@@ -1419,21 +1419,17 @@ The assessment criteria for each security requirements are described in a struct
- REFERENCE: ACC_PKI_SBDC_01
- OBJECTIVE:
- Verify that all system assets are identified as protected assets and that the default access control policy is configured to deny access unless an explicit permission is granted.
- PREPARATION:
- System architecture documentation and asset inventory.
- Default access control policies, role definitions, and authorization matrices.
- Administrator documentation describing access control configuration.
- Default user accounts with different privilege levels, including unauthenticated and unauthorized accounts.
- ACTIVITIES:
- Review the asset inventory and identify all system assets requiring access protection.
- Review access control configurations and verify that the default decision for all protected assets is DENY.
- Verify that access permissions are granted only through explicit authorization rules.
- Attempt to access protected assets using unauthenticated and unauthorized accounts.
- Verify that access requests without explicit permissions are denied in a deterministic manner.
- VERDICT:
- SUCCESS:
- All identified assets are configured by default as protected assets.
@@ -1444,7 +1440,6 @@ The assessment criteria for each security requirements are described in a struct
- One or more assets are not protected.
- The default policy allows access without explicit authorization.
- Unauthorized access attempts result in successful access or inconsistent behavior.
- EVIDENCE:
- System architecture and asset inventory documents.
- Access control policy configuration files.
@@ -1485,6 +1480,7 @@ The assessment criteria for each security requirements are described in a struct
- Screenshots or configuration exports demonstrating default settings.
## 6.3.3 SBDC - Cryptography
- REFERENCE: ACC-PKI-SBDC-03
- OBJECTIVE:
- Verify that all cryptographic mechanisms are configured by default using algorithms, key lengths, protocols, and parameters that conform to the requirements specified in Annex K.
@@ -1505,7 +1501,6 @@ The assessment criteria for each security requirements are described in a struct
- FAIL:
- One or more cryptographic mechanisms do not conform to Annex K requirements.
- Default configurations require manual modification to achieve compliance.
