Secure Req 11: Difference between revisions
m (7 revisions imported: Initial Upload of old pages from IDESG Wiki) |
(No difference)
|
Latest revision as of 04:03, 28 June 2018
<< Back to Baseline Functional Requirements Index
SECURE-11. KEY MANAGEMENT
Entities that use cryptographic solutions as part of identity management MUST implement key management policies and processes that are consistent with industry-accepted practices.
SUPPLEMENTAL GUIDANCE
To support the security and interoperability of cryptographic solutions, organizations must follow best practices and standards for cryptographic algorithms and key management including the generation, protection, distribution, and recovery of keys.
REFERENCES
NIST 800-57 (3-parts – Key Management– http://dx.doi.org/10.6028/NIST.SP.800-57pt3r1, http://csrc.nist.gov/publications/nistpubs/800-57/SP800-57-Part2.pdf, http://dx.doi.org/10.6028/NIST.SP.800-57pt3r1; , ISO/IEC 27002 - 12.3.1; PCI-DSS- 3.6.1-3.6.8 ; (see table of requirements at page 18+); FFIEC - Information Security http://ithandbook.ffiec.gov/ITBooklets/FFIEC_ITBooklet_InformationSecurity.pdf, see 5.1.2.3(a), 5.3, 5.3.2, 2.1.2, 2.11; Wholesale Payment Systems Booklet, http://ithandbook.ffiec.gov/ITBooklets/FFIEC_ITBooklet_WholesalePaymentSystems.pdf
APPLIES TO ACTIVITIES
REGISTRATION, CREDENTIALING, AUTHENTICATION, AUTHORIZATION, INTERMEDIATION
KEYWORDS
Quick Links: SALS | Baseline Functional Requirements v1.0 | Glossary |