Establish a mechanism or put a procedure in place for key and/or data recovery to prevent loss of data if the user losses the encryption key.

Part of SRC-EPT-600 Key and data recovery process

Associated with IA controls: ECSC-1

SV-6818r1_rule Establish a mechanism or put a procedure in place for key and/or data recovery to prevent loss of data if the user losses the encryption key.

Vulnerability discussion

Without a mechanism for key recovery, any data that was encrypted with the key could be lost.

Check content

Interview the IAO to verify data loss prevention procedures for encrypted data on remote access devices. These procedures may be as simple as a requirement for users to backup or an automated backup to an unencrypted folder on the network. Alternative but more expensive methods are third party key storage and multiple key access. If procedures do not exist for key or data recovery, this is a finding.

Fix text

Develop a recovery plan for key recovery or data recovery in the event of a lost key.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.