Per NIST key management guidance what does key management include?

• A. Key generation, distribution, storage, use, and destruction
• B. Key distribution, storage, and destruction
• C. Revocation of certificates
• D. Software patching and maintenance

Answer: (A)

The main idea is the full lifecycle of cryptographic keys. Key management is about how keys are created, shared securely, stored in protected form, used according to policy, and eventually destroyed when no longer needed. Secure generation prevents weak or predictable keys, while secure distribution ensures only authorized parties get the keys. Protected storage (often in hardware security modules or encrypted key stores) keeps keys safe at rest. Clear usage policies govern who can use the keys and for what operations, and secure destruction guarantees that old keys cannot be recovered once they’re retired.

This combination—generation, distribution, storage, use, and destruction—covers the complete lifecycle, which is why it’s the best fit. The other options miss essential parts of the lifecycle: focusing only on distribution, storage, and destruction leaves out generation and use; revocation of certificates relates to PKI certificate management rather than the key material lifecycle itself; and software patching and maintenance pertain to general system upkeep, not key management.