网络安全 GRC 14 项
HSM & Key Ceremony Review
此检查清单为英文版。
Reviews hardware security module operations and key ceremony procedures covering HSM security, ceremony controls, key lifecycle, and audit evidence.
NIST 800-57FIPS 140-3PCI PIN
免费 PDF 或 Word · 输入邮箱即可下载。
HSM Security
- Is the HSM validated to FIPS 140-2/3 at the required level for its use? *
- Is HSM firmware kept current and authenticated before installation? *
- Is administrative access to the HSM restricted, logged, and role-separated? *
- Is tamper response/zeroization configured and tested? *
Key Ceremony Controls
- Is a documented, scripted ceremony procedure followed and approved in advance? *
- Is dual control and split knowledge enforced for key component custodians? *
- Are ceremony participants, roles, and independent witnesses identified and verified? *
- Is the ceremony conducted in a secure, access-controlled environment? *
Key Lifecycle
- Are keys generated within the HSM using an approved random source? *
- Are key backup, recovery, rotation, and destruction procedures documented and tested? *
- Are cryptographic keys segregated by purpose and environment? *
Audit & Evidence
- Is a signed ceremony log/attestation retained with all participant signatures? *
- Are HSM logs retained and reviewed for unauthorized operations? *
- Is video or independent observation retained for high-assurance ceremonies?
下载完整的HSM & Key Ceremony Review检查清单
免费获取排版清晰、便于打印的 PDF，或可编辑的 Word 文档。