Aspects
1
Controls
2
Requirements
4
| Aspect ID | Aspect Name | Control ID | Control Name | Requirement ID | Requirement | Level |
|---|---|---|---|---|---|---|
| 2.04 | Key Compromise Documentation | 2.04.1 | Key Compromise Policy Existence | 2.04.1.1 | An inventory of all key material exists and the entity has an awareness of which key material is critical to the successful operation of the CCSS Trusted Environment. | Level I |
| 2.04 | Key Compromise Documentation | 2.04.1 | Key Compromise Policy Existence | 2.04.1.2 | A Key Compromise Policy and procedures are documented. The following is addressed: 1. Each specific classification of key material used throughout the CCSS Trusted Environment. 2. A detailed plan of dealing with its compromise that includes the use of Approved Communication Channels during execution. 3. Identities of actors via roles (not names), and includes secondary actors in the event any primary actor is unavailable to carry out the KCP. | Level I |
| 2.04 | Key Compromise Documentation | 2.04.1 | Key Compromise Policy Existence | 2.04.1.3 | The key material inventory is reviewed at least annually to ensure that all key material has been recorded and that the recorded information for key material is accurate and up-to-date. | Level II |
| 2.04 | Key Compromise Documentation | 2.04.2 | Key Compromise Policy Training and Rehearsals | 2.04.2.1 | The Key Compromise Policy and procedures are tested at least annually to ensure their viability and to ensure personnel remain trained to use them in the event of a compromise. The following is addressed: 1. The testing exercise is documented and includes the attendees, scenarios tested, outcomes of testing, remediation required, actions, and the next testing date. 2. Any improvements identified from the test are updated in the Key Compromise Policy and procedures. 3. The testing includes ensuring backup(s) containing key material are reviewed and tested where applicable. 4. Any changes to the system's people, processes, and technology components trigger a test of the Key Compromise Policy and procedures. | Level III |
Page 1 of 1