Assessment Objective
Determine if:
- IA-13(01)[01] cryptographic keys that protect access tokens are generated;
- IA-13(01)[02] cryptographic keys that protect access tokens are managed;
- IA-13(01)[03] cryptographic keys that protect access tokens are protected from disclosure; and
- IA-13(01)[04] cryptographic keys that protect access tokens are protected from disclosure and misuse
Assessment Methods
Examine
- Identification and authentication policy;
- procedures addressing cryptographic key establishment and management;
- system design documentation;
- cryptographic mechanisms;
- system configuration settings and associated documentation;
- system security plan;
- other relevant documents or records
Interview
- System/network administrators;
- organizational personnel with information security responsibilities;
- organizational personnel with responsibilities for cryptographic key establishment and/or management
Test
- Organizational processes for cryptographic key management;
- cryptographic modules generating, storing, and using cryptographic keys
Pedidos ligados
| Tipo de ligação | Pedido |
|---|---|
| blocks | IA-13(01) Protection of Cryptographic Keys |