SFS C / SF F

Back to SFS C

Status: Question model review passed; solution and completed SF authoring pending.

This is a generated authoring draft. Human approval and operational assessment results have not been supplied.

Question

Are all organization-owned API endpoints configured to verify that client security certificates have not been revoked before granting access throughout the review period?

Plain-language explanation

Model-reviewed question draft. Completed explanations and a canonical solution are pending. The proposed positive criterion is: Client certificates are confirmed valid and not revoked before access is granted

Assessment criterion and evidence

Actor: organization-owned API endpoints. Scope: client certificate validation within mutual authentication processes. Evidence period: review period. Required evidence: API configuration showing active certificate revocation verification; Operational logs confirming real-time certificate validity checks. Negative criterion: API endpoints grant access without verifying certificate revocation status. Missing evidence: No configuration documentation or validation logs demonstrating revocation status checks

View the JSON record (opens in a new tab).

Assessment result: unset.