Library / CEK

CEK

Cryptography, Encryption & Key Management

Domain definition — mapping in progress (source: AI Controls Matrix (AICM) Introductory Guidance).

Control objectives

Skills

—

Cross-cutting

—

Objectives fitted

AISMM maturity context

Data Security · Structural domain

L1 InitialL2 RepeatableL3 DefinedL4 CapableL5 Efficient

A lens, not a partition. How AISMM adoption works →

Control objectives

The exact things this domain must do. Each carries an authoritative crosswalk to 9 external control sets (Cloud Security Alliance (CSA) AI Controls Matrix (AICM) v1.1.0). Fitted skills are drawn from the pool below as fits are evidenced.

Encryption and Key Management Policy and ProceduresCEK-01

Crosswalk

ISO/IEC 42001EU AI ActBSI AIC4CCM v4.0.13AICPA TSC 2017ISO/IEC 27001:2022ISO/IEC 27002:2022NIST 800-53 rev 5NIST CSF v2.0

Implementation & auditing guidance

Shared implementation — 6 steps

Cloud Service Provider — 10 steps

Application Provider — 8 steps

Model Provider — 8 steps

Orchestrated Services Provider — 8 steps

Verbatim Cloud Security Alliance (CSA) implementation & auditing steps are available to the owner.

Fitted skill — mapping in progress. Candidates are drawn from this domain’s skill pool below.

CEK Roles and ResponsibilitiesCEK-02

Crosswalk

ISO/IEC 42001EU AI ActBSI AIC4CCM v4.0.13AICPA TSC 2017ISO/IEC 27001:2022ISO/IEC 27002:2022NIST 800-53 rev 5NIST CSF v2.0

Implementation & auditing guidance

Shared implementation — 6 steps

Cloud Service Provider — 12 steps

Application Provider — 10 steps

Model Provider — 10 steps

Orchestrated Services Provider — 10 steps

Verbatim Cloud Security Alliance (CSA) implementation & auditing steps are available to the owner.

Fitted skill — mapping in progress. Candidates are drawn from this domain’s skill pool below.

Data ProtectionCEK-03

Crosswalk

ISO/IEC 42001EU AI ActBSI AIC4CCM v4.0.13AICPA TSC 2017ISO/IEC 27001:2022ISO/IEC 27002:2022NIST 800-53 rev 5NIST CSF v2.0

Implementation & auditing guidance

Shared implementation — 6 steps

Cloud Service Provider — 13 steps

Application Provider — 12 steps

Model Provider — 12 steps

Orchestrated Services Provider — 12 steps

Verbatim Cloud Security Alliance (CSA) implementation & auditing steps are available to the owner.

Fitted skill — mapping in progress. Candidates are drawn from this domain’s skill pool below.

Encryption AlgorithmCEK-04

Crosswalk

ISO/IEC 42001EU AI ActBSI AIC4CCM v4.0.13AICPA TSC 2017ISO/IEC 27001:2022ISO/IEC 27002:2022NIST 800-53 rev 5NIST CSF v2.0

Implementation & auditing guidance

Shared implementation — 6 steps

Cloud Service Provider — 13 steps

Application Provider — 10 steps

Model Provider — 10 steps

Orchestrated Services Provider — 10 steps

Verbatim Cloud Security Alliance (CSA) implementation & auditing steps are available to the owner.

Fitted skill — mapping in progress. Candidates are drawn from this domain’s skill pool below.

Encryption Change ManagementCEK-05

Crosswalk

ISO/IEC 42001EU AI ActBSI AIC4CCM v4.0.13AICPA TSC 2017ISO/IEC 27001:2022NIST 800-53 rev 5NIST CSF v2.0

Implementation & auditing guidance

Shared implementation — 6 steps

Cloud Service Provider — 13 steps

Application Provider — 10 steps

Model Provider — 10 steps

Orchestrated Services Provider — 10 steps

Verbatim Cloud Security Alliance (CSA) implementation & auditing steps are available to the owner.

Fitted skill — mapping in progress. Candidates are drawn from this domain’s skill pool below.

Encryption Change Cost Benefit AnalysisCEK-06

Crosswalk

ISO/IEC 42001EU AI ActBSI AIC4CCM v4.0.13AICPA TSC 2017ISO/IEC 27001:2022NIST 800-53 rev 5NIST CSF v2.0

Implementation & auditing guidance

Shared implementation — 6 steps

Cloud Service Provider — 13 steps

Application Provider — 10 steps

Model Provider — 10 steps

Orchestrated Services Provider — 10 steps

Verbatim Cloud Security Alliance (CSA) implementation & auditing steps are available to the owner.

Fitted skill — mapping in progress. Candidates are drawn from this domain’s skill pool below.

Encryption Risk ManagementCEK-07

Crosswalk

ISO/IEC 42001EU AI ActBSI AIC4CCM v4.0.13AICPA TSC 2017ISO/IEC 27001:2022NIST 800-53 rev 5NIST CSF v2.0

Implementation & auditing guidance

Shared implementation — 6 steps

Cloud Service Provider — 13 steps

Application Provider — 10 steps

Model Provider — 10 steps

Orchestrated Services Provider — 10 steps

Verbatim Cloud Security Alliance (CSA) implementation & auditing steps are available to the owner.

Fitted skill — mapping in progress. Candidates are drawn from this domain’s skill pool below.

Service Customer Key Management CapabilityCEK-08

Crosswalk

ISO/IEC 42001EU AI ActBSI AIC4CCM v4.0.13AICPA TSC 2017ISO/IEC 27001:2022NIST 800-53 rev 5NIST CSF v2.0

Implementation & auditing guidance

Shared implementation — 6 steps

Cloud Service Provider — 14 steps

Application Provider — 10 steps

Model Provider — 10 steps

Orchestrated Services Provider — 10 steps

Verbatim Cloud Security Alliance (CSA) implementation & auditing steps are available to the owner.

Fitted skill — mapping in progress. Candidates are drawn from this domain’s skill pool below.

Encryption and Key Management AuditCEK-09

Crosswalk

ISO/IEC 42001EU AI ActBSI AIC4CCM v4.0.13AICPA TSC 2017ISO/IEC 27001:2022NIST 800-53 rev 5NIST CSF v2.0

Implementation & auditing guidance

Shared implementation — 6 steps

Cloud Service Provider — 12 steps

Application Provider — 10 steps

Model Provider — 10 steps

Orchestrated Services Provider — 10 steps

Verbatim Cloud Security Alliance (CSA) implementation & auditing steps are available to the owner.

Fitted skill — mapping in progress. Candidates are drawn from this domain’s skill pool below.

Key GenerationCEK-10

Crosswalk

ISO/IEC 42001EU AI ActBSI AIC4CCM v4.0.13AICPA TSC 2017ISO/IEC 27001:2022ISO/IEC 27002:2022NIST 800-53 rev 5NIST CSF v2.0

Implementation & auditing guidance

Shared implementation — 6 steps

Cloud Service Provider — 13 steps

Application Provider — 10 steps

Model Provider — 10 steps

Orchestrated Services Provider — 10 steps

Verbatim Cloud Security Alliance (CSA) implementation & auditing steps are available to the owner.

Fitted skill — mapping in progress. Candidates are drawn from this domain’s skill pool below.

Key PurposeCEK-11

Crosswalk

ISO/IEC 42001EU AI ActBSI AIC4CCM v4.0.13AICPA TSC 2017ISO/IEC 27001:2022NIST 800-53 rev 5NIST CSF v2.0

Implementation & auditing guidance

Shared implementation — 6 steps

Cloud Service Provider — 13 steps

Application Provider — 10 steps

Model Provider — 10 steps

Orchestrated Services Provider — 10 steps

Verbatim Cloud Security Alliance (CSA) implementation & auditing steps are available to the owner.

Fitted skill — mapping in progress. Candidates are drawn from this domain’s skill pool below.

Key RotationCEK-12

Crosswalk

ISO/IEC 42001EU AI ActBSI AIC4CCM v4.0.13AICPA TSC 2017ISO/IEC 27001:2022ISO/IEC 27002:2022NIST 800-53 rev 5NIST CSF v2.0

Implementation & auditing guidance

Shared implementation — 6 steps

Cloud Service Provider — 13 steps

Application Provider — 10 steps

Model Provider — 10 steps

Orchestrated Services Provider — 10 steps

Verbatim Cloud Security Alliance (CSA) implementation & auditing steps are available to the owner.

Fitted skill — mapping in progress. Candidates are drawn from this domain’s skill pool below.

Key RevocationCEK-13

Crosswalk

ISO/IEC 42001EU AI ActBSI AIC4CCM v4.0.13AICPA TSC 2017ISO/IEC 27001:2022ISO/IEC 27002:2022NIST 800-53 rev 5NIST CSF v2.0

Implementation & auditing guidance

Shared implementation — 6 steps

Cloud Service Provider — 13 steps

Application Provider — 10 steps

Model Provider — 10 steps

Orchestrated Services Provider — 10 steps

Verbatim Cloud Security Alliance (CSA) implementation & auditing steps are available to the owner.

Fitted skill — mapping in progress. Candidates are drawn from this domain’s skill pool below.

Key DestructionCEK-14

Crosswalk

ISO/IEC 42001EU AI ActBSI AIC4CCM v4.0.13AICPA TSC 2017ISO/IEC 27001:2022ISO/IEC 27002:2022NIST 800-53 rev 5NIST CSF v2.0

Implementation & auditing guidance

Shared implementation — 6 steps

Cloud Service Provider — 15 steps

Application Provider — 11 steps

Model Provider — 11 steps

Orchestrated Services Provider — 11 steps

Verbatim Cloud Security Alliance (CSA) implementation & auditing steps are available to the owner.

Fitted skill — mapping in progress. Candidates are drawn from this domain’s skill pool below.

Key ActivationCEK-15

Crosswalk

ISO/IEC 42001EU AI ActBSI AIC4CCM v4.0.13AICPA TSC 2017ISO/IEC 27001:2022ISO/IEC 27002:2022NIST 800-53 rev 5NIST CSF v2.0

Implementation & auditing guidance

Shared implementation — 6 steps

Cloud Service Provider — 16 steps

Application Provider — 10 steps

Model Provider — 10 steps

Orchestrated Services Provider — 10 steps

Verbatim Cloud Security Alliance (CSA) implementation & auditing steps are available to the owner.

Fitted skill — mapping in progress. Candidates are drawn from this domain’s skill pool below.

Key SuspensionCEK-16

Crosswalk

ISO/IEC 42001EU AI ActBSI AIC4CCM v4.0.13AICPA TSC 2017ISO/IEC 27001:2022ISO/IEC 27002:2022NIST 800-53 rev 5NIST CSF v2.0

Implementation & auditing guidance

Shared implementation — 6 steps

Cloud Service Provider — 13 steps

Application Provider — 10 steps

Model Provider — 10 steps

Orchestrated Services Provider — 10 steps

Verbatim Cloud Security Alliance (CSA) implementation & auditing steps are available to the owner.

Fitted skill — mapping in progress. Candidates are drawn from this domain’s skill pool below.

Key DeactivationCEK-17

Crosswalk

ISO/IEC 42001EU AI ActBSI AIC4CCM v4.0.13AICPA TSC 2017ISO/IEC 27001:2022ISO/IEC 27002:2022NIST 800-53 rev 5NIST CSF v2.0

Implementation & auditing guidance

Shared implementation — 6 steps

Cloud Service Provider — 14 steps

Application Provider — 10 steps

Model Provider — 10 steps

Orchestrated Services Provider — 10 steps

Verbatim Cloud Security Alliance (CSA) implementation & auditing steps are available to the owner.

Fitted skill — mapping in progress. Candidates are drawn from this domain’s skill pool below.

Key ArchivalCEK-18

Crosswalk

ISO/IEC 42001EU AI ActBSI AIC4CCM v4.0.13AICPA TSC 2017ISO/IEC 27001:2022ISO/IEC 27002:2022NIST 800-53 rev 5NIST CSF v2.0

Implementation & auditing guidance

Shared implementation — 6 steps

Cloud Service Provider — 13 steps

Application Provider — 10 steps

Model Provider — 10 steps

Orchestrated Services Provider — 10 steps

Verbatim Cloud Security Alliance (CSA) implementation & auditing steps are available to the owner.

Fitted skill — mapping in progress. Candidates are drawn from this domain’s skill pool below.

Key CompromiseCEK-19

Crosswalk

ISO/IEC 42001EU AI ActBSI AIC4CCM v4.0.13AICPA TSC 2017ISO/IEC 27001:2022ISO/IEC 27002:2022NIST 800-53 rev 5NIST CSF v2.0

Implementation & auditing guidance

Shared implementation — 6 steps

Cloud Service Provider — 14 steps

Application Provider — 11 steps

Model Provider — 11 steps

Orchestrated Services Provider — 11 steps

Verbatim Cloud Security Alliance (CSA) implementation & auditing steps are available to the owner.

Fitted skill — mapping in progress. Candidates are drawn from this domain’s skill pool below.

Key RecoveryCEK-20

Crosswalk

ISO/IEC 42001EU AI ActBSI AIC4CCM v4.0.13AICPA TSC 2017ISO/IEC 27001:2022ISO/IEC 27002:2022NIST 800-53 rev 5NIST CSF v2.0

Implementation & auditing guidance

Shared implementation — 6 steps

Cloud Service Provider — 13 steps

Application Provider — 10 steps

Model Provider — 10 steps

Orchestrated Services Provider — 10 steps

Verbatim Cloud Security Alliance (CSA) implementation & auditing steps are available to the owner.

Fitted skill — mapping in progress. Candidates are drawn from this domain’s skill pool below.

Key Inventory ManagementCEK-21

Crosswalk

ISO/IEC 42001EU AI ActBSI AIC4CCM v4.0.13AICPA TSC 2017ISO/IEC 27001:2022ISO/IEC 27002:2022NIST 800-53 rev 5NIST CSF v2.0

Implementation & auditing guidance

Shared implementation — 6 steps

Cloud Service Provider — 13 steps

Application Provider — 10 steps

Model Provider — 10 steps

Orchestrated Services Provider — 10 steps

Verbatim Cloud Security Alliance (CSA) implementation & auditing steps are available to the owner.

Fitted skill — mapping in progress. Candidates are drawn from this domain’s skill pool below.

Standard names and gap levels shown; the specific clause references and full control text are available to the owner.

Skill pool — CEK

Configuring Certificate Authority With OpensslConfiguring Hsm For Key StorageConfiguring TLS 1 3 For Secure CommunicationsImplementing Aes Encryption For Data At RestImplementing Digital Signatures With Ed25519Implementing End To End Encryption For MessagingImplementing Envelope Encryption With Aws KmsImplementing JWT Signing And VerificationImplementing Rsa Key Pair ManagementImplementing Zero Knowledge Proof For AuthenticationPerforming Cryptographic Audit Of ApplicationPerforming Hardware Security Module Integration

Sample view. 12 of 15 skill names shown; the full list is available to the owner.

The other AICM domains

A&AAudit & Assurance AISApplication & Interface Security BCRBusiness Continuity Management and Operational Resilience CCCChange Control and Configuration Management DCSDatacenter Security DSPData Security and Privacy Lifecycle Management GRCGovernance, Risk and Compliance HRSHuman Resources IAMIdentity & Access Management IPYInteroperability & Portability I&SInfrastructure Security LOGLogging and Monitoring MDSModel Security SEFSecurity Incident Management, E-Discovery, & Cloud Forensics STASupply Chain Management, Transparency, and Accountability TVMThreat & Vulnerability Management UEMUniversal Endpoint Management

Assess a function on this domain →See how a fit gets deployed