SFS 1: Administrator and Master Keys
Assess the ownership, protection, use, and recovery of privileged accounts, administrator credentials, master keys, and other high-impact secrets.
Scope and boundaries
This set covers secrets and permissions whose misuse or loss could compromise administration or make protected data unrecoverable. It includes named administrators, separation of duties, secret storage, emergency access, credential rotation, revocation, and traceable privileged actions. Evidence should show who can use a secret, how access is authorized, and how changes and recovery are controlled. General user authentication belongs to SFS 3; cryptographic algorithms and service configuration belong to SFS A.
The sixteen questions
Each SF position is one question. Both positions run from 0 to F.
| SF | Question page | Authoring record |
|---|---|---|
| 0 | SF 0 | 0010 |
| 1 | SF 1 | 0011 |
| 2 | SF 2 | 0012 |
| 3 | SF 3 | 0013 |
| 4 | SF 4 | 0014 |
| 5 | SF 5 | 0015 |
| 6 | SF 6 | 0016 |
| 7 | SF 7 | 0017 |
| 8 | SF 8 | 0018 |
| 9 | SF 9 | 0019 |
| A | SF A | 001A |
| B | SF B | 001B |
| C | SF C | 001C |
| D | SF D | 001D |
| E | SF E | 001E |
| F | SF F | 001F |
From questions to a profile
Only reviewed, accepted 0/1 assessments can populate the sixteen-bit set profile. SF 0 is the most significant bit and SF F the least significant bit. The completed result uses four hexadecimal digits, including leading zeros. A catalog definition does not establish a completed assessment profile.
Read assessment and validation, then encoding. A set profile preserves individual answers; it is not a summed security score.