I'm developing a records series for cryptographic key management records and wondering if anyone who has done this already might share some thoughts. Should these be broken down into sub-series:

- Program
- Architecture
- Transactional
- Inventories (of keys, HSM's)

Should the whole topic under a broader digital security record class?

No regulations found thus far on retention. Retention based on operational need? Contracts with suppliers or clients? Related security record classes? 

Places I've been in researching this:

   NIST Cryptographic Standards and Guidelines pages (and the NIST pubs contained therein)
   PCI-DSS sections 3.5 & 3.6

Thanks for any input you may offer,
Gary Link
Pitttsburgh, PA
[log in to unmask]

 



The contents of this email are the property of PNC. If it was not addressed to you, you have no legal right to read it. If you think you received it in error, please notify the sender. Do not forward or copy without permission of the sender. This message may be considered a commercial electronic message under Canadian law or this message may contain an advertisement of a product or service and thus may constitute a commercial electronic mail message under US law. You may unsubscribe at any time from receiving commercial electronic messages from PNC at http://pages.e.pnc.com/globalunsub/
PNC, 249 Fifth Avenue, Pittsburgh, PA 15222; pnc.com

List archives at http://lists.ufl.edu/archives/recmgmt-l.html
Contact [log in to unmask] for assistance
To unsubscribe from this list, click the below link. If not already present, place UNSUBSCRIBE RECMGMT-L or UNSUB RECMGMT-L in the body of the message.
mailto:[log in to unmask]