Skip to content

V11.1.4 restates cryptographic inventory requirement already covered by V11.1.2 #3345

Description

@tghosth

Current requirements

# Description Level
11.1.2 Verify that a cryptographic inventory is performed, maintained, regularly updated, and includes all cryptographic keys, algorithms, and certificates used by the application. It must also document where keys can and cannot be used in the system, and the types of data that can and cannot be protected using the keys. 2
11.1.4 Verify that a cryptographic inventory is maintained. This must include a documented plan that outlines the migration path to new cryptographic standards, such as post-quantum cryptography, in order to react to future threats. 3

Issue

V11.1.4 opens with "Verify that a cryptographic inventory is maintained" which is a subset of what V11.1.2 already requires ("Verify that a cryptographic inventory is performed, maintained, regularly updated...").

The unique value of V11.1.4 is the migration plan element -- the documented plan for transitioning to new cryptographic standards. The inventory maintenance itself is already fully covered by V11.1.2.

Suggestion

Drop the inventory reference since it's implicit from the section context:

"Verify that there is a documented plan that outlines the migration path to new cryptographic standards, such as post-quantum cryptography, in order to react to future threats."

Background

V11.1.4 was created in PR #2972 (resolving #2912) by merging 11.8.1 and 11.8.2 into V11.1. The "cryptographic inventory is maintained" phrasing was carried over from the original 11.8.1 wording, where it made sense as a standalone requirement in V11.8. Now that the requirement lives in V11.1 alongside V11.1.2, the repetition is unnecessary.

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions