SC-12(3)

Requirement

Produce, control, and distribute asymmetric cryptographic keys using [Selection: NSA-approved key management technology and processes; prepositioned keying material; DoD-approved or DoD-issued Medium Assurance PKI certificates; DoD-approved or DoD-issued Medium Hardware Assurance PKI certificates and hardware security tokens that protect the user’s private key; certificates issued in accordance with organization-defined requirements].

Discussion

SP 800-56A, SP 800-56B, and SP 800-56C provide guidance on cryptographic key establishment schemes and key derivation methods. SP 800-57-1, SP 800-57-2, and SP 800-57-3 provide guidance on cryptographic key management.

NIST 800-53A Assessment Guidance

Examine

[SELECT FROM: System and communications protection policy; procedures addressing cryptographic key establishment and management; system design documentation; system configuration settings and associated documentation; system audit records; list of NSA-approved cryptographic products; list of approved PKI Class 3 and Class 4 certificates; system security plan; other relevant documents or records].

Interview

[SELECT FROM: System/network administrators; organizational personnel with information security responsibilities; system developer; organizational personnel with responsibilities for cryptographic key establishment or management; organizational personnel with responsibilities for PKI certificates].

Test

[SELECT FROM: Mechanisms supporting and/or implementing asymmetric cryptographic key establishment and management].

ID	Assessment Objectives
SC-12(03)[01]	asymmetric cryptographic keys are produced using <SC-12(03)_ODP SELECTED PARAMETER VALUE>;
SC-12(03)[02]	asymmetric cryptographic keys are controlled using <SC-12(03)_ODP SELECTED PARAMETER VALUE>;
SC-12(03)[03]	asymmetric cryptographic keys are distributed using <SC-12(03)_ODP SELECTED PARAMETER VALUE>.

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!