Ensure that key material is generated and held only inside validated hardware security modules.
Require HSM Protection for Key Material
CCC.KeyMgmt.CN07 · Encryption
Related Capabilities
| ID | Title | Description |
|---|---|---|
| CCC.KeyMgmt.CP08 | Key Creation | The service can generate key material within its own boundary using any supported algorithm, so that private key material is never exposed to the user. |
| CCC.KeyMgmt.CP13 | FIPS 140 Level 3 Hardware Security Modules | The service can generate and store keys in hardware security modules validated to FIPS 140-2 Level 3 or FIPS 140-3 Level 3, so that key material never exists in plaintext outside the module. |
| CCC.KeyMgmt.CP22 | Key Import | The service can import key material generated outside the service, wrapped under a service-provided wrapping key, so that it can be used as a managed key. |
Related Threats
| ID | Title | Description |
|---|---|---|
| CCC.KeyMgmt.TH06 | Key Material is Generated or Stored Outside a Hardware Security Module | Keys may be created with a software protection level instead of being generated and held in a validated hardware security module. Key material then exists in a form that can be extracted or copied by a compromised host or privileged operator. Confidentiality of every item protected by the key is lost if the material is exfiltrated. |
Assessment Requirements
| ID | Text | Applicability |
|---|---|---|
| CCC.KeyMgmt.CN07.AR01 | When a key is created, the service MUST generate and store its key material in a hardware security module validated to FIPS 140-2 Level 3 or FIPS 140-3 Level 3. | tlp-amber, tlp-red |