A tamper-resistant vault for the digital keys that lock your encrypted data. If the keys are safe, the data stays unreadable to thieves.
It’s a dedicated network appliance that generates, stores and uses cryptographic keys in tamper-resistant hardware, and it takes on demanding crypto work from applications.
This is a specialized tool for protecting encryption keys. It has no direct inmate-control role, but it gives administrators control over who can decrypt sensitive records.
- Controls access to the keys behind encrypted records.
- Keeps keys in tamper-resistant hardware.
- Most useful for state-level agencies.
Check before you buy
This is a specialized purchase. Most county jails won’t need it unless a system or policy specifically calls for one.
- Keys never need to sit on general-purpose servers.
- Separates key custody from data custody.
- Offloads crypto processing.
| Control | Priority | How this helps |
|---|---|---|
| SC-12Cryptographic Key Establishment and Management | P2* | Directly supports key generation and management. |
| SC-13Cryptographic Protection | P2* | Supports cryptographic protection, but verify its FIPS validation. |
| SC-28Protection of Information at Rest | P2* | Protects keys used for data at rest. |
When an agency holds its keys so that a provider can’t read CJI, it may change cloud staffing requirements. Confirm with your CJIS Systems Officer.
Based on CJIS Security Policy v6.1. This product can support these controls but can’t satisfy them alone. How to read this table