CMMC Practice SC.3.187

Establish and manage cryptographic keys for cryptography employed in organizational systems.


CMMC Version 1.02, pg. 260

Bold Coast Security Guidance

Key management is a critical function, since failure to properly manage keys can lead to compromise of systems by malicious entities, or a self-imposed disruption of service that is caused by the loss of encryption keys needed to restore data, in some cases, when systems and data have to be restored from backups. Level 3 compliance requires an organization to have a clear plan which identifies the appropriate owners and key period to ensure keys are well-managed.

Discussion From Source

DRAFT NIST SP 800-171 R2 Cryptographic key management and establishment can be performed using manual procedures or mechanisms supported by manual procedures. Organizations define key management requirements in accordance with applicable federal laws, Executive Orders, policies, directives, regulations, and standards specifying appropriate options, levels, and parameters.