SC-13 Cryptographic protection
Requires the organization to determine the specific uses for which cryptography is required in the system and to implement the types of cryptography defined for each of those uses, so that algorithm and mechanism choices
4
artefacts
1
held by a system
0
at each review
moderate
to go live
Cloud console / configuration management
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Configuration evidence showing the specified algorithms and modes in use · Cloud console / configuration management
periodic reviewEvidence produced at each review
none for this control
governing documentDocuments that govern the control
- Documented cryptographic uses for the system and the cryptography required for each · Document repository
- Inventory of cryptographic implementations and their validation status · Policy repository / GRC workspace
- Review evidence that the choices remain appropriate as standards change · Policy repository / GRC workspace
First move
Start with the 1 of 4 artefacts that already live in a system (Cloud console / configuration management); keep the periodic reviews but log each one as a dated record with a named reviewer.
Common gaps auditors find
- Cryptographic uses never enumerated, so implementation choices are made per project
- Deprecated algorithms remain enabled for backwards compatibility
- Validation status of cryptographic modules unknown
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetSC-12 Cryptographic key establishment and management · SC-15 Collaborative computing devices and applications