Cloud KMS encryption keys should have rotation configured within 90 days

Cloud KMS encryption keys should be rotated within a period of 90 days. For the gcloud tool, the next rotation time must be in ISO or RFC3339 format. The rotation period must be in the form INTEGER[UNIT].

What this control checks

Checks that Cloud KMS encryption keys have rotation configured within 90 days

Framework mappings

The clauses this control is mapped to in each framework.

SOC 2

CC6.1 The entity implements logical access security software, infrastructure, and architectures over protected information assets to protect them from security events to meet the entity's objectives

NIST SP 800-53 Rev 5

IA-5: Authenticator Management
SC-28 Protection Of Information At Rest

NIST Cybersecurity Framework v2.0

GV.RM-02: Risk appetite and risk tolerance statements are established, communicated, and maintained.
GV.RM-03: Cybersecurity risk management activities and outcomes are included in enterprise risk management processes.
ID.AM-08
PR.AA-01: Identities and credentials for authorized users, services, and hardware are managed by the organization.
PR.AA-04

1 more clause