Cryptographic key management is the discipline of generating, storing, using, rotating, revoking, and auditing the keys that protect encrypted systems. In practice, it is the governance layer that determines whether encryption remains trustworthy across cloud, pipeline, and workload environments.
Expanded Definition
Cryptographic key management is the operational and governance discipline that keeps encryption usable and trustworthy across service accounts, API clients, pipelines, and machine-to-machine workloads. In NHI security, the term extends beyond generating and storing keys to include issuance, rotation, revocation, escrow decisions, access logging, and recovery after compromise. That matters because a key is not just a technical artifact; it is an identity-bearing control plane for non-human access. The strongest definitions today align with NIST Cybersecurity Framework 2.0, while implementation language varies across vendors and cloud platforms. NHI Management Group treats key management as part of the broader lifecycle discipline described in the Ultimate Guide to NHIs — Lifecycle Processes for Managing NHIs and the NHI Lifecycle Management Guide. The most common misapplication is treating key storage as the whole problem, which occurs when teams rotate certificates but leave long-lived api key, signing keys, and backup copies unmanaged.
Examples and Use Cases
Implementing cryptographic key management rigorously often introduces operational overhead, requiring organisations to weigh automation speed against tighter control, shorter lifetimes, and more frequent service updates.
- Rotating signing keys for CI/CD systems so a compromised pipeline credential does not remain usable across releases, a pattern often seen in incidents like the Coupang Signing Key Breach.
- Separating key material for production databases, build systems, and third-party integrations so a single leaked secret cannot move laterally across trust boundaries.
- Using centralized inventory and audit trails to detect orphaned keys, especially where multiple teams issue machine credentials without a shared revocation workflow, a risk discussed in the Top 10 NHI Issues.
- Applying envelope encryption for cloud workloads so application operators can use data encryption without direct exposure to the highest-value root keys.
- Revoking API keys and certificate trust chains during offboarding so a decommissioned workload cannot continue authenticating after ownership changes.
In practice, the question is not whether a key exists, but whether its scope, lifetime, and recovery process are disciplined enough to survive an incident and still satisfy the expectations in NIST Cybersecurity Framework 2.0.
Why It Matters in NHI Security
Key management failures turn encryption from a protective control into a brittle dependency. When keys are shared broadly, stored in code, or left valid after a workload is retired, the organisation may still appear encrypted while actually being one token leak away from compromise. NHI Management Group data shows that 71% of NHIs are not rotated within recommended time frames, and 79% of organisations have experienced secrets leaks, with 77% of those incidents causing tangible damage. That is why key governance is inseparable from NHI visibility, least privilege, and incident response. The risk becomes sharper in environments with autonomous agents, where Regulatory and Audit Perspectives place evidence, traceability, and revocation discipline ahead of convenience. Teams also need to distinguish key custody from broader secrets management, since keys, tokens, and certificates fail in different ways even when they are all called “secrets.” Organisations typically encounter the operational cost of poor key management only after a breach, at which point revocation, forensics, and re-issuance become unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and CSA MAESTRO address the attack and risk surface, while NIST CSF 2.0, NIST Zero Trust (SP 800-207) and NIST SP 800-63 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 | Covers lifecycle and governance expectations for non-human credentials and keys. |
| NIST CSF 2.0 | PR.AC-1 | Access control depends on strong credential and key governance. |
| NIST Zero Trust (SP 800-207) | SC-13 | Zero Trust requires cryptographic protection and managed trust anchors for non-human access. |
| NIST SP 800-63 | AAL2 | Key strength and lifecycle rigor support strong authenticator assurance for machine identities. |
| CSA MAESTRO | Agentic systems need controlled key custody for tool use and delegated execution. |
Treat high-value machine keys as assurance-bound authenticators and raise controls for their issuance and rotation.
