Assessment Objective
Determine if:
- SC-12(03)[01] asymmetric cryptographic keys are produced using [Selection: NSA-approved key management technology and processes; prepositioned keying material; DoD-approved or DoD-issued Medium Assurance PKI certificates; DoD-approved or DoD-issued Medium Hardware Assurance PKI certificates and hardware security tokens that protect the user’s private key; certificates issued in accordance with organization-defined requirements];
- SC-12(03)[02] asymmetric cryptographic keys are controlled using [Selection: NSA-approved key management technology and processes; prepositioned keying material; DoD-approved or DoD-issued Medium Assurance PKI certificates; DoD-approved or DoD-issued Medium Hardware Assurance PKI certificates and hardware security tokens that protect the user’s private key; certificates issued in accordance with organization-defined requirements];
- SC-12(03)[03] asymmetric cryptographic keys are distributed using [Selection: NSA-approved key management technology and processes; prepositioned keying material; DoD-approved or DoD-issued Medium Assurance PKI certificates; DoD-approved or DoD-issued Medium Hardware Assurance PKI certificates and hardware security tokens that protect the user’s private key; certificates issued in accordance with organization-defined requirements].
Assessment Methods
Examine
- System and communications protection policy
- procedures addressing cryptographic key establishment and management
- system design documentation
- system configuration settings and associated documentation
- system audit records
- list of NSA-approved cryptographic products
- list of approved PKI Class 3 and Class 4 certificates
- system security plan
- other relevant documents or records
Interview
- System/network administrators
- organizational personnel with information security responsibilities
- system developer
- organizational personnel with responsibilities for cryptographic key establishment or management
- organizational personnel with responsibilities for PKI certificates
Test
- Mechanisms supporting and/or implementing asymmetric cryptographic key establishment and management
Ticket collegati
| Tipo di collegamento | Ticket |
|---|---|
| blocks | SC-12(03) Asymmetric Keys |