Independent DIB implementation resource — not affiliated with or endorsed by the U.S. Department of WarView the official DoW campaign ↗
Brilliant at the BasicsDIB Resource Center
3.13.10OFFICIAL STATEMENT BELOWDERIVED REQUIREMENTPENDING NIST SME REVIEW

3.13.10 — Cryptographic key management

3.13 System and Communications Protection · NIST SP 800-171 Rev. 2 · The heading label is this site's navigational shorthand; the official language is the statement below.

Official requirement statement (verbatim)

Establish and manage cryptographic keys for cryptography employed in organizational systems.

NIST SP 800-171 Rev. 2 — Protecting CUI in Nonfederal Systems ↗NIST SP 800-171A — Assessing Security Requirements for CUI ↗
Independent interpretation

What this requirement is after

Cryptography is only as strong as the key handling behind it. Keys are generated, stored, distributed, rotated, and destroyed under a deliberate process — not left as an unmanaged by-product of switching encryption on.

Mapped practices

Brilliant at the Basics practices that support this requirement

No practice maps to this requirement — deliberately.

The campaign’s twenty practices are a priority list, not a control catalog, and none of them works this requirement’s substance directly. It still applies to you if it is in your contract’s scope: address it through your own implementation and the related artifacts below, and treat the absence of a mapping here as honesty, not permission to skip it.

Doing the work

Implementation considerations and evidence

Implementation considerationsIndependent guidance — tailor to your environment
  • Inventory where keys and certificates actually live: TLS certificates, disk-encryption recovery keys, VPN pre-shared keys, code-signing keys, and KMS-managed keys in cloud tenants.
  • Platform key management — cloud KMS, OS certificate stores, BitLocker with recovery-key escrow — carries most small-organization cases; the requirement is that somebody owns the process and expiry never arrives as a surprise.
What operating evidence looks likeRecords worth retaining, not a submission checklist
  • A key and certificate inventory with owners and expiry dates
  • Documented procedures for issuance, rotation, escrow, and revocation
Artifacts

Templates and worksheets with a mapped relationship

No artifact in the library names this requirement yet. The library index groups everything by category and practice.

The other revision

Where this lands in Rev. 3

Provenance

Sources and review status

Primary sourcesNIST SP 800-171 Rev. 2 — Protecting CUI in Nonfederal Systems · NIST SP 800-171A — Assessing Security Requirements for CUI
Review statusPending NIST SME review
Content version1.0
Updated