CM-3(6): Cryptography Management

Control Family:

Configuration Management

Parent Control:

CM-3: Configuration Change Control

Priority:

P1: Implement P1 security controls first.

CSF v1.1 References:

PR.IP-1
PR.IP-3
DE.CM-1
DE.CM-7

Threats Addressed:

Tampering
Repudiation
Information Disclosure

Baselines:

(Not part of any baseline)

Next Version:

NIST Special Publication 800-53 Revision 5.2.0:
CM-3(6): Cryptography Management

Control Statement

The organization ensures that cryptographic mechanisms used to provide [Assignment: organization-defined security safeguards] are under configuration management.

Supplemental Guidance

Regardless of the cryptographic means employed (e.g., public key, private key, shared secrets), organizations ensure that there are processes and procedures in place to effectively manage those means. For example, if devices use certificates as a basis for identification and authentication, there needs to be a process in place to address the expiration of those certificates.