NIST 800-53 r5 · Controls catalogue · Family SC
SC-12Cryptographic Key Establishment and Management
Establish and manage cryptographic keys when cryptography is employed within the system in accordance with the following key management requirements: {{ insert: param, sc-12_odp }}.
Last updated: 20 August 2026 20:22 UTC
Cumulative inbound coverage
How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.
Collective: partial · 1 mapping(s) from 1 framework(s): OWASP-Web 1 (partial)
Implementations targeting this control (4)
- aws-config-cmk-backing-key-rotation-enabled KMS customer-managed key rotation is enabled AWS::KMS::Key partial protect enforce CIS §3.6Hub KMS.4
- aws-config-eks-cluster-secrets-encrypted EKS cluster encrypts Kubernetes secrets at rest with KMS AWS::EKS::Cluster partial protect enforce
- azure-mcsb-keyvault-key-rotation Key Vault keys have rotation policy configured Microsoft.KeyVault/vaults/keys partial protect enforce
- aws-config-kms-cmk-not-scheduled-for-deletion Kms Cmk Not Scheduled For Deletion AWS::KMS::Key partial protect enforce
ATT&CK techniques this control mitigates (10)
- T1072 Software Deployment Tools Execution, Lateral Movement
- T1098.004 SSH Authorized Keys Persistence, Privilege Escalation
- T1552 Unsecured Credentials Credential Access
- T1552.001 Credentials In Files Credential Access
- T1552.002 Credentials in Registry Credential Access
- T1552.004 Private Keys Credential Access
- T1563.001 SSH Hijacking Lateral Movement
- T1573 Encrypted Channel Command And Control
- T1573.001 Symmetric Cryptography Command And Control
- T1573.002 Asymmetric Cryptography Command And Control
Weaknesses this control addresses (10)AI-assisted
CWEs ranked by how often they appear in real CVEs. The rationale describes how this control reduces exploitability of each weakness class.
| CWE | Name | CVEs | Why this control addresses it |
|---|---|---|---|
CWE-319 | Cleartext Transmission of Sensitive Information | 1,000+ | Key-establishment procedures specify secure distribution channels that preclude cleartext transmission of key material. |
CWE-312 | Cleartext Storage of Sensitive Information | 900+ | Key-management policy requires protected storage of key material, preventing cleartext storage of sensitive cryptographic keys. |
CWE-326 | Inadequate Encryption Strength | 500+ | Establishment procedures require selection and generation of keys with adequate length and strength for the chosen algorithm. |
CWE-330 | Use of Insufficiently Random Values | 400+ | Key generation under controlled management uses approved random-bit sources rather than insufficiently random values. |
CWE-321 | Use of Hard-coded Cryptographic Key | 300+ | Proper key establishment and management processes directly preclude embedding static cryptographic keys in source code or binaries. |
CWE-338 | Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) | 200+ | Cryptographic key management standards require cryptographically strong PRNGs for key material, blocking use of weak generators. |
CWE-331 | Insufficient Entropy | 100+ | Approved key-establishment methods mandate sufficient entropy during key generation, eliminating entropy-starved keys. |
CWE-340 | Generation of Predictable Numbers or Identifiers | 53 | Controlled key-establishment processes produce unpredictable key values instead of values derived from observable or guessable state. |
CWE-324 | Use of a Key Past its Expiration Date | 22 | Key-management requirements enforce lifecycle controls that prevent continued use of expired or superseded keys. |
CWE-332 | Insufficient Entropy in PRNG | 13 | Managed key generation relies on PRNGs seeded and operated with adequate entropy, avoiding the listed weakness. |
Top CVEs where this control is the strongest mitigation
| CVE | Risk | CVSS | EPSS | Match |
|---|---|---|---|---|
CVE-2023-32169 UPD | 9.5 | 9.8 | 0.5606 | good |
CVE-2023-27584 UPD | 8.9 | 9.8 | 0.3361 | good |
CVE-2025-30406 KEV UPD | 8.9 | 9.0 | 0.9384 | good |
CVE-2026-26335 UPD | 7.8 | 9.8 | 0.0281 | good |
CVE-2025-57174 UPD | 7.7 | 9.8 | 0.0219 | good |
CVE-2023-49599 UPD | 7.5 | 9.8 | 0.0096 | good |
CVE-2024-25730 UPD | 7.5 | 9.8 | 0.0086 | good |
CVE-2024-30207 UPD | 7.5 | 10.0 | 0.0084 | good |
CVE-2024-36048 UPD | 7.5 | 9.8 | 0.0097 | good |
CVE-2024-5296 UPD | 7.5 | 9.8 | 0.0112 | good |
CVE-2024-48956 UPD | 7.5 | 9.8 | 0.0086 | good |
CVE-2023-37936 UPD | 7.5 | 9.8 | 0.0100 | good |
CVE-2023-4472 UPD | 7.4 | 9.8 | 0.0062 | good |
CVE-2024-2413 UPD | 7.4 | 9.8 | 0.0057 | good |
CVE-2024-36031 UPD | 7.4 | 9.8 | 0.0075 | good |
CVE-2024-46612 UPD | 7.4 | 9.8 | 0.0063 | good |
CVE-2025-27674 UPD | 7.4 | 9.8 | 0.0068 | good |
CVE-2025-47781 UPD | 7.4 | 9.8 | 0.0060 | good |
CVE-2025-54807 UPD | 7.4 | 9.8 | 0.0073 | good |
CVE-2025-34217 | 7.4 | 9.8 | 0.0070 | good |
CVE-2025-34256 UPD | 7.4 | 9.8 | 0.0068 | good |
CVE-2020-36925 UPD | 7.4 | 9.8 | 0.0060 | good |
CVE-2026-22586 UPD | 7.4 | 9.8 | 0.0061 | good |
CVE-2026-25894 | 7.4 | 9.8 | 0.0076 | good |
CVE-2026-27637 | 7.4 | 9.8 | 0.0067 | good |