Key Management

Official Source Material

SPRS score value: 1 point.
POA&M eligibility: Eligible at a conditional assessment.
Level 1: Not a Level 1 requirement.

Facts: NIST SP 800-171 DoD Assessment Methodology, Version 1.2.1, June 24, 2020, Annex A; 32 CFR Part 170, § 170.21 and § 170.24, eCFR text current as of September 17, 2026; CMMC Assessment Guide - Level 1, Version 2.13, September 2024.

Establish and manage cryptographic keys for cryptography employed in organizational systems.

Determine if:

[a] cryptographic keys are established whenever cryptography is employed; and
[b] cryptographic keys are managed whenever cryptography is employed.

Source: CMMC Assessment Guide - Level 2, Version 2.13, September 2024

Practitioner Guidance

How to meet it

List every place cryptography is employed. Each entry needs a key story.

Full-disk encryption recovery keys, TLS certificates, VPN secrets, backup encryption keys, and signing keys all belong on the list. Each needs an answer for how the key is created [a] and how it is stored, renewed, revoked, and destroyed [b]. The inventory is short in a small environment, and writing it is most of the work.

Never store a key where the data it protects lives.

A backup encryption key kept in the same repository as the backups means one compromised account yields both. Store recovery keys for full-disk encryption away from the device. Escrowing BitLocker keys to Microsoft Entra ID or Intune is the ordinary case. Keep backup keys in a separate access-controlled store. Check that no single account reaches both a key and the data it unlocks.

Cloud providers manage the keys for their services. Cite it, do not duplicate it.

For a service like Microsoft 365, the provider generates and manages the keys behind its encryption, and its shared responsibility model says so. Your side of [a] and [b] is the keys you hold: device encryption, certificates you issue or buy, and anything you generate yourself.

Certificates are keys with expiration dates. Assign the renewal.

Track certificates from an internal certificate authority in that system, and give externally purchased certificates an owner and a renewal reminder. An expired certificate is a key management failure that announces itself to every visitor.

What falls short

Encryption keys or recovery keys backed up alongside the data they encrypt. It collapses the protection to a single point of failure and shows the keys are not managed under [b].

Over-engineering

A hardware security module for a small environment. Objectives [a] and [b] are met by naming where cryptography is employed and who establishes and holds each key.
A key management platform that duplicates what your cloud provider already does. Cite the provider's key management for its services, and manage the keys you hold yourself.