Key Purpose

[All Actors]
Applies to all Roles (Baseline) before application of role context.
1. Establish and document policies and procedures for Cryptography, Encryption, and Key Management.

2. Approve the policies and procedures through formal governance processes (e.g., security committee, CISO).

3. Communicate the policies and procedures to all relevant stakeholders.

4. Apply the approved policies and procedures to all systems, services, and processes under the role’s control.

5. Evaluate the effectiveness of policy and procedure implementation using internal audits, technical reviews, 
and encryption control validations.

6. Review and update the policies and procedures at least annually, or when significant system, model, or 
regulatory changes occur.

1. Verify that the CSP assigns cryptographic keys and secrets (e.g., tenant keys, HSM-stored credentials, API tokens) to a unique purpose (e.g., encryption, signing, authentication) and that purpose separation is enforced across cloud services, secret management systems, and cryptographic APIs.

2. Confirm that each key and secret is mapped to its intended function (e.g., volume encryption, TLS, identity verification) and that this mapping is documented, reviewed periodically, and integrated into key management systems.

3. Verify that technical and procedural controls prevent the reuse of a single key or secret for multiple cryptographic purposes across different cloud services or layers.

4. Review cryptographic service configurations (e.g., KMS, HSM policies) to ensure that key and secret usage is restricted to their assigned purpose within compute, storage, or networking scopes.

5. Confirm that access to purpose-bound keys and secrets is limited to authorized personnel, services, or systems based on their designated function and aligned with the principle of least privilege.

6. Validate that secrets and keys used in AI-related services (e.g., encrypted inference logs, signed outputs, model container authentication) are provisioned for distinct functions and not shared across services or tenants.

7. Review whether key and secret metadata includes attributes (e.g., tags, labels, purpose descriptors) that specify intended use and that enforcement of these attributes is implemented across cloud key management and monitoring tools.

8. Confirm that infrastructure-as-code (IaC), orchestration templates, and cloud deployment scripts enforce key and secret purpose separation, rejecting configurations that apply multi-use materials.

9. Verify that logging and audit mechanisms capture purpose-related usage metadata and detect any misuse of keys or secrets outside their defined function, with alerting or remediation triggers in place.

10. Validate that keys or secrets exposed to upstream or downstream parties (e.g., APs, AICs) are purpose-scoped and contractually or technically restricted from being reused for unrelated tasks or services.

From CCM:

1. Obtain copies of the policy and procedures detailing the management of secret and private cryptographic keys.
2. Identify cryptographic secret and private keys that have been provisioned for a unique purpose.
3. Ascertain that these keys are being managed in accordance with policy and procedures.