Assessment Objective
Determine if:
- SC-13a. [Assignment: cryptographic uses] are identified;
- SC-13b. [Assignment: types of cryptography] for each specified cryptographic use (defined in SC-13_ODP[01]) are implemented.
Assessment Methods
Examine
- System and communications protection policy
- procedures addressing cryptographic protection
- system design documentation
- system configuration settings and associated documentation
- cryptographic module validation certificates
- list of FIPS-validated cryptographic modules
- system audit records
- system security plan
- other relevant documents or records
Interview
- System/network administrators
- organizational personnel with information security responsibilities
- system developer
- organizational personnel with responsibilities for cryptographic protection
Test
- Mechanisms supporting and/or implementing cryptographic protection
Linked Issues
| Linktype | Issue |
|---|---|
| blocks | SC-13 [M] Cryptographic Protection |