The key management part of the cryptographic policy must govern keys across their whole lifecycle: generation, renewal, storage, backup, archiving, retrieval, transmission, retirement, revocation and destruction. The entity must apply controls, designed from the data classification and risk assessment, that protect keys against loss, unauthorised access, disclosure and modification; have methods to replace lost, compromised or damaged keys; keep an up to date register of all certificates and certificate-storing devices at least for assets supporting critical or important functions; and renew certificates promptly before they expire.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.