Ensure that destroyed key material remains recoverable long enough to detect and reverse an unintended deletion.
Enforce a Key Deletion Recovery Window
CCC.KeyMgmt.CN05 · Data
Related Capabilities
| ID | Title | Description |
|---|---|---|
| CCC.Core.CP18 | Resource Versioning | The service automatically assigns versions to child resources which can be used to preserve, retrieve, and restore past iterations. |
| CCC.KeyMgmt.CP16 | Disable Key | The service can disable a managed key or key version so that cryptographic operations with it are rejected until it is re-enabled, without deleting the key material. |
| CCC.Core.CP32 | Deletion Protection | The service may be configured to block the deletion of a child resource, or to retain a deleted child resource for a recovery window during which it can be restored. |
| CCC.KeyMgmt.CP19 | Delete Key | The service can permanently destroy a managed key or key version once the deletion-protection recovery window has elapsed, after which data protected by it can no longer be decrypted. |
| CCC.Core.CP11 | Backup | The service can generate copies of its data or configurations in the form of automated backups, snapshot-based backups, or incremental backups. |
| CCC.Core.CP34 | Data Lifecycle Policy | The service may be configured to automatically delete, archive, or transition data or child resources once a user-defined age or condition is reached. |
Related Threats
| ID | Title | Description |
|---|---|---|
| CCC.KeyMgmt.TH01 | Key Versions are Deleted or Disabled | Disabling, scheduling deletion, or permanently purging KMS key versions that protect sensitive data can prevent required decryption or signing operations. Service interruption or irreversible data loss may occur if the key material is no longer recoverable. |
| CCC.Core.TH06 | Data is Lost or Corrupted | Services that rely on accurate data are susceptible to disruption in the event of data loss or corruption. Any actions that lead to the unintended deletion, alteration, or limited access to data can impact the availability of the service and the system it is part of. |
Assessment Requirements
| ID | Text | Applicability |
|---|---|---|
| CCC.KeyMgmt.CN05.AR01 | When a key or key version is scheduled for destruction, the service MUST retain the key material in a recoverable state for at least 7 days before it is destroyed. | tlp-clear, tlp-green, tlp-amber, tlp-red |
| CCC.KeyMgmt.CN05.AR02 | When a key or key version is disabled or scheduled for destruction, the service MUST publish an event to a monitored channel. | tlp-amber, tlp-red |