SFS C / SF 7

Back to SFS C

Status: Question model review passed; solution and completed SF authoring pending.

This is a generated authoring draft. Human approval and operational assessment results have not been supplied.

Question

Do all organization-owned API and MQTT message exchanges maintain payload integrity through cryptographic signatures or message authentication codes throughout the review period?

Plain-language explanation

Model-reviewed question draft. Completed explanations and a canonical solution are pending. The proposed positive criterion is: Cryptographic integrity mechanisms (e.g., HMAC, digital signatures) are configured and operational to detect unauthorized message alterations

Assessment criterion and evidence

Actor: organization-owned services. Scope: API contract implementations and MQTT message protocols between internal/external systems. Evidence period: the review period. Required evidence: Service configuration files showing active integrity controls; Integration test results verifying tamper detection; Network traffic analysis confirming signed/verified payloads. Negative criterion: No cryptographic integrity controls exist for message payloads, or evidence shows disabled/bypassed mechanisms. Missing evidence: Pending verification when no configuration logs, traffic samples, or test results are available for review

View the JSON record (opens in a new tab).

Assessment result: unset.