| CCC.KeyMgmt.CP01 | AES-256 | The service can create and use symmetric keys that implement the Advanced Encryption Standard (AES) with a 256-bit key for encryption and decryption. | 1 |
| CCC.KeyMgmt.CP02 | RSA-2048 | The service can create and use RSA keys with a 2048-bit modulus for encryption and digital signatures. | 2 |
| CCC.KeyMgmt.CP03 | RSA-3072 | The service can create and use RSA keys with a 3072-bit modulus for encryption and digital signatures. | 2 |
| CCC.KeyMgmt.CP04 | RSA-4096 | The service can create and use RSA keys with a 4096-bit modulus for encryption and digital signatures. | 2 |
| CCC.KeyMgmt.CP05 | EC-P256 | The service can create and use elliptic curve keys on the NIST P-256 curve for digital signatures. | 1 |
| CCC.KeyMgmt.CP06 | EC-P256K | The service can create and use elliptic curve keys on the secp256k1 curve for digital signatures. | 1 |
| CCC.KeyMgmt.CP07 | EC-P384 | The service can create and use elliptic curve keys on the NIST P-384 curve for digital signatures. | 1 |
| CCC.KeyMgmt.CP08 | Key Creation | The service can generate key material within its own boundary using any supported algorithm, so that private key material is never exposed to the user. | 2 |
| CCC.KeyMgmt.CP09 | Encrypt Data | The service can encrypt data submitted by a user with a managed key and return the ciphertext without exposing the key material. | 2 |
| CCC.KeyMgmt.CP10 | Decrypt Data | The service can decrypt ciphertext submitted by a user with a managed key and return the plaintext without exposing the key material. | 2 |
| CCC.KeyMgmt.CP11 | Create Digital Signature | The service can generate a digital signature over data or a digest submitted by a user with a managed asymmetric key. | 2 |
| CCC.KeyMgmt.CP12 | Verify Digital Signature | The service can verify a digital signature over data or a digest submitted by a user with the public half of a managed asymmetric key. | 1 |
| CCC.KeyMgmt.CP13 | FIPS 140 Level 3 Hardware Security Modules | The service can generate and store keys in hardware security modules validated to FIPS 140-2 Level 3 or FIPS 140-3 Level 3, so that key material never exists in plaintext outside the module. | 1 |
| CCC.KeyMgmt.CP16 | Disable Key | The service can disable a managed key or key version so that cryptographic operations with it are rejected until it is re-enabled, without deleting the key material. | 1 |
| CCC.KeyMgmt.CP17 | Enable Key | The service can re-enable a disabled managed key or key version so that cryptographic operations with it resume. | 1 |
| CCC.KeyMgmt.CP19 | Delete Key | The service can permanently destroy a managed key or key version once the deletion-protection recovery window has elapsed, after which data protected by it can no longer be decrypted. | 1 |
| CCC.KeyMgmt.CP20 | Automatic Symmetric Key Rotation | The service may be configured to automatically generate new key material for a symmetric key at a user-defined interval, provided the key material was generated within the service, while retaining prior versions for decryption. | 1 |
| CCC.KeyMgmt.CP21 | Manual Key Rotation | The service can rotate a managed key on demand by generating a new key version, while retaining prior versions for decryption. | 1 |
| CCC.KeyMgmt.CP22 | Key Import | The service can import key material generated outside the service, wrapped under a service-provided wrapping key, so that it can be used as a managed key. | 2 |
| CCC.KeyMgmt.CP25 | Key Usage Restriction | The service may be configured to restrict a key to a declared set of operations, such as encrypt and decrypt or sign and verify, and rejects requests for operations outside that set. | 1 |
| CCC.KeyMgmt.CP26 | Message Authentication Code Generation and Verification | The service can generate and verify hash-based message authentication codes (HMAC) over data submitted by a user with a managed symmetric key, so that the MAC key never leaves the service. | 1 |
| CCC.KeyMgmt.CP27 | External Key Store | The service may be configured to perform cryptographic operations with keys held in a key manager outside the provider's infrastructure, so that the user retains sole custody of the key material. Where a provider lacks this, key material custody cannot be kept outside the provider. | 1 |