SFS C / SF A

Back to SFS C

Status: Question model review passed; solution and completed SF authoring pending.

This is a generated authoring draft. Human approval and operational assessment results have not been supplied.

Question

Are all organization-owned API endpoints configured to validate and sanitize input data against known injection attack patterns throughout the review period?

Plain-language explanation

Model-reviewed question draft. Completed explanations and a canonical solution are pending. The proposed positive criterion is: successful prevention of injection attacks through validated/sanitized inputs

Assessment criterion and evidence

Actor: organization-owned API endpoints. Scope: all organizational services' API interfaces. Evidence period: review period. Required evidence: configuration records showing input validation rules; evidence of sanitization mechanisms against SQLi/XSS patterns. Negative criterion: occurrence of injection vulnerabilities due to unsanitized inputs. Missing evidence: absence of input validation/sanitization configuration records

View the JSON record (opens in a new tab).

Assessment result: unset.