Key Destruction

[All Actors]
Applies to all Roles (Baseline) before application of role context.
1. Establish and document policies and procedures for Cryptography, Encryption, and Key Management.

2. Approve the policies and procedures through formal governance processes (e.g., security committee, CISO).

3. Communicate the policies and procedures to all relevant stakeholders.

4. Apply the approved policies and procedures to all systems, services, and processes under the role’s control.

5. Evaluate the effectiveness of policy and procedure implementation using internal audits, technical reviews, 
and encryption control validations.

6. Review and update the policies and procedures at least annually, or when significant system, model, or 
regulatory changes occur.

1. Verify that the CSP defines, implements, and evaluates processes, procedures, and technical measures to destroy cryptographic keys stored outside a secure environment and to revoke keys stored in Hardware Security Modules (HSMs) when they are no longer needed, including those supporting tenant-specific encryption services, multi-tenant key storage, and cloud-native secrets management.

2. Verify that the CSP has a documented policy and process for the secure deletion of cryptographic keys and associated data once they are no longer needed, ensuring compliance with relevant legal, regulatory, and contractual requirements for data and key destruction.

3. Confirm that the CSP defines conditions for key destruction or revocation, including service termination, tenant offboarding, algorithm deprecation, cryptoperiod expiration, or customer request.

4. Verify that cryptographic keys stored outside secure environments (e.g., in configuration backups, unprotected volumes, ephemeral cache) are destroyed using industry-approved techniques (e.g., cryptographic erasure, zeroization), and that destruction is traceable and logged.

5. Review the CSP’s systems and platforms to confirm that ephemeral or deprecated keys are removed from memory, virtual instances, container layers, or local storage as part of shutdown or reallocation workflows.

6. Confirm that keys managed in HSMs or KMS are revoked using controlled interfaces that render the key permanently unusable and record revocation metadata (e.g., reason, timestamp, initiator).

7. Validate that CSP-managed keys used to support AI infrastructure (e.g., for encrypted prompt logs, inference cache, model backups) are destroyed or revoked when the services or storage components they protect are no longer in use.

8. Review destruction and revocation event logs to verify completeness and confirm that metadata includes the key ID, affected service, initiating entity, and destruction method.

9. Confirm that key destruction is a required step in CSP resource decommissioning procedures and is enforced through automation, infrastructure as code (IaC), or security orchestration.

10. Verify that CSP key destruction practices comply with relevant jurisdictional laws, industry standards (e.g., NIST, ISO), and contractual commitments to customers.

11. Confirm that the CSP notifies affected customers or partners (e.g., APs, AICs) when shared or customer-scoped keys are revoked or destroyed, ensuring continuity and avoiding unplanned disruption.

From CCM:
1. Confirm the existence of key destruction processes and procedures.
2. Review the access permissions for the destruction and restoration of keys and confirm that only appropriate individuals have access to these capabilities.
3. Review keys that have been destroyed and ascertain the appropriate process and procedure have been followed.
4. Establish documented criteria that determine when it is appropriate for a cryptographic key to be stored outside a secure environment.