Key management is the set of policies, procedures, and technology for handling cryptographic keys across their full lifecycle: generation, distribution, storage, rotation, and destruction. Get any one stage wrong and the strongest algorithm stops protecting anything.
Keys start with a secure random source, move through protected channels, and live in hardware security modules (HSMs) or key vaults rather than a config file. They rotate on a schedule and are destroyed when retired. The point worth internalizing is that the math is rarely the weak link. An AES-256 deployment offers nothing if the key sits in plaintext next to the data or gets emailed to a contractor. Enterprise key management systems centralize this control, enforce policy, and produce the audit trail compliance auditors ask for. Most cryptographic failures in the real world are key handling failures, not broken ciphers.
Why does key management matter for the CISSP exam?
Domain 3: Security Architecture and Engineering treats key management as central to any cryptographic system. Know the lifecycle stages, secure generation, storage in HSMs and vaults, rotation, and secure destruction. NIST lays out the full picture in SP 800-57 Part 1.
Related terms: Encryption, PKI