ADGM FSRA Information Technology Risk Management Guidance (VER01.201124) 13.2: Manage cryptographic keys securely through their lifecycle: generation in secure modules, protected storage and transport, purpose and expiry controls, revocation and destruction, inventory, rotation, compromise response, third-party oversight and logging

What does 13.2 require?

Where the institution administers its own keys, policies cover how keys are securely generated, distributed, used, stored, renewed, revoked, recovered and destroyed. Keys are generated in hardware or software cryptographic modules with strong algorithms, stored in hardware security modules, vaults or secrets management services, never hard-coded or stored with the encrypted data, with backups equally protected and generation ceremonies restricted to necessary competent personnel; keys in use or transit are wrapped or encrypted against tampering and interception; multiparty computation key parts are stored and distributed securely; keys serve their specified purpose for their specified duration with single-use keys never reused and no use beyond expiry; revoked or expired keys cannot be used and are destroyed securely and promptly; a current inventory of generated and procured keys is reviewed regularly; renewal does not let a holder of the old key derive the new one and keys are rotated; a compromise triggers assessment of whether other keys or the scheme are affected, replacement and destruction; third-party key management services are securely configured with due diligence and ongoing oversight; and all key activity is logged, monitored and reviewed.