
Policy for managing cryptographic keys
-------

**Description:**

When there is no policy for managing your cryptographic keys, expired or revoked keys 
that could unknowingly be used again thus becoming a threat for your encrypted data. 


**Solution:**

Verify that there is an explicit policy for how cryptographic keys are managed 
(e.g., generated, distributed, revoked, expired). Verify that this policy is properly 
enforced.
