Where can organizations find standards for key-management practices, such as guidance from NIST?

Where can organizations find standards for key-management practices, such as guidance from NIST?

• A. NIST Special Publication 800-57.
• B. ISO 27001.
• C. PCI DSS Section 3.
• D. COBIT 5.

Answer: (A)

Key-management practices are most thoroughly covered by NIST Special Publication 800-57. This publication provides formal recommendations for cryptographic key management, detailing how keys should be generated, stored, distributed, used, rotated, and retired, and how these activities fit into a cryptographic module and overall security architecture. ISO 27001 offers an information security management system framework but does not give the detailed key-management guidance found in NIST. PCI DSS focuses on protection of cardholder data and includes encryption and key-management requirements, but it’s specific to payment environments rather than a broad set of key-management standards. COBIT 5 is a governance framework and does not provide the technical standards for key management.

Key-management practices are most thoroughly covered by NIST Special Publication 800-57. This publication provides formal recommendations for cryptographic key management, detailing how keys should be generated, stored, distributed, used, rotated, and retired, and how these activities fit into a cryptographic module and overall security architecture. ISO 27001 offers an information security management system framework but does not give the detailed key-management guidance found in NIST. PCI DSS focuses on protection of cardholder data and includes encryption and key-management requirements, but it’s specific to payment environments rather than a broad set of key-management standards. COBIT 5 is a governance framework and does not provide the technical standards for key management.