BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

9.2 Inventory Management

NIST platform security: roots of trust, firmware and secure enclaves SP 800-57 Part 1 Rev. 5 against SP 800-57 Part 1 Rev. 4
All changes in this version
added 9 Additional Considerations part of 9

Title changed

Before · SP 800-57 Part 1 Rev. 4

After · SP 800-57 Part 1 Rev. 5

Inventory Management

Control changed

Before · SP 800-57 Part 1 Rev. 4

After · SP 800-57 Part 1 Rev. 5

When using cryptographic mechanisms employing keys, all long-term keys shall be inventoried. In the case of symmetric keys, this includes the keys used for the protection of information in transit and in storage. For asymmetric key pairs, this includes the key pairs owned by organizational entities − those entities within the organization that are authorized to use the private key of the key pair. When certificates are issued for the public key of the key pair, records shall be maintained for those certificates. These records need to be maintained by an inventory management system. Inventory management is concerned with establishing and maintaining records of the keys and/or certificates in use, assigning and tracking their owners or sponsors 105 (who or what they are, where they are located, and how to contact them), monitoring key and certificate status (e.g., expiration dates and whether a key is compromised), and reporting the status to the appropriate official for remedial action when required.