id: "SC-12(01)" title: "Availability" family: "SC" family_name: "System and Communications Protection" sort_id: "sc-12.01" priority: "P1" implementation_level: "system" parent: "SC-12" enhancement: True


Statement

Maintain availability of information in the event of the loss of cryptographic keys by users.

Guidance

Escrowing of encryption keys is a common practice for ensuring availability in the event of key loss. A forgotten passphrase is an example of losing a cryptographic key.

Assessment Objective

information availability is maintained in the event of the loss of cryptographic keys by users.

System and communications protection policy

procedures addressing cryptographic key establishment, management, and recovery

system design documentation

system configuration settings and associated documentation

system audit records

system security plan

other relevant documents or records

System/network administrators

organizational personnel with information security responsibilities

organizational personnel with responsibilities for cryptographic key establishment or management

Mechanisms supporting and/or implementing cryptographic key establishment and management