Assessment Objective

Determine if:

• SC-13a. [Assignment: cryptographic uses] are identified;
• SC-13b. [Assignment: types of cryptography] for each specified cryptographic use (defined in SC-13_ODP[01]) are implemented.

Assessment Methods

Examine

• System and communications protection policy
• procedures addressing cryptographic protection
• system design documentation
• system configuration settings and associated documentation
• cryptographic module validation certificates
• list of FIPS-validated cryptographic modules
• system audit records
• system security plan
• other relevant documents or records

Interview

• System/network administrators
• organizational personnel with information security responsibilities
• system developer
• organizational personnel with responsibilities for cryptographic protection

Test

• Mechanisms supporting and/or implementing cryptographic protection

Incidencias vinculadas

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final