NIST 800-53 r5 · Controls catalogue · Family SC
SC-12Cryptographic Key Establishment and Management
Establish and manage cryptographic keys when cryptography is employed within the system in accordance with the following key management requirements: {{ insert: param, sc-12_odp }}.
Last updated: 04 July 2026 00:28 UTC
Cumulative inbound coverage
How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.
Collective: mostly · 18 mapping(s) from 3 framework(s): ASVS 5.0 14 (mostly) · CSF 2.0 3 (mostly) · OWASP-Web 1 (partial)
Implementations targeting this control (4)
- aws-config-cmk-backing-key-rotation-enabled KMS customer-managed key rotation is enabled AWS::KMS::Key partial protect enforce CIS §3.6Hub KMS.4
- aws-config-eks-cluster-secrets-encrypted EKS cluster encrypts Kubernetes secrets at rest with KMS AWS::EKS::Cluster partial protect enforce
- azure-mcsb-keyvault-key-rotation Key Vault keys have rotation policy configured Microsoft.KeyVault/vaults/keys partial protect enforce
- aws-config-kms-cmk-not-scheduled-for-deletion Kms Cmk Not Scheduled For Deletion AWS::KMS::Key partial protect enforce
ATT&CK techniques this control mitigates (10)
- T1072 Software Deployment Tools Execution, Lateral Movement
- T1098.004 SSH Authorized Keys Persistence, Privilege Escalation
- T1552 Unsecured Credentials Credential Access
- T1552.001 Credentials In Files Credential Access
- T1552.002 Credentials in Registry Credential Access
- T1552.004 Private Keys Credential Access
- T1563.001 SSH Hijacking Lateral Movement
- T1573 Encrypted Channel Command And Control
- T1573.001 Symmetric Cryptography Command And Control
- T1573.002 Asymmetric Cryptography Command And Control
Weaknesses this control addresses (10)AI
CWEs ranked by how often they appear in real CVEs. The rationale describes how this control reduces exploitability of each weakness class.
| CWE | Name | CVEs | Why this control addresses it |
|---|---|---|---|
CWE-319 | Cleartext Transmission of Sensitive Information | 1,076 | Key-establishment procedures specify secure distribution channels that preclude cleartext transmission of key material. |
CWE-312 | Cleartext Storage of Sensitive Information | 935 | Key-management policy requires protected storage of key material, preventing cleartext storage of sensitive cryptographic keys. |
CWE-326 | Inadequate Encryption Strength | 520 | Establishment procedures require selection and generation of keys with adequate length and strength for the chosen algorithm. |
CWE-330 | Use of Insufficiently Random Values | 431 | Key generation under controlled management uses approved random-bit sources rather than insufficiently random values. |
CWE-321 | Use of Hard-coded Cryptographic Key | 302 | Proper key establishment and management processes directly preclude embedding static cryptographic keys in source code or binaries. |
CWE-338 | Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) | 224 | Cryptographic key management standards require cryptographically strong PRNGs for key material, blocking use of weak generators. |
CWE-331 | Insufficient Entropy | 149 | Approved key-establishment methods mandate sufficient entropy during key generation, eliminating entropy-starved keys. |
CWE-340 | Generation of Predictable Numbers or Identifiers | 48 | Controlled key-establishment processes produce unpredictable key values instead of values derived from observable or guessable state. |
CWE-324 | Use of a Key Past its Expiration Date | 20 | Key-management requirements enforce lifecycle controls that prevent continued use of expired or superseded keys. |
CWE-332 | Insufficient Entropy in PRNG | 13 | Managed key generation relies on PRNGs seeded and operated with adequate entropy, avoiding the listed weakness. |
Top CVEs where this control is the strongest mitigation
| CVE | Risk | CVSS | EPSS | Match |
|---|---|---|---|---|
CVE-2025-3935 KEV UPD | 10.0 | 8.1 | 0.0329 | good |
CVE-2023-27524 KEV | 10.0 | 8.9 | 0.9740 | good |
CVE-2019-6693 KEV | 10.0 | 6.5 | 0.0566 | good |
CVE-2019-18988 KEV | 10.0 | 7.0 | 0.0475 | good |
CVE-2017-9248 KEV | 10.0 | 9.8 | 0.7510 | good |
CVE-2016-4437 KEV | 10.0 | 9.8 | 0.9314 | good |
CVE-2023-34039 | 8.0 | 9.8 | 0.6395 | good |
CVE-2025-67112 | 7.0 | 9.8 | 0.0040 | good |
CVE-2026-26335 | 7.0 | 9.8 | 0.0281 | good |
CVE-2025-34256 | 7.0 | 9.8 | 0.0059 | good |
CVE-2025-15016 | 7.0 | 9.8 | 0.0045 | good |
CVE-2025-59407 | 7.0 | 9.8 | 0.0052 | good |
CVE-2025-15618 | 7.0 | 9.1 | 0.0033 | good |
CVE-2025-30095 | 7.0 | 9.0 | 0.0048 | good |
CVE-2026-23958 | 7.0 | 9.8 | 0.0047 | good |
CVE-2025-57174 | 7.0 | 9.8 | 0.0122 | good |
CVE-2025-41702 UPD | 7.0 | 9.8 | 0.0049 | good |
CVE-2025-34198 | 7.0 | 9.8 | 0.0075 | good |
CVE-2025-55619 UPD | 7.0 | 9.8 | 0.0038 | good |
CVE-2025-44963 UPD | 7.0 | 9.0 | 0.0059 | good |
CVE-2022-34045 | 7.0 | 9.8 | 0.0242 | good |
CVE-2024-55557 | 7.0 | 9.8 | 0.0134 | good |
CVE-2023-33242 | 7.0 | 9.6 | 0.0109 | good |
CVE-2022-20866 | 6.0 | 7.4 | 0.1665 | good |
CVE-2025-13316 | 5.5 | 8.1 | 0.0265 | good |