Re: [PATCH 05/21] Mapped CCI-001140 to requirement_unclear.

On 7/3/12 6:52 PM, Willy Santos wrote: SRG-OS-000165 CCI-001140 The operating system must produce, control, and distribute symmetric cryptographic keys using NIST-approved or NSA-approved key management technology and processes. Cryptographic key management and establishment can be performed using manual procedures or automated mechanisms with supporting manual procedures. In addition to being required for the effective operation of a cryptographic mechanism, effective cryptographic key management provides protections to maintain the availability of the information in the event of the loss of cryptographic keys by users. This maps back to actual NIST controls here: http://web.nvd.nist.gov/view/800-53/control?controlName=SC-12 (skip to the "800-53A Information for Control SC-12" section). The accepted evaluation of this control is to examine /procedures/. I would map this to new_rule_needed, and that rule should say to follow NIST 800-56A and NIST 800-57 for approved key management processes. Yeah, it's a cop out to say "go follow this other policy," but I'm OK with that as it (a) points the users to official processes, and (b) gives us time to detail this out in future versions of the guide.