SFS 1 / SF 5

Back to SFS 1

Status: Question model review passed; solution and completed SF authoring pending.

This is a generated authoring draft. Human approval and operational assessment results have not been supplied.

Question

Are privileged secrets stored using dedicated secure vaults with strict access controls throughout the review period?

Plain-language explanation

Model-reviewed question draft. Completed explanations and a canonical solution are pending. The proposed positive criterion is: Documented evidence showing secrets stored exclusively in dedicated vaults with role-based access controls, encryption, and separation of duties enforcement

Assessment criterion and evidence

Actor: Organization administrators and custodians of privileged credentials. Scope: All named administrator accounts, master keys, and high-impact secrets covered by SFS 1. Evidence period: During the entire review period specified in the assessment. Required evidence: Inventory of privileged secrets showing vault storage locations; Access control policies demonstrating separation of duties; Technical proof of encryption in transit/at rest. Negative criterion: Secrets stored in unapproved locations (e.g., configuration files, version control, unsecured documents) or vaults lacking access controls. Missing evidence: Pending assessment when no evidence of storage mechanisms is provided

View the JSON record (opens in a new tab).

Assessment result: unset.