Assessment Objective

Determine if:

• SC-12(02)[01] symmetric cryptographic keys are produced using [Selection: NIST FIPS-validated; NSA-approved] key management technology and processes;
• SC-12(02)[02] symmetric cryptographic keys are controlled using [Selection: NIST FIPS-validated; NSA-approved] key management technology and processes;
• SC-12(02)[03] symmetric cryptographic keys are distributed using [Selection: NIST FIPS-validated; NSA-approved] key management technology and processes.

Assessment Methods

Examine

• System and communications protection policy
• procedures addressing cryptographic key establishment and management
• system design documentation
• system configuration settings and associated documentation
• system audit records
• list of FIPS-validated cryptographic products
• list of NSA-approved cryptographic products
• system security plan
• other relevant documents or records

Interview

• System/network administrators
• organizational personnel with information security responsibilities
• system developer
• organizational personnel with responsibilities for cryptographic key establishment or management

Test

• Mechanisms supporting and/or implementing symmetric cryptographic key establishment and management

Kwistjonijiet marbuta

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final