Skip to content

Key Escrow

What is Key Escrow?

An arrangement in which cryptographic keys are held by a trusted third party (escrow agent) for later retrieval under defined conditions. Key escrow enables lawful access to encrypted data when the original key holder is unavailable.

Information Security

Terms that appear alongside key escrow

Each of these is named in at least one of the same controls as key escrow. The number is how many controls name both.

Frameworks that govern key escrow

ISO 27001:2022View framework →NIST SP 800-53 Rev 5View framework →NIST Cybersecurity Framework 2.0View framework →

What the standards actually require on key escrow

Requirements naming key escrow across 6 standards, quoted from the control text.

FedRAMP High2 controls

Maintain availability of information in event of loss of cryptographic keys via key escrow or recovery; HIGH only.

SC-12(1) · Availability →
ITU-T X.805 - Security Architecture for End-to-End Communications2 controls

Security Dimension 3 Non-Repudiation per X.805 Clause 6.3: Non-repudiation provides means for preventing an individual or entity from denying having performed a particular action related to data by making available proof of various network-related actions (e.g...

X805-Dim3-Non-Repudiation-Proof-Origin-Delivery-Sender-Receiver-Denial-Prevention · ITU-T X.805 Security Dimension 3 - Non-Repudiation + Proof of Origin + Proof of Delivery + Sender + Receiver Denial Prevention + Digital Signatures + Timestamping + Audit Logs + Forensic Evidence + Court-Admissible Records →
FedRAMP Moderate1 control

Establish and manage cryptographic keys per FedRAMP requirements (FIPS-validated, key escrow/recovery as appropriate).

SC-12 · Cryptographic Key Establishment and Management →
ISMAP (Japan)1 control

ISMAP Data Protection establishes comprehensive data lifecycle controls. (1) Data Classification: customer government data must be classified per Japanese government data classification scheme + including (a) General + (b) Sensitive + (c) Confidential + (d) St...

ISMAP-DataProtection-Classification-Encryption-DataResidencyJapan-Backup-SecureDeletion-Cryptography-FIPS · ISMAP Data Protection - Data Classification + AES-256 Encryption At Rest + TLS 1.3 In Transit + Data Residency Japan + Backup + Secure Deletion + Cryptography per FIPS 140-3 + CRYPTREC + KMS HSM →
NIST SP 800-53 Rev 5 LOW1 control

Establish and manage cryptographic keys per FedRAMP requirements (FIPS-validated, key escrow/recovery as appropriate).

SC-12 · Cryptographic Key Establishment and Management →
NIST SP 800-53 Rev 5 MODERATE1 control

Establish and manage cryptographic keys per FedRAMP requirements (FIPS-validated, key escrow/recovery as appropriate).

SC-12 · Cryptographic Key Establishment and Management →

Questions people ask about key escrow

What is Key Escrow?
An arrangement in which cryptographic keys are held by a trusted third party (escrow agent) for later retrieval under defined conditions. Key escrow enables lawful access to encrypted data when the original key holder is unavailable.
Why is Key Escrow important for compliance?
Key Escrow is a key concept in Information Security. Understanding key escrow helps organizations meet regulatory requirements, reduce risk, and demonstrate due diligence during audits. Our compliance platform maps 686 frameworks with 311K cross-framework control mappings.
Which compliance frameworks address Key Escrow?
Key Escrow appears in the requirement text of FedRAMP High, ITU-T X.805 - Security Architecture for End-to-End Communications, FedRAMP Moderate, ISMAP (Japan), NIST SP 800-53 Rev 5 LOW. Across these standards we have identified 8 controls that name it directly, each linked to the control text on the compliance platform.
Where can I learn more about Key Escrow?
Explore our compliance framework pages to see how key escrow applies across different standards and regulations. Our implementation guides provide step-by-step guidance, and the compliance platform offers AI-powered analysis of how this concept maps across 686 frameworks.

See how Key Escrow applies across compliance frameworks

Our platform maps 686 frameworks with 311K cross-framework control mappings. Explore how this concept is addressed across standards.

Explore on Platform
Written and maintained by Gerard Blokdyk, The Art of Service.