SC-28(03) Cryptographic Keys
NIST SP 800-53 (controls) 5.2.0 against 5.2.0
All changes in this version
All changes in this version
Title
Cryptographic Keys
Control
Provide protected storage for cryptographic keys [Selection: {{ insert: param, sc-28.03_odp.02 }} ; hardware-protected key store].
Discussion
A Trusted Platform Module (TPM) is an example of a hardware-protected data store that can be used to protect cryptographic keys.
Parameters
sc-28.03_odp.01: [{{ insert: param, sc-28.03_odp.02 }} ; hardware-protected key store]
sc-28.03_odp.02: safeguards
Related controls
sc-12, sc-13
Assessment objective
SC-28(03) protected storage for cryptographic keys is provided using [Selection: {{ insert: param, sc-28.03_odp.02 }} ; hardware-protected key store].
STIG rules that implement this control 4
Canonical Ubuntu 24.04 LTS V1R7
- UBTU-24-600090 CAT I Ubuntu 24.04 LTS handling data requiring data-at-rest protections must employ cryptographic mechanisms to prevent unauthorized disclosure and modification of the information at rest.
Cisco IOS XE Router NDM Y26M04
- CISC-ND-000620 CAT I The Cisco router must only store cryptographic representations of passwords.
Microsoft Windows Server 2025 V1R4
- WN25-00-000090 CAT II Windows Server 2025 systems must have a Trusted Platform Module (TPM) enabled and ready for use.
Red Hat Enterprise Linux 10 V1R3
- RHEL-10-701270 CAT II RHEL 10 must, for PKI-based authentication, validate certificates by constructing a certification path (which includes status information) to an accepted trust anchor.