Current requirements
| # |
Description |
Level |
| 11.1.2 |
Verify that a cryptographic inventory is performed, maintained, regularly updated, and includes all cryptographic keys, algorithms, and certificates used by the application. It must also document where keys can and cannot be used in the system, and the types of data that can and cannot be protected using the keys. |
2 |
| 11.1.4 |
Verify that a cryptographic inventory is maintained. This must include a documented plan that outlines the migration path to new cryptographic standards, such as post-quantum cryptography, in order to react to future threats. |
3 |
Issue
V11.1.4 opens with "Verify that a cryptographic inventory is maintained" which is a subset of what V11.1.2 already requires ("Verify that a cryptographic inventory is performed, maintained, regularly updated...").
The unique value of V11.1.4 is the migration plan element -- the documented plan for transitioning to new cryptographic standards. The inventory maintenance itself is already fully covered by V11.1.2.
Suggestion
Drop the inventory reference since it's implicit from the section context:
"Verify that there is a documented plan that outlines the migration path to new cryptographic standards, such as post-quantum cryptography, in order to react to future threats."
Background
V11.1.4 was created in PR #2972 (resolving #2912) by merging 11.8.1 and 11.8.2 into V11.1. The "cryptographic inventory is maintained" phrasing was carried over from the original 11.8.1 wording, where it made sense as a standalone requirement in V11.8. Now that the requirement lives in V11.1 alongside V11.1.2, the repetition is unnecessary.
Current requirements
Issue
V11.1.4 opens with "Verify that a cryptographic inventory is maintained" which is a subset of what V11.1.2 already requires ("Verify that a cryptographic inventory is performed, maintained, regularly updated...").
The unique value of V11.1.4 is the migration plan element -- the documented plan for transitioning to new cryptographic standards. The inventory maintenance itself is already fully covered by V11.1.2.
Suggestion
Drop the inventory reference since it's implicit from the section context:
"Verify that there is a documented plan that outlines the migration path to new cryptographic standards, such as post-quantum cryptography, in order to react to future threats."
Background
V11.1.4 was created in PR #2972 (resolving #2912) by merging
11.8.1and11.8.2into V11.1. The "cryptographic inventory is maintained" phrasing was carried over from the original11.8.1wording, where it made sense as a standalone requirement in V11.8. Now that the requirement lives in V11.1 alongside V11.1.2, the repetition is unnecessary.