Does managing 2FA tokens fall under control: cryptographic key mgt? Probably. 

Tokens are mentioned in:
- 5.11 Return of assets (for hardware tokens)
- 5.17 Authentication information
- 8.5 Secure authentication