| NIST SP 800-57 |
Key management life-cycle, key sizes, crypto-periods |
HSM-based key generation and storage; defined CA key life-times; approved algorithms |
| NIST SP 800-53 Rev. 5 |
SC-12 key establishment and management; SC-13 cryptographic protection; SC-17 PKI certificates; IA-5(2) PKI-based authentication; AU audit controls |
Managed CA hierarchy; approved algorithms; certificates for device and user authentication; CA and portal audit logs |
| NIST CSF 2.0 |
PR.AA identity and authentication; PR.DS data security; DE.CM continuous monitoring |
Certificate-based identity; encryption in transit; CA health monitoring and expiry alerts |
| FIPS 140-3 |
Validated cryptographic modules |
CA keys held in FIPS 140-3 Level 3 HSMs in the EC datacenter |
| ISO/IEC 27001:2022 |
Annex A 8.24 use of cryptography; 5.15 access control; 8.15 logging |
Documented cryptographic policy; role-based access; activity logs |
| PCI DSS v4.0 |
Req. 3.6 and 3.7 key management; Req. 4.2.1 strong cryptography for cardholder data in transit |
Protected CA keys; certificate inventory and expiry control for TLS |
| HIPAA Security Rule |
164.312(a)(2)(iv) encryption; 164.312(d) authentication; 164.312(e) transmission security |
Certificates for TLS and device authentication; audit logs |
| SOC 2 |
CC6.1 logical access; CC6.7 data in transmission; CC7 system monitoring |
Role-based access; TLS certificates; monitoring and logs |
| GDPR |
Article 32 security of processing, including encryption |
Certificates enabling encryption of personal data in transit |
| CNSA 2.0 |
Move to quantum-resistant algorithms for National Security Systems |
Crypto-agile hierarchy able to add post-quantum CAs |
| SPDM and DICE |
Hardware-rooted device identity and attestation |
Private CA hierarchy for issuing device identity certificates |
