Key Compromise

[All Actors]
Applies to all Roles (Baseline) before application of role context
1. Establish and document policies and procedures for Cryptography, Encryption, and Key Management.

2. Approve the policies and procedures through formal governance processes (e.g., security committee, CISO).

3. Communicate the policies and procedures to all relevant stakeholders.

4. Apply the approved policies and procedures to all systems, services, and processes under the role’s control.

5. Evaluate the effectiveness of policy and procedure implementation using internal audits, technical reviews, 
and encryption control validations.

6. Review and update the policies and procedures at least annually, or when significant system, model, or 
regulatory changes occur.

1. Verify that the CSP defines, implements, and evaluates processes, procedures, and technical measures for handling compromised cryptographic keys, including provisions for legal and regulatory requirements.

2. Verify that the CSP's incident response plan includes documented steps for handling compromised keys, ensuring that the keys are restricted to decryption, securely revoked, and that they cannot be reused for encryption. Confirm that the CSP’s incident response procedures comply with relevant legal and regulatory requirements for key management in the event of a compromise.

3. Confirm that the CSP restricts use of compromised keys to decrypt-only operations under controlled circumstances (e.g., legacy storage layer decryption, cloud log retrieval), and explicitly prohibits further encryption with such keys unless formally approved.

4. Review how compromised keys are detected and flagged in cloud-native key management systems (e.g., KMS, HSM) or related infrastructure.

5. Validate that compromised keys are logically segregated from active key inventories and cannot be used in cloud service encryption workflows.

6. Confirm that access to compromised keys is restricted to authorized cloud security or incident response teams, with access governed by elevated approvals and role-based controls.

7. Review audit logs and monitoring tools to ensure all access and usage of compromised keys is tracked and includes metadata such as reason for access, user identity, and affected systems.

8. Verify that decrypt-only operations using compromised keys are documented and retained for audit purposes, including justification and linkage to security event records.

9. Confirm that CSP practices for managing compromised keys include applicable regulatory obligations (e.g., GDPR breach response, HIPAA encryption standards, FedRAMP handling procedures).

10. Validate that AI-specific keys (e.g., encrypting model logs, prompt storage, inference results) are included in compromised key handling protocols and subject to decrypt-only restrictions when compromised.

11. Review whether the CSP coordinates with upstream providers (e.g., hardware vendors, cryptographic library maintainers) and downstream consumers (e.g., APs, AICs) to contain key compromise risks and communicate key status changes or transitions.

From CCM:
1. Examine if the organization has defined processes, procedures, and technical measures for secure handling of compromised keys.
2. Review if the process for secure usage of compromised keys fulfills the organization and external business / operational continuity requirements.
3. Evaluate the significance of technical and organizational measures defined and implemented for usage of compromised keys in a secure environment.