Encryption and Cryptographic Key Management
Access Authorization and Recovery Procedures
Access to encryption recovery information is restricted to authorized Information Technology personnel performing legitimate administrative, support, security, or recovery activities.
Requests for recovery information may arise from device maintenance, operating system recovery, hardware replacement, security investigations, or other authorized operational requirements.
Before releasing or using recovery information, responsible personnel evaluate the legitimacy of the request and confirm that the activity is consistent with the requester’s authorization and the University’s operational requirements.
Recovery information may be accessed through the applicable enterprise management platform or secure administrative repository by personnel with appropriate privileges.
Recovery activities are performed using established technical procedures appropriate to the affected encryption technology.
Where supported by the management platform, administrative access and recovery activities are subject to logging and audit capabilities.
Encryption Key Lifecycle and Rotation
Encryption keys are generated, maintained, and managed through the security mechanisms provided by the applicable encryption technology or enterprise management platform.
Key replacement or rotation may occur in response to security concerns, suspected compromise, device reconfiguration, operating system changes, encryption management requirements, or other operational circumstances.
The need for key rotation is evaluated according to the type of encryption technology, vendor recommendations, applicable security requirements, and the potential risk associated with continued use of the existing key.
Encryption recovery keys are not necessarily subject to a universal calendar-based rotation schedule. Rotation requirements are determined by the applicable encryption technology, security circumstances, and institutional risk.
When encryption keys are replaced or regenerated, updated recovery information is maintained through the applicable management mechanism.
Encryption Key Ownership and Administration
Information Technology personnel responsible for endpoint management, enterprise systems, infrastructure, and information security administer encryption technologies within their respective areas of responsibility.
Administrative responsibility for encryption keys and recovery information is assigned according to established technical roles and system management responsibilities.
Access to encryption management functions and recovery information is limited to authorized personnel with a legitimate operational or security requirement.
Information Technology management provides oversight of encryption administration and coordinates responsibilities among technical teams when necessary.
Encryption Key Retention and Disposition
Encryption keys and recovery information are retained as necessary to support the operation, maintenance, recovery, and security of the associated University-managed systems.
Retention requirements may vary according to the type of encryption technology, the operational lifecycle of the associated system, and applicable institutional or regulatory requirements.
When systems are decommissioned, reassigned, or otherwise removed from service, associated encryption keys and recovery information may be retired or removed in accordance with established system administration, asset management, and data disposition procedures.
Encryption recovery information associated with active systems is maintained for as long as necessary to support authorized recovery operations.
Encryption Key Storage and Protection
Encryption keys and recovery information associated with University-managed systems are maintained through approved encryption management platforms, secure administrative repositories, or other appropriate enterprise security mechanisms.
Encryption recovery information is protected through applicable administrative and technical safeguards, including access restrictions, authentication requirements, and security monitoring capabilities.
Recovery information is not intended for general user access and is maintained separately from routine user data when supported by the applicable encryption technology.
Information Technology personnel are responsible for protecting encryption keys and recovery information against unauthorized disclosure, modification, or loss.
Exceptions and Operational Considerations
Troy University maintains a diverse technology environment supporting academic, administrative, instructional, and research activities.
Certain systems, specialized equipment, or vendor-managed technologies may require encryption configurations or key management procedures that differ from standard enterprise endpoint practices.
Such circumstances are evaluated according to system capabilities, data sensitivity, operational requirements, vendor recommendations, and applicable University information security policies.
Where standard encryption controls cannot be implemented, Information Technology may evaluate alternative safeguards or compensating controls appropriate to the associated risk.
Monitoring and Administrative Accountability
Information Technology utilizes available enterprise management, endpoint security, and administrative monitoring capabilities to support oversight of encryption technologies and associated recovery information.
Administrative access to encryption management systems is restricted according to assigned technical responsibilities.
Where supported by the applicable technologies, encryption management activities, recovery information access, and significant administrative actions may be recorded through system logs or other available monitoring mechanisms.
Information Technology personnel periodically evaluate encryption management practices as part of ongoing system administration and information security activities.
Purpose
Troy University Information Technology maintains established procedures for managing encryption technologies and associated cryptographic keys used to protect University information systems and sensitive institutional data.
These procedures support Troy University ePolicy 804.2, Encryption, which establishes requirements for protecting University information through appropriate encryption safeguards.
The purpose of this procedure is to document the administrative and technical practices used to manage encryption keys, recovery information, authorized access, and related security controls throughout the operational lifecycle of University-managed systems.
Roles and Responsibilities
Information Technology personnel responsible for managing encrypted systems are responsible for maintaining appropriate encryption configurations, protecting recovery information, and supporting authorized recovery activities.
Personnel with administrative access to encryption keys and recovery information are responsible for using those privileges only for legitimate University purposes.
Information Technology management provides oversight of encryption administration and coordinates activities involving multiple technical teams when appropriate.
This procedure is reviewed periodically and may be adjusted to reflect changes in encryption technologies, institutional requirements, cybersecurity threats, and applicable University policies.
Scope
This procedure applies to encryption technologies and cryptographic keys managed or administered by Troy University Information Technology, including encryption associated with University-managed workstations, laptops, servers, storage systems, and other applicable technology resources.
Encryption technologies may include Microsoft BitLocker, Apple FileVault, and other encryption mechanisms supported by the University’s enterprise technology and security infrastructure.
Encryption associated with third-party hosted systems and services may be administered by the respective service providers in accordance with applicable contractual requirements and University information security policies.