Cloud Cybersecurity Controls – Service Providers (CCC – 2 : 2024) 2-15-P-3

Requirement

In addition to the ECC Subcontrol 2-8-3-2, cybersecurity requirements for key management within the CSP shall cover, at minimum, the following:

Sub-Controls

2-15-P-3-1

Requirement: Ensure well-defined ownership for cryptographic keys.

2-15-P-3-2

Requirement: A secure cryptographic key retrieval mechanism in case of cryptographic key lost (such as backup of keys and enforcement of trusted key storage, strictly external to cloud).

2-15-P-3-3

Requirement: Activating and monitoring of all audit trails of keys.

References

ECC – 2:2024 equivalent: 2-8-3-2

Need help putting this into practice? See our NCA CCC compliance services.

See LakeRidge in action.

Talk with our team about your framework, your gaps, and the right plan.

Get a demo