BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

6.2.2.1 Availability

NIST platform security: roots of trust, firmware and secure enclaves SP 800-57 Part 1 Rev. 4
All changes in this version
first version loaded 6 Training: If the new system requires that new or different tasks (e.g., key part of 6.2.2

Title

Availability

Control

Cryptographic information may need to be readily available for as long as data is protected by the information. A common method for providing this protection is to make one or more copies of the cryptographic information and store them in separate locations. During a key’s cryptoperiod, keying material requiring long-term availability should be stored in both normal operational storage (see Section 8.2.1 ) and in backup storage (see Section 8.2.2.1 ). Cryptographic information that is retained after the end of a key’s cryptoperiod should be placed in archive storage (see Section 8.3.1 ). This Recommendation does not preclude the use of the same storage media for both backup and archive storage. Specifics on the long-term availability requirement for each key type are addressed for backup storage in Section 8.2.2.1 , and for archive storage in Section 8.3.1 . The recovery of this cryptographic information for use in replacing cryptographic information that is lost (e.g., from normal storage), or in performing cryptographic operations after the end of a key’s cryptoperiod is discussed in Sections 8.2.2.2 (recovery during normal operations) and 8.3.1 (recovery from archive storage), and in Appendix B . Even though the primary focus of this section is to provide assurance of the availability of cryptographic information, there is at least one example where denying the availability of this information may be desired, namely when sanitizing large volumes of information that have been encrypted. In this case, cryptographic sanitization (i.e., destroying the key used to decrypt the information) is suggested (see [ SP 800-88 ]).