Framework
Cryptographic Key Lifecycle Management Framework
This framework establishes the strategic governance, lifecycle controls, and operational standards for managing cryptographic keys across the organization's IT, OT, cloud, and BASC-certified trade environments. It defines a unified structure for key generation, distribution, storage, rotation, revocation, and destruction, aligned with NIST SP 800-57 and ISO/IEC 27002:2022 §8.24, and applicable to BASC-certified and WCO SAFE trade environments (which prescribe no cryptographic standard of their own).
- Type
- Framework
- Version
- 1.10.0
- Date
- 2026-10-15
- Owner
- Chief Information Security Officer
- Approving authority
- Chief Information Officer
- Classification
- Public
- Confidentiality
- Public
- Category
- Information Security
- Review frequency
- Annual and upon material cryptographic standard or regulatory change
- Licence
- CC BY-SA 4.0
Read the full text on GitHub (opens in a new tab)
Outline
- Purpose
- Scope
- 1. Key lifecycle phases
- 2. Key management controls
- 3. Key lifecycle register (KLR)
- 4. Governance and accountability
- 5. Sector-programme cryptographic integration
- 6. Post-quantum cryptography transition
- Framework alignment
Frameworks it maps to
- ISO/IEC 27002:2022
- NIST SP 800-57 Part 1 Rev. 5
- NIST SP 800-57 Part 2 Rev. 1
- NIST SP 800-57 Part 3 Rev. 1
- NIST SP 800-208
- NIST FIPS 203 / 204
- NIST FIPS 197-upd1
- NIST FIPS 186-5
- NIST FIPS 180-4
- NIST SP 800-131A Rev. 2
- NIST SP 800-90B
- NIST SP 800-130
- COBIT 2019
- CSA CCM v4.1
- WCO SAFE Framework (2025 edition)
Related documents
- Cryptographic Key Operations Proceduresecurity
- Post-Quantum Cryptography Readiness Roadmapsecurity
- Enterprise Governance and Risk Management Policyrisk
- Supplier Audit Proceduresupply-chain
- Approved Key-Agreement Protocols Registersecurity
Next
All Documents