Modification of automatic or manual rotation settings can keep older key material active longer than intended, decreasing cryptographic resilience and extending exposure in the event of key compromise.
Key Rotation is Disabled or Delayed Beyond Policy Limits
CCC.KeyMgmt.TH03
Related Capabilities
| ID | Title | Description |
|---|---|---|
| CCC.KeyMgmt.CP20 | Automatic Symmetric Key Rotation | The service may be configured to automatically generate new key material for a symmetric key at a user-defined interval, provided the key material was generated within the service, while retaining prior versions for decryption. |
| CCC.KeyMgmt.CP21 | Manual Key Rotation | The service can rotate a managed key on demand by generating a new key version, while retaining prior versions for decryption. |
Related Controls
| ID | Title | Description |
|---|---|---|
| CCC.KeyMgmt.CN03 | Enforce Automatic Rotation | Ensure symmetric keys rotate automatically within policy intervals to reduce exposure of key material. |