SFS B / SF 3

Back to SFS B

Status: Question model review passed; solution and completed SF authoring pending.

This is a generated authoring draft. Human approval and operational assessment results have not been supplied.

Question

Are firmware updates for all organization-owned IoT devices delivered exclusively through authenticated and encrypted channels throughout the review period?

Plain-language explanation

Model-reviewed question draft. Completed explanations and a canonical solution are pending. The proposed positive criterion is: Documented configuration requiring update authentication/encryption + verified logs showing secured update transmissions

Assessment criterion and evidence

Actor: Organization managing IoT devices. Scope: All organization-owned Internet of Things (IoT) devices within the declared assessment boundary. Evidence period: Review period as defined in the assessment charter. Required evidence: Device firmware update configuration documentation; Network traffic analysis demonstrating encryption/authentication. Negative criterion: Unsecured update mechanisms observed (e.g., plain HTTP, unauthenticated channels) OR absence of required security controls. Missing evidence: Pending determination due to unavailable configuration evidence or update activity logs

View the JSON record (opens in a new tab).

Assessment result: unset.