Crypto / Key / Controls / v2026.11
Validate Imported Keys
CCC.KeyMgmt.CN04 · Encryption
Accept only externally generated keys that meet approved cryptographic strength and provenance requirements.
Related Capabilities
| ID | Title | Description |
|---|
| CCC.KeyMgmt.CP22 | Key Import | The service can import key material generated outside the service, wrapped under a service-provided wrapping key, so that it can be used as a managed key. |
Related Threats
| ID | Title | Description |
|---|
| CCC.KeyMgmt.TH04 | Weak or Compromised Key Material is Imported | Insufficient validation during the key-import process may allow weak, back-doored, or otherwise compromised key material to be introduced, reducing the overall strength of subsequent cryptographic operations. |
Assessment Requirements
| ID | Text | Applicability |
|---|
| CCC.KeyMgmt.CN04.AR01 | When a key import request is processed, the key MUST use an approved algorithm (AES-256, RSA-2048 or larger, EC-P256 or larger). | tlp-green |
| CCC.KeyMgmt.CN04.AR02 | When a key import request is processed, the key material MUST originate from a certified HSM. | tlp-amber, tlp-red |
Guideline Mappings
| Framework | ID | Remarks |
|---|
| NIST-CSF | PR.DS-1 | Data at rest is protected |
| NIST_800_53 | SC-28 | Protection of Information at Rest |