SFS 9 / SF D

Back to SFS 9

Status: Question model review passed; solution and completed SF authoring pending.

This is a generated authoring draft. Human approval and operational assessment results have not been supplied.

Question

Has documented evidence confirmed that security audits for in-scope applications included verification of cryptographic control implementation and configuration, including transport encryption and data protection mechanisms, throughout the review period?

Plain-language explanation

Model-reviewed question draft. Completed explanations and a canonical solution are pending. The proposed positive criterion is: Verified implementation of approved cryptographic standards with valid configurations

Assessment criterion and evidence

Actor: Organization conducting security audits. Scope: In-scope applications and their cryptographic implementations. Evidence period: Review period. Required evidence: Audit reports showing cryptographic control validation; Configuration evidence for transport/data encryption. Negative criterion: Unverified cryptographic controls or evidence of weak configurations. Missing evidence: Pending verification when audit documentation lacks cryptographic validation

View the JSON record (opens in a new tab).

Assessment result: unset.