SC.2.010 — Establish and Manage Cryptographic Keys

What SC.2.010 means in plain English

If you are using encryption (and you should be), you need to manage the keys properly. BitLocker recovery keys, TLS certificate private keys, VPN keys — they all need to be stored securely and you need to know where they are. Do not leave recovery keys on sticky notes. Store them in a password manager or a secure, backed-up location. When keys expire or are compromised, replace them. Keep a simple inventory of what keys you have and where they are stored.

The assessment question

“Do you maintain an inventory of cryptographic keys used in your environment (BitLocker, TLS, VPN) with secure storage, defined lifetimes, and procedures for key rotation and revocation?”

How to implement SC.2.010

1. Create a cryptographic key inventory spreadsheet: key type (BitLocker, TLS cert, VPN key), associated system, creation date, expiration date, storage location, and responsible person.
2. Store BitLocker recovery keys in Microsoft 365 Azure AD (automatic with Intune) or in a secure, encrypted document in your password manager. Never store them in plain text on the same machine.
3. Set calendar reminders for TLS certificate renewals — most certificates expire annually. Consider Let's Encrypt with auto-renewal to avoid surprise expirations.
4. For VPN keys, document where the server key is stored and ensure it has restricted file permissions. Rotate VPN keys annually or if a compromise is suspected.

Evidence your assessor will ask for

• Cryptographic key inventory listing all keys, their types, and storage locations
• Evidence of secure key storage (Azure AD for BitLocker, password manager for others)
• Key rotation or renewal records showing keys are managed within their lifetimes
• Written key management procedure describing generation, storage, rotation, and revocation

More System and Communications Protection controls