Cryptographic Key Establishment and Management (03.13.10)_cryptographic-key-establishment-and-management

Cryptographic Key Establishment and Management (03.13.10) Cryptographic Key Establishment and Management

High-Level Description

Family: System and Communications Protection Framework: NIST SP 800-171 Rev 3 Applicability: Systems processing, storing, or transmitting CUI

Cryptographic Key Establishment and Management

What to Check

• Verify Cryptographic Key Establishment and Management (03.13.10) Cryptographic Key Establishment and Management is implemented for CUI systems
• Review SSP documentation for Cryptographic Key Establishment and Management (03.13.10)
• Validate CMMC Level 2 assessment objective for Cryptographic Key Establishment and Management (03.13.10)
• Confirm POA&M addresses any gaps for Cryptographic Key Establishment and Management (03.13.10)

How to Test

Step 1: Review System Security Plan

Examine the SSP for Cryptographic Key Establishment and Management (03.13.10) implementation description and responsible parties.

Step 2: Assess Implementation

# Verify security controls protecting CUI
# Check access controls, encryption, monitoring as applicable

# For Linux systems:
ls -la /etc/security/ 2>/dev/null
grep -r "CUI\|controlled" /etc/security/ 2>/dev/null

# For cloud:
# Use cloud-audit-mcp tools to assess posture

Step 3: CMMC Assessment Validation

Verify this requirement passes CMMC Level 2 assessment methodology per SP 800-171A Rev 3.

Tools

Remediation Guide

Requirement Statement

Implement Cryptographic Key Establishment and Management per NIST SP 800-171 Rev 3.

Supplemental Guidance

Cryptographic keys can be established and managed using either manual procedures or automated mechanisms supported by manual procedures. Organizations satisfy key establishment and management requirements in accordance with applicable federal laws, Executive Orders, policies, directives, regulations, and standards that specify appropriate options, levels, and parameters. This requirement is related to 03.13.11.

Risk Assessment

CWE Categories

References

• NIST SP 800-171 Rev 3
• NIST SP 800-171A Rev 3 (Assessment)
• CMMC Model Overview
• NIST OSCAL Content

Checklist

• SSP documents Cryptographic Key Establishment and Management (03.13.10) implementation
• Evidence of operating effectiveness collected
• POA&M addresses any gaps
• CMMC assessment objective met
• Continuous monitoring active