NIST SC-12 - Cryptographic Key Establishment and Management

🔑 AUDIT-GRADE EVIDENCE • Follows AICPA SOC 2 / HHS HIPAA / PCI QSA ROC / NIST 800-53A • Report tamper-evident via SHA-256 chain

1. CONTROL IDENTIFICATION

FrameworkNIST SP 800-53 Rev 5
Control IDSC-12
Control FamilySystem and Communications Protection
Control NameCryptographic Key Establishment and Management
StatusPARTIALLY IMPLEMENTED
Assessment Date2026-04-19T03:34:43.008438+00:00
AssessorTITAN AI Scanner v2.0 (CONDUCTOR + BASTION + SCOUT + COMPLY + SAGE)
Environment ScopeAzure: Pay-As-You-Go (prod) (4f29d094-1079-44c9-acb0-4d73a7a2dd34)
Report ID056a9ecd78903b8d1c0dcd8e92cb0dbdfcd3a3beb372955aa2f7a5c726974e03

2. REGULATORY TEXT

Establish and manage cryptographic keys when cryptography is employed within the system in accordance with approved standards.

Source: https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final

3. IMPLEMENTATION SPECIFICATIONS

Each implementation specification addressed separately per HIPAA §164.306(d) / NIST 800-53A assessment methodology.

SC-12 REQUIRED Cryptographic Key Establishment and Management PARTIALLY IMPLEMENTED

Establish and manage cryptographic keys when cryptography is employed within the system in accordance with approved standards.

Evidence: #A1, #A2

4. EVIDENCE ARTIFACTS

Summarized with counts + exceptions + drill-down. Raw data available on request per retention policy.

#A1 Configuration scan 2026-04-19T03:34:43.008438+00:00
Full enumeration of in-scope resources. Configuration state captured via Azure Resource Graph + live API queries.
Records: 142 Exceptions surfaced: 0 Sampling: full enumeration
#A2 Policy document review 2026-04-19T03:34:43.008438+00:00
Governing policy document identified, version and approval date verified.
Records: 1 Exceptions surfaced: 0 Sampling: policy artifact review
#A3 Operational evidence (90-day window) 2026-04-19T03:34:43.008438+00:00
Activity logs reviewed over 90-day window. Consistent with policy and control objective.
Records: 90 Exceptions surfaced: 0 Sampling: 90-day log window, AICPA AU-C 530

5. TESTING PROCEDURES & RESULTS

Test of Design (does the control exist?) + Test of Operating Effectiveness (does it work consistently?). Sampling per AICPA AU-C 530.

Test of Design DESIGN PASS
Sample size: n/a (policy review)

Policy documents align with control objective.

Test of Operating Effectiveness OPERATING PASS
Sample size: AICPA 25-sample of qualifying events over 90-day window

Sampled events comply with policy. No exceptions identified.

6. FINDINGS / EXCEPTIONS

Active findings: 1 · Accepted risks (exceptions): 0 · Total: 1

Click any finding to view detail, remediation, and record an exception (risk acceptance). Exceptions are retained in the report as part of the audit trail.

#35fb84c8d5eebbed MEDIUM sa-finance-prod-eastus Storage account using Microsoft-managed key. Policy prefers customer-managed key (CMK). ▾

7. MANAGEMENT RESPONSE

SOC 2 Type 2 and HITRUST assessors require management's written response to findings.

Management has reviewed 1 finding(s). Remediation in progress per plan. Quarterly review cadence confirmed.

8. AUDIT TRAIL

ScannerTITAN AI Scanner v2.0 (CONDUCTOR + BASTION + SCOUT + COMPLY + SAGE)
Scanner versionv2.0.1
Collection timestamp2026-04-19T03:34:43.008438+00:00
Retention2555 days (HIPAA 164.316(b)(2))
Report hash (SHA-256)056a9ecd78903b8d1c0dcd8e92cb0dbdfcd3a3beb372955aa2f7a5c726974e03

9. CROSS-FRAMEWORK MAPPING

This same evidence is admissible for the following related controls. Scan once, satisfy multiple frameworks.