Key Management

List every place cryptography is employed. Each entry needs a key story.

Full-disk encryption recovery keys, TLS certificates, VPN secrets, backup encryption keys, and signing keys all belong on the list. Each needs an answer for how the key is created [a] and how it is stored, renewed, revoked, and destroyed [b]. The inventory is short in a small environment, and writing it is most of the work.

Never store a key where the data it protects lives.

A backup encryption key kept in the same repository as the backups means one compromised account yields both. Store recovery keys for full-disk encryption away from the device. Escrowing BitLocker keys to Microsoft Entra ID or Intune is the ordinary case. Keep backup keys in a separate access-controlled store. Check that no single account reaches both a key and the data it unlocks.

Cloud providers manage the keys for their services. Cite it, do not duplicate it.

For a service like Microsoft 365, the provider generates and manages the keys behind its encryption, and its shared responsibility documentation says so. Your side of [a] and [b] is the keys you hold: device encryption, certificates you issue or buy, and anything you generate yourself.

Certificates are keys with expiration dates. Assign the renewal.

Track certificates from an internal certificate authority in that system, and give externally purchased certificates an owner and a renewal reminder. An expired certificate is a key management failure that announces itself to every visitor.