established and managed according to defined requirements for key generation, distribution, storage, access and destruction.\n\n**In practice.** Doing this well means a key management standard, central key management services or hardware security modules for sensitive keys, defined key lifetimes and rotation, separation of duties for key custodians and procedures for compromise. Auditors expect the standard, key inventories, rotation records and access controls on key stores. ISO\u002FIEC 27001 cryptographic key management sets similar expectations.\n\n**Common gaps.** Keys and secrets are often stored alongside the data they protect or embedded in code. Many organisations cannot list all their keys and certificates. Key custodians may also leave without a handover. Rotation is also frequently postponed indefinitely because nobody knows what would break.","Establish and manage cryptographic keys when cryptography is employed within the system in accordance with the following key management requirements: [Assignment: organization-defined requirements].\nDiscussion: Cryptographic key management and establishment can be performed using manual procedures or automated mechanisms with supporting manual procedures. Organizations define key management requirements in accordance with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines and specify appropriate options, parameters, and levels. Organizations manage trust stores to ensure that only approved trust anchors are part of such trust stores. This includes certificates with visibility external to organizational systems and certificates related to the internal operations of systems. [NIST CMVP](#1acdc775-aafb-4d11-9341-dc6a822e9d38) and [NIST CAVP](#84dc1b0c-acb7-4269-84c4-00dbabacd78c) provide additional information on validated cryptographic modules and algorithms that can be used in cryptographic key management and establishment.","From NIST SP 800-53 Rev. 5, a work of the US government in the public domain.","https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Fsp\u002F800\u002F53\u002Fr5\u002Fupd1\u002Ffinal","Open SP 800-53 at NIST",null,"2026-10-18T15:18:43.663+00:00",{"total":19,"list":20},23,[21,25,29,33,37,41,45,49,53,57,61,65],{"slug":22,"title":23,"published_at":24},"self-hosted-ai-agents-demand-rigorous-credential-and-configuration-controls","Self-Hosted AI Agents Demand Rigorous Credential and Configuration Controls","2026-11-12T19:21:17.711+00:00",{"slug":26,"title":27,"published_at":28},"misconfigured-anonymous-access-exposes-container-registries-to-full-hijack","Misconfigured Anonymous Access Exposes Container Registries to Full Hijack","2026-11-12T14:20:21.972+00:00",{"slug":30,"title":31,"published_at":32},"unauthenticated-token-takeover-exposes-private-container-registries","Unauthenticated Token Takeover Exposes Private Container Registries","2026-11-12T10:21:30.989+00:00",{"slug":34,"title":35,"published_at":36},"buggy-workaround-script-caused-emudhra-to-issue-cryptographically-weak-certificates","Buggy Workaround Script Caused eMudhra to Issue Cryptographically Weak Certificates","2026-11-12T05:20:20.672+00:00",{"slug":38,"title":39,"published_at":40},"buggy-key-migration-script-compromises-16-emudhra-ca-certificates","Buggy Key Migration Script Compromises 16 eMudhra CA Certificates","2026-11-11T22:20:25.443+00:00",{"slug":42,"title":43,"published_at":44},"buggy-script-fatally-weakened-ca-private-keys-destroying-trust-in-emudhra","Buggy Script Fatally Weakened CA Private Keys, Destroying Trust in eMudhra","2026-11-11T14:20:46.892+00:00",{"slug":46,"title":47,"published_at":48},"gobalance-key-exposure-flaw-enables-onion-address-hijacking","GoBalance Key Exposure Flaw Enables .onion Address Hijacking","2026-10-09T10:20:58.801+00:00",{"slug":50,"title":51,"published_at":52},"slim-spider-targets-brazilian-fintechs-to-steal-cloud-credentials-and-crypto-secrets","Slim Spider Targets Brazilian Fintechs to Steal Cloud Credentials and Crypto Secrets","2026-09-08T18:22:01.558+00:00",{"slug":54,"title":55,"published_at":56},"critical-ebyte-na111-m-firmware-flaws-enable-full-device-compromise","Critical Ebyte NA111-M Firmware Flaws Enable Full Device Compromise","2026-08-27T18:22:44.28+00:00",{"slug":58,"title":59,"published_at":60},"encryption-key-exposed-in-api-leads-to-startup-platform-data-breach","Encryption Key Exposed in API Leads to Startup Platform Data Breach","2026-08-24T16:21:17.656+00:00",{"slug":62,"title":63,"published_at":64},"n-able-passportal-flaw-exposes-password-vault-master-keys","N-able Passportal Flaw Exposes Password Vault Master Keys","2026-08-20T18:20:40.6+00:00",{"slug":66,"title":67,"published_at":68},"mozillas-signing-key-accidentally-committed-to-code-repo","Mozilla's Signing Key Accidentally Committed to Code Repo","2026-08-11T14:22:57.948+00:00",[70,75,80,85,90,95],{"slug":71,"name":72,"problem":73,"stories":74},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",13,{"slug":76,"name":77,"problem":78,"stories":79},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",10,{"slug":81,"name":82,"problem":83,"stories":84},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",8,{"slug":86,"name":87,"problem":88,"stories":89},"patch-management","Automated patch management","Known holes get closed in days, not months.",5,{"slug":91,"name":92,"problem":93,"stories":94},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",3,{"slug":96,"name":97,"problem":98,"stories":94},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[100,106,112,116,121,125,129,134],{"family":101,"item":102,"code":103,"title":104,"together":105},"gdpr","32","Article 32","Security of processing",11,{"family":107,"item":108,"code":109,"title":110,"together":111},"cis","4","Control 4","Secure Configuration of Enterprise Assets and Software",9,{"family":107,"item":113,"code":114,"title":115,"together":84},"3","Control 3","Data Protection",{"family":107,"item":117,"code":118,"title":119,"together":120},"16","Control 16","Application Software Security",6,{"family":107,"item":122,"code":123,"title":124,"together":120},"7","Control 7","Continuous Vulnerability Management",{"family":126,"item":127,"code":128,"title":128,"together":89},"itil","overview","ITIL",{"family":107,"item":130,"code":131,"title":132,"together":133},"2","Control 2","Inventory and Control of Software Assets",4,{"family":135,"item":136,"code":137,"title":138,"together":133},"iso-27001","a-8-24","Annex A 8.24","ISO\u002FIEC 27001:2022 Annex A 8.24: Use of cryptography"]