SFS A / SF 7

Back to SFS A

Status: Question model review passed; solution and completed SF authoring pending.

This is a generated authoring draft. Human approval and operational assessment results have not been supplied.

Question

Are cryptographic protocols and cipher suites configured to exclude known insecure algorithms and modes throughout the review period?

Plain-language explanation

Model-reviewed question draft. Completed explanations and a canonical solution are pending. The proposed positive criterion is: Configuration settings explicitly disable known insecure cryptographic algorithms and modes

Assessment criterion and evidence

Actor: Organization. Scope: All organization-owned systems employing cryptographic services. Evidence period: Throughout the review period. Required evidence: System configuration files documenting protocol/cipher suite restrictions; Security scan reports verifying absence of disabled algorithms. Negative criterion: Use of cryptographic algorithms or modes with known critical vulnerabilities (e.g., MD5, SHA-1 for signatures, SSLv3, weak Diffie-Hellman parameters). Missing evidence: Pending verification if configuration records or security scan results are unavailable

View the JSON record (opens in a new tab).

Assessment result: unset.