GRC Cybersécurité 14 points
HSM & Key Ceremony Review
Cette liste de contrôle est en anglais.
Reviews hardware security module operations and key ceremony procedures covering HSM security, ceremony controls, key lifecycle, and audit evidence.
NIST 800-57FIPS 140-3PCI PIN
PDF ou Word gratuit · saisissez votre e-mail pour le télécharger.
HSM Security
- Is the HSM validated to FIPS 140-2/3 at the required level for its use? *
- Is HSM firmware kept current and authenticated before installation? *
- Is administrative access to the HSM restricted, logged, and role-separated? *
- Is tamper response/zeroization configured and tested? *
Key Ceremony Controls
- Is a documented, scripted ceremony procedure followed and approved in advance? *
- Is dual control and split knowledge enforced for key component custodians? *
- Are ceremony participants, roles, and independent witnesses identified and verified? *
- Is the ceremony conducted in a secure, access-controlled environment? *
Key Lifecycle
- Are keys generated within the HSM using an approved random source? *
- Are key backup, recovery, rotation, and destruction procedures documented and tested? *
- Are cryptographic keys segregated by purpose and environment? *
Audit & Evidence
- Is a signed ceremony log/attestation retained with all participant signatures? *
- Are HSM logs retained and reviewed for unauthorized operations? *
- Is video or independent observation retained for high-assurance ceremonies?
Téléchargez la liste de contrôle HSM & Key Ceremony Review complète
Obtenez-la gratuitement en PDF propre et imprimable, ou en document Word modifiable.