SFS A / SF 6

Back to SFS A

Status: Question model review passed; solution and completed SF authoring pending.

This is a generated authoring draft. Human approval and operational assessment results have not been supplied.

Question

Are digital certificates for all organization-owned services valid, unexpired, and issued by trusted certificate authorities throughout the review period?

Plain-language explanation

Model-reviewed question draft. Completed explanations and a canonical solution are pending. The proposed positive criterion is: Certificates are valid, unexpired, and issued by trusted certificate authorities (e.g., DigiCert, Sectigo)

Assessment criterion and evidence

Actor: organization. Scope: all organization-owned services using digital certificates for authentication or encryption. Evidence period: throughout the review period. Required evidence: Documented certificate inventory showing expiration dates and issuing authorities; Validation evidence confirming trust chain integrity for all active certificates. Negative criterion: Certificates are expired, revoked, self-signed without documented exception, or issued by untrusted authorities. Missing evidence: Absence of certificate inventory reports or validation evidence during evidence collection

View the JSON record (opens in a new tab).

Assessment result: unset.