IA-13(1) Protection of Cryptographic Keys
Control enhancement of IA-13 Identity Providers and Authorization Servers
Control
Cryptographic keys that protect access tokens are generated, managed, and protected from disclosure and misuse.
Discussion
Identity assertions and access tokens are typically digitally signed. The private keys used to sign these assertions and tokens are protected commensurate with the impact of the system and information resources that can be accessed.
Related controls
Need IA-13(1) implemented and evidenced?
We assess where you stand against this control, document the gap, and build the remediation plan your auditor and your board will both accept.
Control catalog and framework text on this page is reproduced from official NIST publications — a public-domain work of the U.S. Government (17 U.S.C. §105). Maverc commentary, groupings, and readiness guidance are our own and are not part of any NIST publication.