CRY-17 Cryptographic Key Lifecycle Management

Basic criterion

Procedures and technical safeguards for secure key management in the area of responsibility of the Cloud Service Provider include at least the following aspects:

• Generation of keys for different cryptographic systems and applications;
• Issuing and obtaining public-key certificates;
• Provisioning and activation of the keys;
• Secure storage of keys (separation of key management system from application and middleware level) including description of how authorised users get access;
• Changing or updating cryptographic keys including policies defining under which conditions and in which manner the changes and/or updates are to be realised;
• Handling of compromised keys;
• Withdrawal and deletion of keys; and
• If pre-shared keys are used, the specific provisions relating to the safe use of this procedure are specified separately.

Additional criterion

Keys should be withdrawn or deleted e.g. in the event of compromise or employee changes. The Cloud Service Provider protects the keys which are created and inserted into the cloud service by the cloud customers according to the same criteria as the keys created by the Cloud Service Provider.