Encrypting the Backups Broke the Restore Test
A regulated firm must retain customer records for seven years. It encrypts backups with AES-256 using keys held in a hardware security module (HSM) managed by a single administrator. The retention policy says backups are kept for seven years; the encryption key rotation policy says keys rotate every 12 months and old keys are destroyed after rotation. A restore test of a 14-month-old backup fails because the key needed to decrypt it was destroyed at the last rotation. The auditor asks for evidence that retained data is recoverable for the full retention period. The firm has no key escrow and no documented recovery procedure for archived keys.
1. What is the core control conflict, and which requirement is being violated?
Read the worked answer
The conflict is between retention (7 years) and key lifecycle (destroy old keys after 12 months). Data encrypted with a destroyed key is effectively unrecoverable, so the retention control is not actually met - the firm is retaining ciphertext it cannot read. This violates the recoverability/availability expectation behind retention (and, depending on the regime, records-retention and business-continuity obligations). The auditor's request for evidence of recoverability is the correct test: retention without recoverability is not retention. The single-administrator HSM also creates a separation-of-duties and availability weakness.
2. Propose a key-management design that satisfies both policies, and state what evidence the auditor should see.
Read the worked answer
Design: (1) Key escrow / archived key vault - retain old keys (wrapped under a long-lived key-encryption key) for at least the retention period plus a margin, not destroy them at rotation; (2) rotation re-wraps rather than discards - new data keys per rotation, old data keys preserved for decryption; (3) split control - require two authorized custodians (or M-of-N) to access archived keys, removing the single-admin risk; (4) documented recovery runbook with periodic restore tests of aged backups. Evidence for the auditor: key inventory showing keys retained ≥7 years, restore-test logs for backups at multiple ages (including >12 months), custodian access records, and the runbook. The test is whether a 6-year-old backup restores - not whether a policy document says it should.