Control: When cryptography is required and employed within the information system, the organization establishes and manages cryptographic keys using automated mechanisms with supporting procedures or manual procedures.

Supplemental Guidance: NIST Special Publication 800-56 provides guidance on cryptographic key establishment. NIST Special Publication 800-57 provides guidance on cryptographic key management.

Control Enhancements: (0) None.

Baseline: LOW Not Selected MOD SC-12 HIGH SC-12

Family: System And Communications Protection

Class: Technical

ISO 17799 mapping: 12.3.1, 12.3.2

COBIT 4.1 mapping: DS5.8