Part 1: General - Computer Security Resource Center - National ...

March, 2007
to be saved. Keys for the authentication of stored or transmitted information may also
need to be saved.
2. How and where the keying material would be saved? For example, the keying material
could be stored in a safe by the individual who initiates the protection of the information
(e.g., the encrypted information), or the keying material could be saved automatically
when the protected information is transmitted, received or stored. The keying material
could be saved locally or at some remote site.
3. Who will be responsible for protecting the KRI? Each individual, organization or suborganization
could be responsible for their own keying material, or an external
organization could perform this function.
4. Who can request key recovery and under what conditions? For example, the individual
who protected the information (i.e., used and stored the KRI) or the organization to which
the individual is assigned could recover the keying material. Legal requirements may
need to be considered. An organization could request the information when the individual
who stored the KRI is not available.
5. Under what conditions could the policy be modified and by whom?
6. What audit capabilities and procedures would be included in the KRS? The policy shall
identify the events to be audited. Auditable events might include KRI requests and their
associated responses; who made a request and when; the startup and shutdown of audit
functions; the operations performed to read, modify or destroy the audit data; requests to
access user authentication data; and the uses of authentication mechanisms.
7. How the KRS would deal with aged keying material or the destruction of the keying
material?
8. Who would be notified when keying material is recovered and under what conditions?
For example, the individual who encrypted data and stored the KRI could be notified
when the organization recovers the decryption key because the person is absent, but the
individual might not be notified when the organization is monitoring the activities of that
individual.
9. The procedures that need to be followed when the KRS or some portion of the data
within the KRS is compromised.
138