SFS 9 / SF 7

Back to SFS 9

Status: Question model review passed; solution and completed SF authoring pending.

This is a generated authoring draft. Human approval and operational assessment results have not been supplied.

Question

Have security audits for in-scope applications confirmed coverage of all externally facing API endpoints during the review period?

Plain-language explanation

Model-reviewed question draft. Completed explanations and a canonical solution are pending. The proposed positive criterion is: Documented audit scope includes all externally facing API endpoints with verification evidence

Assessment criterion and evidence

Actor: organization conducting security audits. Scope: all externally facing API endpoints of in-scope applications. Evidence period: review period specified in audit documentation. Required evidence: Audit scope documentation; Endpoint inventory records; Verification records confirming testing scope. Negative criterion: Audit scope documentation omits one or more externally facing API endpoints. Missing evidence: No audit documentation provided for API endpoint coverage verification

View the JSON record (opens in a new tab).

Assessment result: unset.