CMMC Practice SC.3.187
Establish and manage cryptographic keys for cryptography employed in organizational systems.
Bold Coast Security Guidance
Key management is a critical function, since failure to properly manage keys can lead to compromise of systems by malicious entities, or a self-imposed disruption of service that is caused by the loss of encryption keys needed to restore data, in some cases, when systems and data have to be restored from backups. Level 3 compliance requires an organization to have a clear plan which identifies the appropriate owners and key period to ensure keys are well-managed.
DRAFT NIST SP 800-171 R2
Cryptographic key management and establishment can be performed using manual procedures or mechanisms supported by manual procedures. Organizations define key management requirements in accordance with applicable federal laws, Executive Orders, policies, directives, regulations, and standards specifying appropriate options, levels, and parameters.