Monetary Authority of Singapore Technology Risk Management Guidelines 10.2: 10.2 Cryptographic Key Management

Key management policy, standards and procedures should cover generation, distribution, installation, renewal, revocation, recovery and expiry. Keys should be generated securely and protected from disclosure, with material used to derive them protected or destroyed; each key should have a lifespan set by data sensitivity, system criticality and threats and be replaced before expiry; sensitive keys should be managed in hardened, tamper-resistant systems such as hardware security modules; keys in transit should not be exposed and should travel out of band or by other secure means; keys should serve a single purpose; compromised keys and any keys affected by them should be revoked and replaced; expired or revoked keys should be destroyed irrecoverably; new keys should not be derivable from knowledge of the old; and keys should be backed up with a high level of protection.