Assessment Objective
Determine if:
- SC-17a. public key certificates are issued under [Assignment: certificate policy] , or public key certificates are obtained from an approved service provider;
- SC-17b. only approved trust anchors are included in trust stores or certificate stores managed by the organization.
Assessment Methods
Examine
- System and communications protection policy
- procedures addressing public key infrastructure certificates
- public key certificate policy or policies
- public key issuing process
- system security plan
- other relevant documents or records
Interview
- System/network administrators
- organizational personnel with information security responsibilities
- organizational personnel with responsibilities for issuing public key certificates
- service providers
Test
- Mechanisms supporting and/or implementing the management of public key infrastructure certificates
Gekoppelde issues
| Koppelingstype | Issue |
|---|---|
| blocks | SC-17 [M] Public Key Infrastructure Certificates |