SFS C / SF D

Back to SFS C

Status: Question model review passed; solution and completed SF authoring pending.

This is a generated authoring draft. Human approval and operational assessment results have not been supplied.

Question

Are all organization-owned MQTT message topics configured with authorization policies restricting access to permitted client systems throughout the review period?

Plain-language explanation

Model-reviewed question draft. Completed explanations and a canonical solution are pending. The proposed positive criterion is: MQTT topics enforce authorization policies limiting access to explicitly permitted client systems based on service roles

Assessment criterion and evidence

Actor: Organization. Scope: MQTT message topics used for data exchange between organizational services. Evidence period: Throughout the review period. Required evidence: MQTT broker configuration showing topic-specific access control lists (ACLs); Audit logs verifying policy enforcement for subscription/publish operations. Negative criterion: MQTT topics allow unrestricted access or insufficient authorization controls that permit unauthorized client interactions. Missing evidence: Absence of configuration records or audit logs demonstrating topic-level authorization policies

View the JSON record (opens in a new tab).

Assessment result: unset.