SFS A / SF 9

Back to SFS A

Status: Question model review passed; solution and completed SF authoring pending.

This is a generated authoring draft. Human approval and operational assessment results have not been supplied.

Question

Are cryptographic operations for critical systems protected by hardware security modules (HSMs) where required by organizational policy throughout the review period?

Plain-language explanation

Model-reviewed question draft. Completed explanations and a canonical solution are pending. The proposed positive criterion is: Documented deployment and usage of HSMs or equivalent hardware modules meeting organizational policy requirements for specified critical operations

Assessment criterion and evidence

Actor: organization. Scope: cryptographic operations involving critical systems and data. Evidence period: throughout the review period. Required evidence: Organizational policy requirements for hardware-enforced cryptographic operations; Technical verification of hardware module integration in cryptographic workflows; Configuration records demonstrating active hardware enforcement. Negative criterion: Evidence of cryptographic operations performed without mandated hardware protection, or absence of required HSM implementation where policy applies. Missing evidence: Pending assessment when implementation records or configuration evidence are unavailable

View the JSON record (opens in a new tab).

Assessment result: unset.