SEC09-BP03 Authenticate network communications
Verify the identity of network communications by using protocols that support authentication, such as TLS or IPsec, between services, applications and users.
4
artefacts
2
held by a system
0
at each review
easy
to go live
Endpoint management (MDM / EDR)
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- TLS and mutual TLS configuration for internal endpoints · Endpoint management (MDM / EDR)
- Scan results confirming unauthenticated protocols are absent · Vulnerability scanner / patch tooling
periodic reviewEvidence produced at each review
none for this control
governing documentDocuments that govern the control
- Inventory of service-to-service flows with the protocol used · Policy repository / GRC workspace
- Certificate or identity issuance process for workload identities · Policy repository / GRC workspace
First move
Automate the pull from your Endpoint management (MDM / EDR). Device compliance report from the MDM (encryption, EDR agent, OS version) on a daily pull.
Common gaps auditors find
- internal traffic left unauthenticated on the assumption the network is trusted
- TLS terminated at the edge with plaintext behind it
- certificate validation disabled to work around expiry errors
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetSEC09-BP02 Enforce encryption in transit · SEC10-BP01 Identify key personnel and external resources