Cryptographic Key Establishment and Management SC-12

Source: NIST SP 800-53 Rev.5, System and Communications Protection family NIST SP 800-53 Rev.5. The baseline shows the lowest SP 800-53B baseline (Low / Moderate / High) this control appears in NIST SP 800-53B.

Control guide — plain-English, per NIST SP 800-53

SC-12 (Cryptographic Key Establishment and Management) requires managing cryptographic keys across their whole lifecycle — generation, distribution, storage, rotation, and destruction — for the keys the system relies on. Whenever encryption is used (SC-8, SC-13), SC-12 governs the keys behind it. It applies from Low into Moderate.

What good looks like

• Generate keys with approved methods and appropriate strength.
• Distribute and install keys securely — never send a key in cleartext.
• Store private keys protected: restricted file permissions, a passphrase, or a secrets store.
• Rotate keys on a defined schedule and on suspected compromise.
• Revoke and destroy retired keys so they cannot be reused.

Framework mapping

• NIST CSF 2.0 — PR.AA-01 — Identities and credentials, including cryptographic keys, are managed
• CIS Controls v8 — Control 3 — Data Protection (key management for encrypted data)

How to move it toward Implemented

• Key establishment is done: the BLUEADMIN Secure Shell (SSH) key was installed via ssh-copy-id and password auth is disabled — that half is concrete.
• The missing piece is the rest of the lifecycle. Define a rotation cadence (regenerate the admin keypair on a schedule and whenever staff change), protect the private key with a passphrase and restricted permissions, and add a destruction step (prune retired keys from authorized_keys).
• Write that as a one-page key lifecycle note and attach it naming SC-12 to move from partial toward 'Completed'.