SC.L2-3.13.10
Key Management
Source and approval
CMMC Assessment Guide — Level 2 · Revision 2.13
Publisher approved · Complete cited source edition 2026-10-31
Read the official guideSee SC.L2-3.13.10 in the reference catalog with its NIST cross-references
Official requirement
Establish and manage cryptographic keys for cryptography employed in organizational systems.
Assessment objectives
a. cryptographic keys are established whenever cryptography is employed; and
b. cryptographic keys are managed whenever cryptography is employed.
Implementation guidance
Editorial examples to help you plan. Adapt them to your environment; the official requirement and objectives remain authoritative.
In plain language
Establish and manage cryptographic keys used for system cryptography.
Implementation example
Example from the source assessment guide (not a mandatory implementation): You are a system administrator responsible for providing key management. You have generated a public -private key pair to exchange CUI [a]. You require all system administrators to read the key management policy before you allow them to install the private key on their machines [b]. No one else is allowed to know or have a copy of the private key per the policy. You provide the public key to the other parties who will be sending you CUI and test the Public Key Infrastructure (PKI) to ensure the encryption is working [a]. You set a revocation period of one year on all your certificates per organizational policy [b]. Example 2 You encrypt all of your company’s computers using the disk encryption utility built into the operating system. As you configure encryption on each device, it generates a cryptographic key. You associate each key with the correct computer in your inventory spreadsheet and restrict access to the spreadsheet to the system administ rators whose work role requires them to manage the computers [b].
Evidence examples
Examples suggested by the source guide (not an exhaustive or mandatory checklist): System and communications protection policy; procedures addressing cryptographic key establishment and management; system security plan; system design documentation; cryptographic mechanisms; system configuration settings and associated documentation; system audit logs and records; other relevant documents or records
Common mistakes
Selecting encryption without managing key creation, distribution, storage, replacement, and retirement.