Hardware Security Module
What is Hardware Security Module?
A dedicated cryptographic processor that provides secure generation, storage, and management of digital keys and performs encryption operations in a tamper-resistant device.
Terms that appear alongside hardware security module
Each of these is named in at least one of the same controls as hardware security module. The number is how many controls name both.
- encryption 5 shared controls
- fips 4 shared controls
- key management 4 shared controls
- tls 3 shared controls
- hardware security module hsm 3 shared controls
- audit 3 shared controls
- authentication 3 shared controls
- encryption at rest 3 shared controls
Frameworks that govern hardware security module
What the standards actually require on hardware security module
Requirements naming hardware security module across 6 standards, quoted from the control text.
Private keys for Microsoft AD CS CA servers are protected by a hardware security module.
ISM-1957 · HSM protection of CA private keys →Security Dimension 3 Non-Repudiation per X.805 Clause 6.3: Non-repudiation stops a person or entity from credibly denying that it carried out a given action on data, by keeping evidence of network-related actions available (for example evidence of an obligatio...
X805-Dim3-Non-Repudiation-Proof-Origin-Delivery-Sender-Receiver-Denial-Prevention · ITU-T X.805 Security Dimension 3 - Non-Repudiation + Proof of Origin + Proof of Delivery + Sender + Receiver Denial Prevention + Digital Signatures + Timestamping + Audit Logs + Forensic Evidence + Court-Admissible Records →OMB, with NIST, CISA and GSA, requires FCEB agencies to follow best practices on the protection and management of hardware security modules, trusted execution environments or other isolation technologies for the access tokens and cryptographic keys that cloud...
us-executive-order-14144-strengthening-and-promoting-innovation-in-the-nations-cybersecurity::4(g)(iii) · Sec. 4(g)(iii) Follow best practice for HSMs and isolation protecting cloud keys →Destroy keys kept anywhere other than a secure environment, and revoke those kept in hardware security modules, once they are no longer needed, through a defined and evaluated process. The process includes provisions for legal and regulatory requirements.
CCM-CEK-14 · Key Destruction →Where code signing is used, the maker has procedural and technical controls against unauthorised access to or change of the private signing keys;
iacs-unified-requirements-e26e27-cyber-resilience-of-ships-and-on-board-systems::E27-5.1 · E27 5.1 Controls for private keys (IEC 62443-4-1 SM-8) →ISMAP Data Protection establishes comprehensive data lifecycle controls. (1) Data Classification: customer government data must be classified per Japanese government data classification scheme + including (a) General + (b) Sensitive + (c) Confidential + (d) St...
ISMAP-DataProtection-Classification-Encryption-DataResidencyJapan-Backup-SecureDeletion-Cryptography-FIPS · ISMAP Data Protection - Data Classification + AES-256 Encryption At Rest + TLS 1.3 In Transit + Data Residency Japan + Backup + Secure Deletion + Cryptography per FIPS 140-3 + CRYPTREC + KMS HSM →Questions people ask about hardware security module
What is Hardware Security Module?
Why is Hardware Security Module important for compliance?
Which compliance frameworks address Hardware Security Module?
Where can I learn more about Hardware Security Module?
See how Hardware Security Module applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.