diff --git a/.github/README.md b/.github/README.md index 3a70bdc..b8356d2 100644 --- a/.github/README.md +++ b/.github/README.md @@ -52,9 +52,9 @@ pip install -r scripts/requirements-dev.txt - `model/` — narrative pages: vocabulary, modules, categories overview, references summary. - `release-notes/` — per-version release notes. Each version subdirectory uses the template at `release-notes/templates/_index.md`. - `assessment/` — assessment process pages (scoping, assessment, evaluation, reporting, implementation). -- `extensions/` — extension framework schema and the catalog of published extensions. -- `tools/` — Excel-based assessment tools and the web self-assessment configuration. -- `integrations/` — converters that produce artifacts for downstream tools (e.g., Eramba CSV packages). +- `extensions/` — extension framework documentation, structure, scoring, and JSON schema. The catalog of published extensions lives in the separate [`pkimm-extensions`](https://pkic.org/wg/pkimm/extensions/) repository. +- Converters that produce artifacts for downstream tools (e.g., Eramba CSV packages) live in the separate `pkimm-integrations` repository. +- Excel-based assessment tools have been retired in favor of the web self-assessment; the last Excel tools remain available under the `1.0.0` tag / website section. - `scripts/` — authoring scripts (generator, validator) and their tests. ### Conventions @@ -74,7 +74,7 @@ Edit `data/pkimm-model-.yaml` under the relevant module. Use a short ke ### Adding an extension -Each extension is a single YAML file under `extensions/catalog//-extension.yaml` validating against `extensions/extension.schema-1.0.0.json`. Declare which model versions the extension targets in its `compatibility` array. Extension-specific references go in an inline top-level `references:` block on the extension; common references resolve against the global catalog. +Extension definitions are authored in the separate [`pkimm-extensions`](https://pkic.org/wg/pkimm/extensions/) repository, as a single YAML file per extension validating against this repo's `extensions/extension.schema-1.0.0.json`. Declare which model versions the extension targets in its `compatibility` array. Extension-specific references go in an inline top-level `references:` block on the extension; common references resolve against the global catalog. See the `pkimm-extensions` repository for its authoring workflow. ## License & IPR diff --git a/.gitignore b/.gitignore index 36cb51b..ee27bac 100644 --- a/.gitignore +++ b/.gitignore @@ -42,3 +42,5 @@ __pycache__/ ### Local Claude Code workspace ### .claude/ +docs/superpowers/ +.superpowers/ diff --git a/CLAUDE.md b/CLAUDE.md index 9c2af8d..668f99e 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -4,7 +4,7 @@ This file provides guidance to Claude Code (claude.ai/code) when working with co ## What this repository is -Content repository for the **PKI Maturity Model (PKIMM)**, maintained by the PKI Consortium PKIMM working group. The content is rendered at https://pkic.org/pkimm by an external Hugo-based site — this repo holds the source markdown, the canonical model data, and assessment tools. There is **no build system, no test suite, and no application code** here. Treat changes as documentation/data edits, not software changes. +Content repository for the **PKI Maturity Model (PKIMM)**, maintained by the PKI Consortium PKIMM working group. The content is rendered at https://pkic.org/pkimm by an external Hugo-based site — this repo holds the source markdown, the canonical model data, and the assessment methodology pages. There is **no build system, no test suite, and no application code** here. Treat changes as documentation/data edits, not software changes. ## Repository layout @@ -19,13 +19,10 @@ Content repository for the **PKI Maturity Model (PKIMM)**, maintained by the PKI - `data/pkimm-model.schema-1.0.0.json` — JSON Schema for the 1.0.0 YAML shape (retroactively renamed from `pkimm-model.schema.json`). - `data/pkimm-references.yaml` — **independently-versioned references catalog**. Per-requirement `references` fields in the 2.0.0 model contain arrays of IDs from this catalog. Edit here to update reference metadata without touching the model YAML. - `data/pkimm-references.schema-1.0.0.json` — JSON Schema for the references catalog. -- `extensions/extension.schema-1.0.0.json` — JSON Schema for PKIMM extension files. -- `extensions/catalog/pqc/pqc-extension.yaml` — PQC (Post-Quantum Cryptography) extension version 0.2.0, compatible with PKIMM 2.0.0. +- `extensions/` — extension framework: schema (`extension.schema-1.0.0.json`), structure and scoring documentation. The extension framework defines the non-destructive, composable overlay/relevance model (schema/structure/scoring); the catalog of published extension YAML definitions now lives in the separate `pkimm-extensions` repository, rendered at https://pkic.org/wg/pkimm/extensions/. - `scripts/` — authoring and validation scripts (see "Authoring workflow" below). -- `tools/` — published Excel assessment tools (`PKI_Maturity_Assessment_Tool_*.xlsx`, `PKI_Maturity_Self_Assessment_Tool_*.xlsx`). -- `integrations/eramba/` — per-schema-version converters that produce Eramba-importable CSV packages. - - `convert-yaml-data-to-csv-package-1.0.0.py` — reads `data/pkimm-model-1.0.0.yaml` (schema 1.0.0) and writes `pkimm-1.0.0.csv`. - - `convert-yaml-data-to-csv-package-2.0.0.py` — reads `data/pkimm-model-2.0.0.yaml` (schema 2.0.0) and `data/pkimm-references.yaml`; writes `pkimm-2.0.0.csv`. Future schema versions get their own script alongside. +- Integration converters (e.g., the Eramba CSV package generators) now live in the separate `pkimm-integrations` repository, rendered at https://pkic.org/wg/pkimm/integrations/. +- The published Excel assessment tools (`PKI_Maturity_Assessment_Tool_*.xlsx`, `PKI_Maturity_Self_Assessment_Tool_*.xlsx`) have been retired from this repo, superseded by the web self-assessment; they remain available via the `1.0.0` tag and the 1.0.0 website section. - `release-notes/` — per-version release notes (`release-notes/1.0.0/`, `release-notes/2.0.0/`) and a template at `release-notes/templates/`. See the release notes for consumer-facing changes and migration guidance. - `faq/`, `.github/README.md` — supplementary content; the GitHub-rendered README lives in `.github/README.md`, not the repo root. diff --git a/_index.md b/_index.md index 170c392..5cddd03 100644 --- a/_index.md +++ b/_index.md @@ -49,7 +49,7 @@ The assessment process defines steps to scope, assess, evaluate, and report the ## Assessment tools The following assessment tools are available to support the assessment process: -- [PKI maturity assessment tool](./tools/) - Excel spreadsheet that can be used to perform the assessment and generate a report. +- [PKI maturity self-assessment](https://pkic.org/wg/pkimm/assessment/) - web-based self-assessment tool. The earlier Excel-based assessment tool has been retired in favor of this tool and remains available under the 1.0.0 tag / website section. ```mermaid diff --git a/extensions/_index.md b/extensions/_index.md index 0403acb..152e453 100644 --- a/extensions/_index.md +++ b/extensions/_index.md @@ -18,6 +18,8 @@ Extensions may: Extensions are optional and independent. They can be added or removed without changing the core PKI MM model or affecting the baseline maturity calculation. +Browse the published extensions in the [extension catalog](https://pkic.org/wg/pkimm/extensions/). + ## How extensions influence maturity > 💡 **Concept** @@ -46,6 +48,6 @@ flowchart TD - **[Extension structure](./structure/)** — what fields make up an extension definition (metadata, Relevance, Overlays). Read this if you are authoring a new extension. - **[Scoring model](./scoring/)** — formulas, order-of-operations, and the end-to-end worked example. Read this if you are implementing tooling for an extension. -- **[Extension catalog](./catalog/)** — the list of working-group extensions with documentation and YAML definitions. +- **[Extension catalog](https://pkic.org/wg/pkimm/extensions/)** — the list of working-group extensions with documentation and YAML definitions, published from the `pkimm-extensions` repository. - **[Extension JSON Schema](./extension.schema-1.0.0.json)** — the canonical machine-readable contract for extension YAML files. - **[Extension framework FAQ](../faq/#extension-framework)** — answers to common questions including non-destructive design, multi-extension behavior, and overlay tunability. diff --git a/extensions/catalog/_index.md b/extensions/catalog/_index.md deleted file mode 100644 index 0b66fa4..0000000 --- a/extensions/catalog/_index.md +++ /dev/null @@ -1,17 +0,0 @@ ---- -date: "2026-05-13T7:00:00Z" -title: Extension catalog -weight: 3 ---- - -# Extension catalog - -The catalog lists extensions developed and maintained by the working group. Each entry links to the extension's documentation and YAML definition. - -Extensions follow a consistent documentation structure so readers know what to expect — see the [extension documentation template](./templates/) when authoring a new entry. - -## Available extensions - -| Extension | Version | Short description | Documentation | -|---|---|---|---| -| **PQC Readiness Extension** Under development | 0.2.0 | Adds Post-Quantum Cryptography readiness criteria and overlays to evaluate strategic, policy, compliance, and operational preparedness for quantum-safe PKI transition. | [Details](./pqc/) | diff --git a/extensions/catalog/pqc/_index.md b/extensions/catalog/pqc/_index.md deleted file mode 100644 index 3abbb0f..0000000 --- a/extensions/catalog/pqc/_index.md +++ /dev/null @@ -1,116 +0,0 @@ ---- -date: "2026-05-13T7:00:00Z" -title: PQC Readiness Extension -weight: 1 ---- - -# PQC Readiness Extension - -The Post-Quantum Cryptography (PQC) Readiness Extension adds quantum-safe transition criteria to the PKI Maturity Model. It introduces an extension-specific maturity signal alongside the baseline PKI MM categories, plus weight overlays that emphasize requirements most relevant to PQC migration. - -The quantum threat fundamentally changes what PKI maturity means. An organization achieving Level 5 on every current PKI MM requirement may still face material cryptographic risk if its foundations are quantum-vulnerable. The Dutch government's "harvest-now, decrypt-later" framing makes this a **present-day** risk for long-lived confidentiality, not a future concern. - -## Status - -This extension is **under development**. - -- **Complete** — Governance module (categories 1 – 4): full Level 1–5 criteria, assessor guidance, evidence examples, and overlay weights are defined. -- **Outline** — Management, Operations, and Resources modules: PQC-critical considerations identified, but Level 1–5 criteria are not yet developed. -- **YAML version** — `0.2.0`. The extension version will move to `1.0.0` when all modules reach full Level 1–5 development and the working group endorses the content. - -### Open question - -The placement of overlay weights is **not yet settled** between two candidate designs: - -- **Governance-centric overlays** (current YAML): per-requirement multipliers applied to Governance categories 1 – 4, emphasizing the requirements where PQC introduces fundamentally new evidence or review cadence. -- **Capability-centric overlays** (Kennedy's proposal, section 7): multipliers applied to crypto-agility (Change Management & Agility) and PQC training (Knowledge & Training), elevating the operational capabilities most underweighted for quantum readiness. - -The current YAML follows the Governance-centric design (because that is what the self-assessment tool currently exercises). Resolving this is a working-group decision and will land in a future revision. - -## Scope - -The extension targets the following audiences: - -- **Certification Authority operators (CA / TSP)** — primary audience; most existing content reflects CA/TSP archetypes. -- **PKI architects and operators in enterprises** — assessing internal PKI quantum-readiness. -- **Auditors and consultants** — using the extension as part of broader PKI maturity engagements. - -Persona coverage for **certificate-consuming organizations**, **software vendors**, and **AI-system-layer cryptographic governance** is identified as a known gap and tracked for a later revision. - -## What the extension covers - -The four Governance categories receive full PQC-specific Level 1–5 criteria; the remaining modules are identified at an outline level only. - -### Governance — Module G - -#### Strategy and vision (G.strategy-and-vision) - -Strategic direction for PQC transition: executive sponsorship of the quantum threat, the Mosca inequality applied to data lifetimes, organizational persona per the Dutch Migration Handbook, board-level visibility, and budget for PQC activities. - -**Key transitions:** -- Level 2 → 3 — "Awareness to Action": formal strategy incorporation, executive sponsorship extended, working group established. -- Level 4 → 5 — "Execution to Leadership": competitive positioning, ecosystem contribution, crypto-agility as ongoing capability. - -#### Policies and documentation (G.policies-and-documentation) - -Policy framework for PQC: CP/CPS updates to incorporate NIST FIPS 203/204/205, deprecation schedules aligned with SP 800-131A Rev 3, hybrid-vs-pure PQC strategy, key management policy adjustments (larger keys, HSM support, stateful HBS state management), CBOM adoption, and multi-jurisdiction policy alignment (BSI / ANSSI hybrid versus CNSA 2.0 pure PQ). - -#### Compliance (G.compliance) - -Regulatory mapping and audit scope for PQC requirements: DORA ICT risk management (EU financial services from January 2025), eIDAS 2.0 cryptographic requirements, CNSA 2.0 timelines (US National Security Systems), NIS2 implementing measures, and the 18 EU Member States Joint Statement recommendations. Audit criteria evolution under WebTrust and ETSI scopes is tracked here. - -#### Processes and procedures (G.processes-and-procedures) - -Operational procedures transformed for PQC: key ceremony evolution (hybrid generation, quorum, HSM activation, stateful HBS state management), crypto-agility procedures per NIST CSWP 39, quantum risk assessment with Mosca inequality, change management for phased migration, incident response for cryptographic events, and extended segregation of duties for PQC-specific roles. - -### Modules M, O, R — outline only - -The following PQC-critical considerations are identified for the remaining modules. Full Level 1–5 development is pending. - -#### Management — Module M (PQC technical considerations) - -- **Key Management (M.key-management)** — algorithm inventory and CBOM generation; PQC key lifecycle (larger keys, longer generation times); stateful hash-based signature state management (XMSS, LMS); hybrid key management; HSM PQC algorithm support verification. -- **Certificate Management (M.certificate-management)** — hybrid certificate issuance (composite signatures, external keys); certificate validity periods versus algorithm security lifetimes; revocation strategy for quantum-vulnerable certificates; template updates; cross-certification for hybrid PKI. -- **Infrastructure Management (M.infrastructure-management)** — HSM firmware upgrade roadmaps; network capacity for larger PQC keys and signatures; storage for larger certificates; performance testing. -- **Change Management and Agility (M.change-management-and-agility)** — crypto-agility architecture enabling algorithm substitution; transition procedures; rollback for failed PQC deployments; configuration management for cryptographic parameters. - -#### Operations — Module O (PQC security considerations) - -- **Resilience (O.resilience)** — quantum threat in business continuity planning; recovery procedures for cryptographic compromise; redundancy for PQC algorithm availability. -- **Automation (O.automation)** — automated cryptographic inventory discovery; automated certificate replacement for PQC migration; CI/CD integration for PQC algorithm validation. -- **Interoperability (O.interoperability)** — PQC interoperability testing with relying parties; hybrid certificate compatibility verification; cross-vendor PQC algorithm interoperability; protocol-version negotiation. -- **Monitoring and Auditing (O.monitoring-and-auditing)** — algorithm usage monitoring and reporting; quantum-vulnerable algorithm detection; CBOM drift monitoring; audit trail for algorithm transitions. - -#### Resources — Module R (PQC people and sourcing considerations) - -- **Sourcing (R.sourcing)** — vendor PQC roadmap assessment in procurement; contract requirements for PQC support timelines; third-party certificate provider PQC readiness; supply-chain security for cryptographic components. -- **Knowledge and Training (R.knowledge-and-training)** — PQC technical training for PKI operations staff; executive education on quantum risk; certification programs incorporating PQC; knowledge transfer from PQC migration projects. -- **Awareness (R.awareness)** — organization-wide quantum-threat awareness; developer education on PQC implications; stakeholder communication for migration activities. - -## Product and service dependency - -Organizational PKI maturity depends on the readiness of products and services in the dependency chain — Certificate Authority software, HSMs, IAM platforms, cloud PKI offerings, application frameworks, IoT firmware. An organization can achieve Level 5 on internal governance while being blocked from PQC deployment by a critical vendor not supporting quantum-safe algorithms until later in the decade. - -The PKI Consortium's separate Post-Quantum Cryptography Maturity Model (PQCMM) assesses product / service PQC readiness. The PQC extension is designed to be used **alongside** PQCMM: the PKIMM extension scores the organization's governance and operational readiness; PQCMM scores the dependencies. Integration guidance is on the working group's roadmap. - -## YAML definition - -The machine-readable definition of the PQC Readiness Extension is in [`pqc-extension.yaml`](./pqc-extension.yaml). Tools consume the YAML directly; this page is the human-readable companion. The YAML is the canonical source for assessment use — the prose above is a summary. - -## References - -- **NIST FIPS 203 / 204 / 205** — ML-KEM, ML-DSA, SLH-DSA (August 2024) -- **NIST SP 800-131A Rev. 3** — Transitioning the Use of Cryptographic Algorithms and Key Lengths -- **NIST CSWP 39** — Considerations for Achieving Cryptographic Agility -- **NIST SP 800-208** — Stateful Hash-Based Signatures -- **CNSA 2.0** — NSA Commercial National Security Algorithm Suite 2.0 (2022) -- **Regulation (EU) 2022/2554 (DORA)** — Digital Operational Resilience Act -- **Regulation (EU) 2024/1183 (eIDAS 2.0)** -- **NIS2 Implementing Regulation 2024/2690** -- **18 EU Member States Joint Statement on Post-Quantum Cryptography** -- **Dutch PQC Migration Handbook** -- **CycloneDX Cryptography Bill of Materials (CBOM)** - -## Attribution - -This extension is based on the *Proposal for Post-Quantum Cryptography Readiness Extension to the PKI Maturity Model (PKIMM)* (Draft v1.3, December 2025) prepared for the PKI Consortium by Kennedy Nwup, Principal Consultant — Post-Quantum Cryptography & PKI Readiness, Afield AB. diff --git a/extensions/catalog/pqc/pqc-extension.yaml b/extensions/catalog/pqc/pqc-extension.yaml deleted file mode 100644 index f62c470..0000000 --- a/extensions/catalog/pqc/pqc-extension.yaml +++ /dev/null @@ -1,478 +0,0 @@ -schemaVersion: 1.0.0 -extension: - id: pqc - name: PQC Readiness Extension - version: 0.2.0 - description: Extends the assessment model with post-quantum cryptography (PQC) readiness criteria, maturity guidance, and PQC-specific requirement weight overlays to evaluate strategic, policy, compliance, and operational preparedness for quantum-safe PKI transition. - documentation: https://pkic.org/wg/pkimm/model/extensions/catalog/pqc/ - compatibility: - - 2.0.0 - floorScore: true -references: -- id: mosca-inequality - title: 'Mosca Inequality: Cryptographic Risk Timeline Framework' - authority: Michele Mosca (Academic) -- id: dutch-pqc-handbook - title: PQC Migration Handbook v2.0 - authority: Dutch NCSC/AIVD/TNO/CWI - url: https://publications.tno.nl/publication/34643386/fXcPVHsX/TNO-2024-pqc-en.pdf -- id: nist-fips-203 - title: NIST FIPS 203 - Module-Lattice-Based Key-Encapsulation Mechanism Standard (ML-KEM) - authority: NIST - url: https://csrc.nist.gov/pubs/fips/203/final -- id: nist-fips-204 - title: NIST FIPS 204 - Module-Lattice-Based Digital Signature Standard (ML-DSA) - authority: NIST - url: https://csrc.nist.gov/pubs/fips/204/final -- id: nist-fips-205 - title: NIST FIPS 205 - Stateless Hash-Based Digital Signature Standard (SLH-DSA) - authority: NIST - url: https://csrc.nist.gov/pubs/fips/205/final -- id: uk-ncsc-pqc-migration - title: Timelines for Migration to Post-Quantum Cryptography (2028/2031/2035 milestones) - authority: UK NCSC - url: https://www.ncsc.gov.uk/guidance/pqc-migration-timelines -- id: bsi-pqc-migration - title: Migration to Post-Quantum Cryptography - authority: BSI (Federal Office for Information Security, Germany) - url: https://www.bsi.bund.de/EN/Themen/Unternehmen-und-Organisationen/Informationen-und-Empfehlungen/Quantentechnologien-und-Post-Quanten-Kryptografie/Post-Quanten-Kryptografie/post-quanten-kryptografie_node.html -- id: anssi-pqc-position - title: Views on the Post-Quantum Cryptography Transition - authority: ANSSI (Agence nationale de la sécurité des systèmes d'information, France) - url: https://cyber.gouv.fr/en/publications/anssi-views-post-quantum-cryptography-transition -- id: etsi-tr-103-619 - title: ETSI TR 103 619 - Migration strategies for quantum-safe schemes - authority: ETSI -- id: nist-ir-8413 - title: NIST IR 8413 - Status Report on the Third Round of the NIST Post-Quantum Cryptography Standardization Process - authority: NIST - url: https://csrc.nist.gov/pubs/ir/8413/final -relevance: - modules: - - id: G - categories: - - id: strategy-and-vision - weight: 5 - guidance: | - Strategy and vision form the foundation for quantum-safe transition. Without executive sponsorship recognizing the quantum threat, PQC migration will lack resources and priority. The Dutch Migration Handbook identifies organizational personas ranging from 'unaware' to 'frontrunner,' with most European organizations currently in early awareness stages. Strategic planning must address the Mosca inequality: if data sensitivity lifespan plus migration time exceeds time until cryptographically relevant quantum computers (CRQC), action is required now. - assessment: | - Key Probes: - - Can executives articulate the quantum threat to PKI operations? - - Is PQC mentioned in strategic planning documents? - - Has the organization assessed its Mosca inequality position? - - What regulatory deadlines has the organization identified as applicable? - - Is budget allocated specifically for PQC activities? - - Critical Transitions: - - Level 2→3: 'Awareness to Action' - formal strategy incorporation, executive sponsorship extended, working group established - - Level 4→5: 'Execution to Leadership' - competitive positioning, ecosystem contribution, crypto-agility as ongoing capability - - Warning Signs: - - 'We'll address it when vendors are ready' - vendor timelines may not align with regulatory requirements - - No executive able to discuss quantum risk - indicates awareness gap at leadership level - - PQC treated as purely technical matter - missing governance and strategic dimensions - - Assuming extended timeline - UK NCSC sets migration milestones through 2028/2031/2035; financial sector guidance warns risk could materialize within 10-15 years or sooner - - Evidence Examples by Level: - - Level 2: Email/meeting notes showing PQC discussed; informal awareness materials - - Level 3: Board presentation on quantum risk; PQC working group charter; budget line item for PQC; Mosca analysis document - - Level 4: Quarterly PQC steering committee minutes; ERM risk register with quantum risk entry; KRI dashboard showing PQC metrics; multi-year migration budget approval - - Level 5: Published thought leadership; standards body participation records; regulator consultation responses; crypto-agility architecture documentation - references: [] - levels: - - number: 1 - name: Initial - description: | - - No awareness of quantum computing threat to PKI cryptographic foundations - - PKI strategy documents silent on algorithm longevity or transition planning - - Executive sponsors unaware of PQC as a strategic consideration - - No recognition that current cryptographic choices have finite security lifespan - - number: 2 - name: Foundational - description: | - - General awareness that quantum computing may impact cryptographic security - - PQC mentioned informally but not incorporated into PKI strategy - - Executive sponsors aware of quantum threat but not prioritizing action - - No formal assessment of organization's quantum risk exposure - - 'Wait and see' stance toward PQC standards and vendor solutions - - number: 3 - name: Advanced - description: | - - PKI strategy explicitly addresses PQC migration as strategic priority - - Executive sponsorship formally extended to cover quantum-safe transition - - Mosca inequality assessed for key data assets and certificate types - - Organization has identified its persona per Dutch Migration Handbook framework - - Strategic roadmap includes PQC milestones aligned to regulatory timelines - - Board/governance body briefed on quantum risk and migration requirements - - Budget allocation for PQC assessment and initial planning activities - - Cross-functional PQC working group or steering committee established - - number: 4 - name: Managed - description: | - - PQC migration fully integrated into PKI strategic planning cycle - - Executive sponsorship active and sustained (not just initial approval) - - Cascading sponsorship established across affected business units - - Quantum risk integrated into Enterprise Risk Management framework - - Key Risk Indicators (KRIs) defined for PQC migration progress - - Strategy reviewed and updated quarterly against regulatory developments - - Board receives regular quantum readiness updates as governance matter - - Multi-year budget secured for complete migration programme - - Strategy explicitly addresses hybrid vs pure PQ approach with rationale - - number: 5 - name: Optimized - description: | - - PQC strategy recognized as competitive differentiator and trust enabler - - Organization positioned as quantum-ready ahead of regulatory mandates - - Strategic planning anticipates cryptographic evolution beyond current PQC standards - - Executive sponsors actively engaged in industry PQC initiatives - - Contributing to standards development and industry best practices - - Strategy enables crypto-agility as ongoing capability, not one-time transition - - Proactive engagement with regulators on PQC implementation approaches - - Strategic partnerships with quantum-safe technology providers established - - id: policies-and-documentation - weight: 5 - guidance: | - RFC 3647 governs Certificate Policy and CPS structure. PQC migration requires fundamental policy updates: algorithm specifications must expand to include NIST FIPS 203/204/205 (ML-KEM, ML-DSA, SLH-DSA), deprecation schedules must align with SP 800-131A Rev 3 and regional requirements, hybrid vs pure PQC strategy must be documented, and Cryptographic Bill of Materials (CBOM) requirements are emerging as compliance necessity. - Multi-jurisdiction complexity creates policy challenges: European regulators (BSI, ANSSI) require hybrid signatures during transition, while CNSA 2.0 recommends pure PQ for US National Security Systems. Key management policies must address larger key sizes, HSM PQC support requirements, and stateful hash-based signature state management where applicable. - assessment: | - Key Probes: - - When was CP/CPS last updated? Does it reference PQC algorithms? - - Does approved algorithm list include deprecation dates? - - Can the organization produce a CBOM? - - How does Key Management Policy address PQC key sizes and HSM requirements? - - How are regional regulatory differences (EU hybrid vs US pure PQ) addressed? - - Warning Signs: - - CP/CPS last updated before August 2024 (pre-NIST standardization) - - Algorithm list lacks deprecation dates - - 'We'll update when vendors support PQC' - reactive rather than proactive stance - - No awareness of regional requirement differences - - CBOM mentioned but no artifacts produced - - Evidence Examples by Level: - - Level 2: Internal memo acknowledging CP/CPS needs updating; informal algorithm inventory - - Level 3: CP/CPS amendment project plan; approved algorithm list with PQC entries and deprecation dates; CBOM generation tool deployed; hybrid strategy decision document - - Level 4: Published CP/CPS with PQC provisions; algorithm governance meeting minutes; CBOM integrated with CI/CD pipeline; compliance audit report including algorithm verification - - Level 5: Policy templates shared with industry; algorithm governance anticipating draft standards; CBOM feeding into ERM dashboard; multi-jurisdiction policy variant management system - references: [] - levels: - - number: 1 - name: Initial - description: | - - CP/CPS silent on algorithm longevity or quantum vulnerability - - No approved algorithm list with deprecation schedules - - Key Management Policy does not reference algorithm transitions - - No CBOM or cryptographic inventory documentation exists - - number: 2 - name: Foundational - description: | - - Awareness that CP/CPS will need PQC updates, but no changes made - - Algorithm lists exist but without deprecation schedules or PQC additions - - No documented hybrid vs pure PQC strategy decision - - Cryptographic inventory exists informally but not in CBOM format - - Regional regulatory requirements not mapped to policy - - number: 3 - name: Advanced - description: | - - CP/CPS formally under review with PQC amendment project initiated - - Approved algorithm list explicitly includes: - - Current classical algorithms with deprecation dates aligned to SP 800-131A - - PQC algorithms (ML-KEM, ML-DSA, SLH-DSA) with implementation timeline - - Hybrid requirements per applicable regulatory framework - - Hybrid vs pure PQC strategy documented with regulatory rationale - - Key Management Policy updated for PQC considerations (larger keys, HSM support, stateful HBS state management) - - CBOM framework adopted; initial cryptographic inventory underway - - Multi-jurisdiction policy alignment documented - - number: 4 - name: Managed - description: | - - CP/CPS formally updated with PQC provisions published - - Algorithm governance process established with quarterly review and formal add/deprecate procedures - - CBOM generated and maintained, integrated with SDLC - - Policy compliance monitoring established (audits verify algorithm usage) - - Cross-functional policy governance (legal/compliance, architecture, procurement) - - number: 5 - name: Optimized - description: | - - Policy documentation treated as strategic asset enabling competitive positioning - - Algorithm governance anticipates regulatory changes through standards body participation - - CBOM integrated with ERM, supply chain security, incident response - - Policy enables crypto-agility (abstract specifications, modular structure, tested migration procedures) - - Multi-jurisdiction complexity managed proactively with maintained policy variants - - Contributing to ecosystem (policy templates shared, lessons learned published) - - id: compliance - weight: 5 - guidance: | - The regulatory landscape for PQC is evolving rapidly with binding requirements now in effect. DORA establishes comprehensive ICT risk management requirements for EU financial entities from January 2025, creating regulatory pressure for cryptographic resilience. The EU Coordinated Roadmap recommends PQC preparations by 2026 with critical infrastructure protection by 2030. The 18 EU Member States Joint Statement urges prioritization and roadmap development for PQC transition. CNSA 2.0 mandates PQC for US National Security Systems with preference by 2025, exclusive use by 2030-2035. - Industry standards are adapting: CA/Browser Forum S/MIME BR includes PQC algorithms (Ballot SMC013), ETSI ESI standards are updating for QSC/PQC, and WebTrust/ETSI audit criteria are evolving. Non-conformity with PQC requirements carries material risk: certificates issued today with quantum-vulnerable cryptography may be compromised before expiration. - assessment: | - Sector-Specific Considerations: - - Financial Services (EU): DORA compliance mandatory from January 2025 - - Trust Services (EU): eIDAS 2.0 wallet by 2026 creates implicit PQC requirements - - Critical Infrastructure: NIS2 and its implementing measures reinforce governance and control expectations for security measures including cryptography, creating indirect pressure for cryptographic agility - - Government/Defense: CNSA 2.0 timelines binding; agency-specific deadlines may be earlier - - Healthcare: Long data sensitivity horizons make HNDL threat particularly relevant - - Warning Signs: - - Compliance team cannot articulate DORA requirements or applicable PQC regulations - - No regulatory mapping document exists - - Audit scope unchanged since before August 2024 - - 'Waiting for auditors to tell us' - reactive compliance stance - - Multi-jurisdiction strategy absent - - Evidence Examples by Level: - - Level 2: Informal tracking of PQC regulatory developments; awareness communications - - Level 3: Regulatory mapping spreadsheet/document; gap analysis report; compliance roadmap with PQC milestones; audit criteria review request - - Level 4: Quarterly compliance status reports; third-party audit report including PQC scope; regulatory horizon scanning process documentation; trend analysis of algorithm-related non-conformities - - Level 5: Regulatory consultation submissions; standards body meeting attendance records; published compliance frameworks; cross-border compliance harmonization documentation - references: [] - levels: - - number: 1 - name: Initial - description: | - - No awareness of PQC-specific regulatory requirements - - Compliance framework does not reference quantum threats or PQC standards - - Audit scope does not include cryptographic algorithm assessment - - Non-conformity management does not track algorithm deprecation - - DORA ICT risk management implications not recognized (if applicable) - - number: 2 - name: Foundational - description: | - - General awareness that PQC compliance requirements are emerging - - No formal mapping of PQC requirements to compliance obligations - - Audit scope unchanged; PQC not included in audit criteria - - Non-conformity tracking does not distinguish quantum-vulnerable algorithms - - Industry standard updates (WebTrust, ETSI) tracked informally - - number: 3 - name: Advanced - description: | - - Formal regulatory mapping completed for applicable PQC requirements: - - DORA ICT risk management requirements (EU financial services) - - eIDAS 2.0 cryptographic requirements (EU trust services) - - CNSA 2.0 timeline (if US NSS-related operations) - - NIS2 Implementing Regulation 2024/2690 (if applicable) - - 18 EU Member States Joint Statement recommendations - - Gap analysis conducted against applicable requirements - - Compliance roadmap developed with PQC milestones aligned to regulatory deadlines - - Audit criteria review initiated (WebTrust/ETSI scope expansion for PQC) - - Non-conformity categories updated to include quantum-vulnerable algorithm usage - - Multi-jurisdiction compliance strategy documented - - number: 4 - name: Managed - description: | - - Active compliance program executing against PQC requirements - - Cryptographic risk monitoring process established aligned with DORA ICT risk requirements - - 'Leading practices and standards' tracking formalized - - Quarterly compliance status reporting to management - - Audit program includes PQC assessment: - - Algorithm compliance verification - - CBOM completeness assessment - - Hybrid/pure implementation verification - - Vendor compliance verification - - Third-party audit readiness demonstrated - - Non-conformity management mature with trend analysis - - Regulatory horizon scanning for emerging requirements - - number: 5 - name: Optimized - description: | - - Compliance program anticipates and shapes PQC regulation through: - - Regulatory consultations and standards development participation - - National cyber agency engagement - - Industry leadership and framework sharing - - Audit program sets industry benchmark (exceeds minimum requirements) - - Compliance integrated with ERM (quantum risk quantified, regulatory risk appetite defined) - - Continuous improvement with effectiveness metrics and post-regulatory change reviews - - Cross-border compliance excellence with harmonized approach and interoperability testing - - id: processes-and-procedures - weight: 5 - guidance: | - The transition to post-quantum cryptography transforms operational processes fundamentally. This is not merely an algorithm swap; it represents a multi-year major programme requiring new procedures across every PKI operational domain. - Key process considerations include: key ceremony evolution for PQC algorithms (larger keys, hybrid generation, stateful HBS state management), crypto-agility procedures per NIST CSWP 39, quantum risk assessment integration using the Mosca inequality framework, operational change management for phased migration, incident response for cryptographic events, and extended segregation of duties for PQC-specific roles. - assessment: | - Key Probes: - - Can the organization demonstrate a key ceremony script that includes PQC algorithms? - - How is quantum risk incorporated into the enterprise risk register? - - What is the documented time-to-transition for algorithm changes? - - How would the organization respond to a cryptanalytic breakthrough announcement? - - Who is the designated PQC migration lead? - - Warning Signs: - - Key ceremony scripts last updated before August 2024 - - 'We'll update procedures when we deploy PQC' - reactive stance - - Risk assessment treats quantum as distant future threat - - No designated migration lead or crypto-agility coordinator - - 'Our vendor will handle the transition' - outsourcing responsibility without oversight - - Evidence Examples by Level: - - Level 2: Email threads discussing PQC procedure updates; vendor roadmap documents collected - - Level 3: Updated key ceremony script with PQC algorithm support; Mosca analysis in risk register; documented migration lead role; crypto-agility procedure draft; incident response playbook with cryptographic scenarios - - Level 4: Completed PQC key ceremony records; quarterly quantum risk review minutes; time-to-transition metrics dashboard; tabletop exercise after-action reports; HSM firmware change records - - Level 5: Algorithm substitution drill results showing minutes-not-hours capability; automated non-compliant algorithm detection logs; published incident response playbooks; industry working group contributions - - Suggested KPIs for Level 4/5: - - Time-to-transition: Hours required to substitute algorithm across PKI - - Crypto inventory coverage: Percentage of systems with CBOM - - Incident response time: Hours from cryptographic event detection to containment - - Procedure currency: Days since last PQC procedure review - references: [] - levels: - - number: 1 - name: Initial - description: | - - Operational procedures do not reference PQC or quantum threats - - Key ceremony scripts unchanged from pre-PQC era - - Risk assessment methodology does not incorporate quantum threat modelling - - No crypto-agility procedures exist; algorithm changes require ad-hoc engineering - - Incident response procedures do not include cryptographic failure scenarios - - Segregation of duties does not address PQC-specific roles - - number: 2 - name: Foundational - description: | - - Awareness that operational procedures will require PQC updates - - Key ceremony scripts under informal review for PQC compatibility - - Risk assessment includes general awareness of quantum threat - - Crypto-agility recognized as requirement but no documented procedures - - Change management acknowledges PQC as future initiative - - HSM vendor roadmaps reviewed informally for PQC support timeline - - number: 3 - name: Advanced - description: | - - Key ceremony procedures formally updated for PQC: - - Scripts support hybrid key generation (classical + PQC simultaneous) - - Quorum requirements defined for PQC key material - - HSM initialization procedures include PQC algorithm activation - - Stateful HBS state management procedures documented (if applicable) - - Risk assessment methodology formally extended: - - Mosca inequality analysis incorporated for data prioritization - - Quantum risk categories integrated into existing risk register - - HNDL threat explicitly assessed for high-value data assets - - Crypto-agility procedures documented with algorithm substitution and rollback - - Change management integrates PQC migration changes with CAB process - - Incident response extended for cryptanalytic breakthrough and algorithm deprecation scenarios - - PQC-specific roles defined (migration lead, crypto-agility coordinator) - - Dual control requirements extended to PQC operations - - number: 4 - name: Managed - description: | - - Operational procedures actively supporting PQC migration execution - - Key ceremonies conducted with PQC algorithms (hybrid or pure per policy) - - Risk assessment continuous with quarterly quantum risk review - - Crypto-agility demonstrated through tested transitions and validated rollback - - Time-to-transition metrics established and monitored - - Change management mature with cross-functional CAB including crypto-competent reviewers - - Incident response tested through tabletop exercises including cryptographic scenarios - - Segregation of duties enforced and verified through audit - - number: 5 - name: Optimized - description: | - - Operational procedures embody crypto-agility as core design principle - - Algorithm substitution achievable in minutes, not hours - - Automated detection of non-compliant algorithm usage - - Risk assessment anticipates threat timeline evolution with scenario planning - - Change management enables rapid cryptographic changes with pre-approved templates - - Emergency change procedures for cryptographic incidents - - Incident response coordinated with external parties and national cyber agencies - - Contributing to industry procedure standards - - Procedures support crypto-agility beyond PQC for future algorithm transitions -overlays: - modules: - - id: G - categories: - - id: strategy-and-vision - requirements: - - id: sponsor-support - type: multiplier - multiplier: 2.0 - rationale: | - PQC requires active multi-year executive commitment, cascading sponsorship, quantum risk in ERM. These are new demands absent in classical PKI. - - id: responsible-leadership - type: multiplier - multiplier: 2.0 - rationale: | - PQC requires entirely new roles (migration lead, crypto-agility coordinator, steering committee) not present in classical PKI. - - id: scope-and-drivers - type: multiplier - multiplier: 2.0 - rationale: | - PQC introduces new business drivers (HNDL threat, Mosca inequality, regulatory timelines) absent in classical PKI. - - id: architecture - type: multiplier - multiplier: 2.5 - rationale: | - Extreme outlier. Base weight 1 (floor) yet hybrid vs pure PQ, algorithm selection, HSM compatibility are among the most consequential PQC decisions. Largest gap between base weight and PQC importance in Module 1. - - id: policies-and-documentation - requirements: - - id: policy-scope - type: multiplier - multiplier: 1.5 - rationale: | - Policy scope expands (multi-jurisdiction, PQC obligations) but the core activity remains 'define and document policy scope'. - - id: certificate-policy - type: multiplier - multiplier: 1.5 - rationale: | - CP requires fundamental rewrite for PQC: algorithm specifications, deprecation schedules, hybrid requirements, CBOM. Weight is max but PQC transforms what CP must contain. - - id: practice-statement - type: multiplier - multiplier: 1.5 - rationale: | - CPS requires new operational procedures for PQC: key ceremony scripts, HSM initialization, stateful HBS management. Weight is max but content changes fundamentally. - - id: disclosure-statement - type: multiplier - multiplier: 1.5 - rationale: | - Disclosure scope expands (relying parties need quantum readiness posture) but core activity remains 'publish disclosure.' Weight 4 already substantial. - - id: policy-review - type: multiplier - multiplier: 2.0 - rationale: | - PQC demands fundamentally new review discipline: quarterly algorithm governance with formal add/deprecate procedures. This is a new governance process, not faster review. - - id: compliance - requirements: - - id: compliance-policies - type: multiplier - multiplier: 2.0 - rationale: | - PQC introduces entirely new compliance domain: DORA quantum requirements, CNSA 2.0, eIDAS 2.0 crypto requirements. New obligations, not expanded existing ones. - - id: compliance-monitoring - type: multiplier - multiplier: 1.5 - rationale: | - Monitoring scope expands (PQC audit criteria, CBOM verification) but core activity remains 'operate compliance monitoring program'. - - id: compliance-responsibilities - type: multiplier - multiplier: 1.5 - rationale: | - Existing compliance roles expand to cover PQC obligations. New interfaces needed but responsibility assignment is the same core activity. - - id: regulatory-inventory - type: multiplier - multiplier: 1.0 - rationale: | - EXPLICITLY assigned 1.0x in v1.3 Section 7.1: 'Already highest weight.' PQC adds entries to the list but the activity of maintaining the list is unchanged. Framework confirms. - - id: processes-and-procedures - requirements: - - id: process-scope - type: multiplier - multiplier: 1.5 - rationale: | - Process scope expands to cover PQC activities but the core activity remains 'align process scope with policy scope'. - - id: process-documentation - type: multiplier - multiplier: 2.0 - rationale: | - PQC introduces fundamentally new processes: hybrid key ceremonies, Mosca analysis, crypto-agility with substitution/rollback. New processes, not expanded documentation. - - id: bau-execution - type: multiplier - multiplier: 1.0 - rationale: | - Timely execution remains 'execute recurring activities on time.' PQC adds urgency (ANSSI 2027, CNSA 2.0) but the nature of timely execution is unchanged. Weight at max. - - id: process-evidence - type: multiplier - multiplier: 2.0 - rationale: | - PQC introduces entirely new evidence categories: PQC key ceremony records, algorithm substitution drill results, CBOM artifacts, time-to-transition metrics. New evidence discipline. - - id: process-improvement - type: multiplier - multiplier: 2.0 - rationale: | - PQC demands fundamentally different review cadence. Evolving standards require near-continuous updates, not periodic review. diff --git a/extensions/catalog/templates/_index.md b/extensions/catalog/templates/_index.md deleted file mode 100644 index e3970ab..0000000 --- a/extensions/catalog/templates/_index.md +++ /dev/null @@ -1,70 +0,0 @@ ---- -date: "2026-05-13T7:00:00Z" -title: Extension documentation template -build: - render: never - list: never - ---- - -# Extension documentation template - -This document is a template for the documentation page of an extension in the [Extension catalog](../). Every extension's `_index.md` should follow the structure below so readers can quickly find the same information across extensions. - -## How to use this template - -- Copy this file to a new folder under `extensions/catalog//_index.md`. -- Place the corresponding `-extension.yaml` file in the same folder. -- Replace parts written in *italic* with the extension's actual content. -- Remove any sections that don't apply, but keep their headings unchanged when they do apply. -- Remove the `draft: true` front-matter flag once the page is ready to publish. -- Add the extension to the table in [`extensions/catalog/_index.md`](../). - ---- - -# *[Extension name]* - -*[One short paragraph stating the extension's purpose: what aspect of PKI maturity it covers and why it exists. Two to four sentences.]* - -*[A second short paragraph providing additional context — for example, the threat model it addresses, the regulatory drivers, or the use case where the extension is most useful.]* - -## Status - -*[State the maturity of the extension. Use one of the badges from the catalog (`Under development`, `Release candidate`, `Stable`, `Deprecated`).]* - -- **Complete** — *[Which modules / categories have full Level 1–5 criteria, assessor guidance, and overlay weights defined.]* -- **Outline** — *[Which modules / categories are identified but not yet fully developed.]* -- **YAML version** — *[The version field in the YAML, with a short note about what triggers a version bump.]* - -*[If there are unresolved design decisions or open questions that affect interpretation, list them here. Each item should be one or two sentences pointing at the trade-off.]* - -## Scope - -*[Who is the extension for? List the primary audiences (e.g., CA operators, PKI architects, auditors) and explicitly call out audiences that are NOT covered or are covered shallowly.]* - -## What the extension covers - -*[Section per PKI MM module that the extension addresses. For each category provide a 1–3 paragraph summary of what PQC-specific (or extension-specific) maturity looks like. The YAML is the canonical source of the Level 1–5 criteria — the prose here orients the reader.]* - -### *[PKI MM Module name]* - -#### *[Category N — name]* - -*[Short summary of how this extension's criteria differ from or extend the baseline PKI MM category. Keep this to a few sentences — the level criteria live in the YAML.]* - -*[Optional: highlight critical transitions, key probes, or evidence examples that don't fit cleanly into level criteria.]* - -## YAML definition - -The machine-readable definition of this extension is in [`-extension.yaml`](./-extension.yaml). Tools consume the YAML directly; this page is the human-readable companion. - -## References - -*[Bulleted list of standards, regulations, and other sources the extension draws on. Prefer authoritative primary sources (NIST, ETSI, ISO, regulatory texts).]* - -- *[Reference 1]* -- *[Reference 2]* - -## Attribution - -*[Optional. Credit the authors and contributors. Useful if the extension was prepared by an external party or working group sub-team.]* diff --git a/extensions/extension.schema-1.0.0.json b/extensions/extension.schema-1.0.0.json index 331dc29..16999d7 100644 --- a/extensions/extension.schema-1.0.0.json +++ b/extensions/extension.schema-1.0.0.json @@ -1,7 +1,7 @@ { "$schema": "https://json-schema.org/draft/2020-12/schema", "title": "PKI MM Extension schema", - "description": "Schema for extensions to the PKI Maturity Model (extensions/catalog//-extension.yaml). See https://pkic.org/wg/pkimm/model/extensions/ for the framework documentation.", + "description": "Schema for extensions to the PKI Maturity Model. Extension definitions live in the pkimm-extensions repository (/-extension.yaml). See https://pkic.org/wg/pkimm/model/extensions/ for the framework documentation and https://pkic.org/wg/pkimm/extensions/ for the catalog.", "version": "1.0.0", "type": "object", "required": ["schemaVersion", "extension", "relevance", "overlays"], diff --git a/faq/_index.md b/faq/_index.md index 4b2bab0..d7cea74 100644 --- a/faq/_index.md +++ b/faq/_index.md @@ -57,7 +57,7 @@ Growing importance of PKI maturity assessment is also reflected in the increasin ## Where can I access the assessment tools? -Available assessment tools and resources can be found in the [Tools](../tools/) section of the PKI MM documentation. The tools include the PKI maturity assessment questionnaire, guidance on conducting the assessment, and templates for reporting the assessment results. +Available assessment tools and resources can be found via the [PKI maturity self-assessment](https://pkic.org/wg/pkimm/assessment/), the web-based tool that superseded the earlier Excel-based assessment tool (still available under the 1.0.0 tag / website section). The tools include the PKI maturity assessment questionnaire, guidance on conducting the assessment, and templates for reporting the assessment results. The tools are designed to help organizations assess the maturity of their PKI and identify areas for improvement and are updated regularly to reflect the latest best practices and industry standards. diff --git a/integrations/eramba/convert-yaml-data-to-csv-package-1.0.0.py b/integrations/eramba/convert-yaml-data-to-csv-package-1.0.0.py deleted file mode 100644 index 6e72d20..0000000 --- a/integrations/eramba/convert-yaml-data-to-csv-package-1.0.0.py +++ /dev/null @@ -1,80 +0,0 @@ -import yaml -import pandas as pd -import re -import jsonschema -import json - -# Load the YAML content from the uploaded file -model_version = '1.0.0' -file_path = f'../../data/pkimm-model-{model_version}.yaml' -with open(file_path, 'r') as file: - data = yaml.safe_load(file) - -# Sanity-check that the filename and the YAML's version field agree -if data.get('version') != model_version: - raise ValueError( - f"Version mismatch: filename declares {model_version}, " - f"YAML declares {data.get('version')!r}" - ) - -# Load the JSON schema from the uploaded file -schema_file_path = '../../data/pkimm-model.schema-1.0.0.json' -with open(schema_file_path, 'r') as schema_file: - schema = json.load(schema_file) - -# Validate the YAML content against the schema -try: - jsonschema.validate(data, schema) - print("Validation successful") -except jsonschema.ValidationError as e: - print(f"Validation error: {e.message}") - -# Function to clean the references by removing markdown links but keeping the text with dashes -def clean_references_preserve_text(ref): - # Replace markdown links with just the text inside the brackets - cleaned_references = re.sub(r'\[([^\]]+)\]\([^\)]+\)', r'\1', ref) - return cleaned_references - -# Prepare lists to hold the structured data for the CSV -chapters = [] -items = [] - -# Extract data according to the specified structure with the new Chapter ID and Item ID format -for module in data.get('modules', []): - module_id = module.get('id', '') - for category in module.get('categories', []): - chapter_id = f"{module_id}.{category.get('id', '')}" - chapter_name = category.get('name', '') - chapter_description = category.get('description', '') - for requirement in category.get('requirements', []): - item_id = f"{chapter_id}.{requirement.get('id', '')}" - item_name = requirement.get('description', '') - item_description = requirement.get('guidance', '') - assessment = requirement.get('assessment', '') - references = requirement.get('references', '') - clean_ref = clean_references_preserve_text(references) - item_additional_info = f"Assessment\n{assessment}\nReferences\n{clean_ref}" - - # Append the data to the lists - chapters.append([chapter_id, chapter_name, chapter_description]) - items.append([item_id, item_name, item_description, item_additional_info]) - -# Convert the lists to dataframes -chapters_df = pd.DataFrame(chapters, columns=["Chapter ID", "Chapter Name", "Chapter Description"]) -items_df = pd.DataFrame(items, columns=["Item ID", "Item Name", "Item Description", "Item Additional Information"]) - -# Since the chapter IDs and item IDs are structured, we can extract the chapter ID part from item ID -items_df['Chapter ID'] = items_df['Item ID'].apply(lambda x: '.'.join(x.split('.')[:-1])) - -# Merge the dataframes on Chapter ID to get the final structure -result_df = pd.merge(chapters_df, items_df, on="Chapter ID") - -# Remove duplicate rows from the dataframe -result_df.drop_duplicates(inplace=True) - -# Save the final dataframe to CSV without the header -csv_file_path_no_header = f'pkimm-{model_version}.csv' -result_df.to_csv(csv_file_path_no_header, index=False, header=False, lineterminator='\n') - -# Provide the path for download -csv_file_path_no_header diff --git a/integrations/eramba/convert-yaml-data-to-csv-package-2.0.0.py b/integrations/eramba/convert-yaml-data-to-csv-package-2.0.0.py deleted file mode 100644 index fa3e756..0000000 --- a/integrations/eramba/convert-yaml-data-to-csv-package-2.0.0.py +++ /dev/null @@ -1,96 +0,0 @@ -import yaml -import pandas as pd -import jsonschema -import json - -# Load the YAML content from the canonical data file -model_version = '2.0.0' -file_path = f'../../data/pkimm-model-{model_version}.yaml' -with open(file_path, 'r') as file: - data = yaml.safe_load(file) - -# Sanity-check that the filename and the YAML's version field agree -if str(data.get('version')) != model_version: - raise ValueError( - f"Version mismatch: filename declares {model_version}, " - f"YAML declares {data.get('version')!r}" - ) - -# Load the JSON schema -schema_file_path = '../../data/pkimm-model.schema-2.0.0.json' -with open(schema_file_path, 'r') as schema_file: - schema = json.load(schema_file) - -# Validate the YAML content against the schema -try: - jsonschema.validate(data, schema) - print("Validation successful") -except jsonschema.ValidationError as e: - print(f"Validation error: {e.message}") - -# Load the references catalog and build a lookup dict by id -refs_catalog = yaml.safe_load(open('../../data/pkimm-references.yaml'))['references'] -ref_by_id = {r['id']: r for r in refs_catalog} - - -def resolve_references(ref_ids): - """Resolve a list of catalog reference IDs into a formatted string matching - the 1.0.0 CSV style: one '- Title' line per reference (no URLs).""" - if not ref_ids: - return '' - lines = [] - for ref_id in ref_ids: - ref = ref_by_id.get(ref_id) - if ref: - lines.append(f"- {ref['title']}") - else: - lines.append(f"- {ref_id}") - return '\n'.join(lines) - - -# Prepare lists to hold the structured data for the CSV -chapters = [] -items = [] - -# Extract data according to the specified structure. -# Category IDs are kebab-case in 2.0.0; requirement IDs are also kebab-case. -# Level names are unprefixed (e.g. "Foundational"); the composed form would be -# "${number} - ${name}" but levels are not output as a column in the CSV. -for module in data.get('modules', []): - module_id = module.get('id', '') - for category in module.get('categories', []): - chapter_id = f"{module_id}.{category.get('id', '')}" - chapter_name = category.get('name', '') - chapter_description = category.get('description', '') - for requirement in category.get('requirements', []): - item_id = f"{chapter_id}.{requirement.get('id', '')}" - item_name = requirement.get('description', '') - item_description = requirement.get('guidance', '') - assessment = requirement.get('assessment', '') - references = requirement.get('references', []) - resolved_refs = resolve_references(references) - item_additional_info = f"Assessment\n{assessment}\nReferences\n{resolved_refs}" - - # Append the data to the lists - chapters.append([chapter_id, chapter_name, chapter_description]) - items.append([item_id, item_name, item_description, item_additional_info]) - -# Convert the lists to dataframes -chapters_df = pd.DataFrame(chapters, columns=["Chapter ID", "Chapter Name", "Chapter Description"]) -items_df = pd.DataFrame(items, columns=["Item ID", "Item Name", "Item Description", "Item Additional Information"]) - -# Extract the chapter ID part from item ID (everything before the last dot-segment) -items_df['Chapter ID'] = items_df['Item ID'].apply(lambda x: '.'.join(x.split('.')[:-1])) - -# Merge the dataframes on Chapter ID to get the final structure -result_df = pd.merge(chapters_df, items_df, on="Chapter ID") - -# Remove duplicate rows from the dataframe -result_df.drop_duplicates(inplace=True) - -# Save the final dataframe to CSV without the header -csv_file_path_no_header = f'pkimm-{model_version}.csv' -result_df.to_csv(csv_file_path_no_header, index=False, header=False, lineterminator='\n') - -# Provide the path for download -print(f"Output written to: {csv_file_path_no_header}") diff --git a/integrations/eramba/pkimm-1.0.0.csv b/integrations/eramba/pkimm-1.0.0.csv deleted file mode 100644 index 0222f53..0000000 --- a/integrations/eramba/pkimm-1.0.0.csv +++ /dev/null @@ -1,1960 +0,0 @@ -G.1,Strategy and Vision,"Trusted and secure PKI must be properly managed and supported by the organization. The existence of a strategy and vision for the PKI is one of the key factors for the success of the PKI and contributes to the overall maturity. The strategy and vision should be aligned with the organizational goals and approach and should be followed and measured regularly. - -Formal documentation about the business drivers, scope, and design of the PKI helps to ensure that the PKI is properly aligned and understood to support the organizational. The documentation should be reviewed and updated regularly to ensure that the PKI is aligned with the organizational goals and needs. - -Undefined or unclear understanding and leadership can cause loss of the established trust and can lead to the failure of the PKI quickly. -",G.1.1,Organizational sponsor and support,"The success of the PKI implementation highly depends on the organization top management support. Top management typically also acts as a sponsor of the PKI, meaning that they allocate and approve budget needed to build and maintain the PKI. - -The basic assumption is that the established digital trust is going to be maintained and developed for years, and therefore it is important to have a long-term vision and strategy for the PKI. The strategy and vision should be aligned with the overall organizational goals and approach. -","Assessment -The following is sample evidence that can be used to assess the requirement: -- Interview with the top management -- Documented strategy and vision -- Documented organizational goals and approach -- Understanding of why the PKI is needed and what is the value for the organization -- Support and sponsorship of the top management - -References -- ISO/IEC 27001 - Information security management systems -" -G.1,Strategy and Vision,"Trusted and secure PKI must be properly managed and supported by the organization. The existence of a strategy and vision for the PKI is one of the key factors for the success of the PKI and contributes to the overall maturity. The strategy and vision should be aligned with the organizational goals and approach and should be followed and measured regularly. - -Formal documentation about the business drivers, scope, and design of the PKI helps to ensure that the PKI is properly aligned and understood to support the organizational. The documentation should be reviewed and updated regularly to ensure that the PKI is aligned with the organizational goals and needs. - -Undefined or unclear understanding and leadership can cause loss of the established trust and can lead to the failure of the PKI quickly. -",G.1.2,Formal assignment of responsible leadership,"Proper leadership and responsible person should be assigned by the management to fulfil the role for the establishment, maintenance, and development of the PKI according to the strategy and vision. The responsible person should be able to make decisions and take actions to ensure the PKI is aligned with the organizational goals and needs. -","Assessment -The formal assignment of the responsible person should be documented and approved by the management. Formal document should contains identification of the person and understanding of the role and responsibilities. -Interview with the responsible person should confirm the understanding of the role and responsibilities, driving the PKI implementation according to the organizational strategy. - -References -- ISO/IEC 27001 - Information security management systems -" -G.1,Strategy and Vision,"Trusted and secure PKI must be properly managed and supported by the organization. The existence of a strategy and vision for the PKI is one of the key factors for the success of the PKI and contributes to the overall maturity. The strategy and vision should be aligned with the organizational goals and approach and should be followed and measured regularly. - -Formal documentation about the business drivers, scope, and design of the PKI helps to ensure that the PKI is properly aligned and understood to support the organizational. The documentation should be reviewed and updated regularly to ensure that the PKI is aligned with the organizational goals and needs. - -Undefined or unclear understanding and leadership can cause loss of the established trust and can lead to the failure of the PKI quickly. -",G.1.3,Scope and business drivers for PKI,"The scope of the PKI should be clearly defined and documented. The scope should be defined in terms of the use-cases that the PKI is going to support. Each use-case can have a different requirements and therefore different strategy. The use-cases should be defined in terms of the business drivers that are going to be supported by the PKI. Business drivers helps to document alignment with the overall organizational goals. - -The scope and business drivers can be considered as a formal high-level overview of the PKI strategy and vision. -Its purpose is also to create a common understanding of the organizational PKI and to provide direction for the detailed design and implementation. -The target audience consists typically of architects, experts, advisors, management, and sponsors. -","Assessment -The following is sample evidence that can be used to assess the requirement: -- Documented scope of the PKI -- Documented business drivers -- Documented use-cases -- Documented alignment with the organizational goals - -References -- ISO/IEC 27001 - Information security management systems -- The Open Group Architecture Framework (TOGAF) -" -G.1,Strategy and Vision,"Trusted and secure PKI must be properly managed and supported by the organization. The existence of a strategy and vision for the PKI is one of the key factors for the success of the PKI and contributes to the overall maturity. The strategy and vision should be aligned with the organizational goals and approach and should be followed and measured regularly. - -Formal documentation about the business drivers, scope, and design of the PKI helps to ensure that the PKI is properly aligned and understood to support the organizational. The documentation should be reviewed and updated regularly to ensure that the PKI is aligned with the organizational goals and needs. - -Undefined or unclear understanding and leadership can cause loss of the established trust and can lead to the failure of the PKI quickly. -",G.1.4,Architecture and design of the PKI,"The architecture and design of the PKI should be documented to provide a clear understanding of the implementation and technologies that are involved. The architecture and design should be aligned with the scope and business drivers for the PKI and should be reviewed and updated regularly. - -The architecture and design typically consists of the following: -- Functional and technical design description -- Description of logical components -- Network infrastructure design -- Technology involved -- Integration requirements and interfaces (APIs) -- Support systems (such as IAM, logging, monitoring, etc.) -- Operational requirements -- Security requirements -- Deployment options -- Staging and testing - -The architecture and design are further used for the implementation of the PKI and serves as an input for the PKI team. It can be also used for the procurement of the PKI components and services that are needed for the implementation. -","Assessment -The following is sample evidence that can be used to assess the requirement: -- Documented architecture and design -- Alignment with the scope and business drivers -- Interview with the PKI team to confirm the understanding of the architecture and design - -References -- ETSI EN 319 401 - General Policy Requirements for Trust Service Providers -- The Open Group Architecture Framework (TOGAF) -" -G.2,Policies and documentation,"Documented policies plays an important role in the secure and consistent management of the PKI. The goal is to minimize financial and operational threats and risks in the digital world. Well-described policies and security measures increase overall trust in the ecosystem of trust services and are a condition for successful operation. The basis for these matters lies in relevant laws and regulations, international standards and best practices. - -It consists of: -- formal policies and practice statements for supported PKI services and use-cases -- formal management of agreements between parties involved in the PKI -- certificate and key management rules -- roles and responsibilities in the management of the PKI -- documented disclosure statements -- maintenance and review of policies and documentation -- code of practice for information security management, techniques and risk management - -Properly documented policies keeps the PKI assets trusted over the time and serves as a basis for integrated processes and procedures. It is a living management system that is continuously updated and changed as technologies, security, and compliance requirements change. - -The Certificate Policy (CP) defines the overall policies and requirements of a PKI, the Certification Practice Statement (CPS) provides detailed operational procedures followed by the Certification Authority (CA), and the disclosure statement offers transparency about the CA's identity and services to relying parties. -",G.2.1,The scope of policies is defined and documented,"Each PKI implementation and use case is different, therefore it requires different care. The scope of policies that are applicable for the implementation should be defined and documented. When the proper description of the policies scope is provided, it helps all parties involved to understand the purpose of the policies and their applicability. - -The scope can include the following: -- Identification of the policies required for the implementation -- Reasoning why the policies are required or not required -- Structure of policies and documentation -- List of policies with references, versions, etc. -- Any other relevant information -","Assessment -- The scope of policies is defined and documented -- The scope of policies is complete -- Interview with the management and PKI responsible personnel to confirm the scope - -References -- RFC 3647 - Internet X.509 Public Key Infrastructure Certificate Policy and Certification Practices Framework -- ISO/IEC 27001 - Information security management systems -- ETSI EN 319 401 - General Policy Requirements for Trust Service Providers -" -G.2,Policies and documentation,"Documented policies plays an important role in the secure and consistent management of the PKI. The goal is to minimize financial and operational threats and risks in the digital world. Well-described policies and security measures increase overall trust in the ecosystem of trust services and are a condition for successful operation. The basis for these matters lies in relevant laws and regulations, international standards and best practices. - -It consists of: -- formal policies and practice statements for supported PKI services and use-cases -- formal management of agreements between parties involved in the PKI -- certificate and key management rules -- roles and responsibilities in the management of the PKI -- documented disclosure statements -- maintenance and review of policies and documentation -- code of practice for information security management, techniques and risk management - -Properly documented policies keeps the PKI assets trusted over the time and serves as a basis for integrated processes and procedures. It is a living management system that is continuously updated and changed as technologies, security, and compliance requirements change. - -The Certificate Policy (CP) defines the overall policies and requirements of a PKI, the Certification Practice Statement (CPS) provides detailed operational procedures followed by the Certification Authority (CA), and the disclosure statement offers transparency about the CA's identity and services to relying parties. -",G.2.2,Certificate policy is documented and published,"Certificate Policy (CP) is used to establish the controls of the issuing party and the roles and responsibilities of its entities for the specific PKI implementation and use case. It's used to provide assurance to partners and show the trustworthiness by the use of standards. It can be considered as a high level contract between the parties involved in the PKI and therefore should be published and available to all parties involved. - -CPs are described in a document form where the content may differ. Multiple policies can be part of a single document for different use cases. A CP contains a set of rules that indicates the applicability of a certificate to a particular community and/or class of applications with common security requirements or level of security (for instance certificates for the purpose of: persons, domains, organizations, authenticity and confidentiality, services). To uniquely identify the purpose of the certificates the CP contains unique numbers (Object Identifier, OID) which needs to be registered. - -In general a CP addresses the following items: -- Types of certificates -- Document name and identification -- PKI participants -- Certificate usage -- Policy administration -- Definitions -- Publication and repository responsibilities -- Identification and authentication -- Certificate life-cycle operational requirements -- Facility management and operational controls -- Technical security controls -- Certificate, CRL, and OCSP profiles -- Compliance audit and other assessments - - Other business and legal matters -","Assessment -- The CP is properly documented in its full scope -- The CP clearly defines the scope of the policy, such as the purpose of the security and assurance levels, the type and use of its certificates and parties involved -- The legal rights and responsibilities of parties are described in the CP -- CP has listed correct object identifiers for the purpose it's used for -- Verify that the CP is published and available to all parties involved -- Interview with the management and PKI responsible personnel to confirm the CP is accurate and followed - -References -- RFC 3647 - Internet X.509 Public Key Infrastructure Certificate Policy and Certification Practices Framework -- ISO/IEC 27001 - Information security management systems -- ETSI EN 319 411-1 - Policy and security requirements for Trust Service Providers issuing certificates -" -G.2,Policies and documentation,"Documented policies plays an important role in the secure and consistent management of the PKI. The goal is to minimize financial and operational threats and risks in the digital world. Well-described policies and security measures increase overall trust in the ecosystem of trust services and are a condition for successful operation. The basis for these matters lies in relevant laws and regulations, international standards and best practices. - -It consists of: -- formal policies and practice statements for supported PKI services and use-cases -- formal management of agreements between parties involved in the PKI -- certificate and key management rules -- roles and responsibilities in the management of the PKI -- documented disclosure statements -- maintenance and review of policies and documentation -- code of practice for information security management, techniques and risk management - -Properly documented policies keeps the PKI assets trusted over the time and serves as a basis for integrated processes and procedures. It is a living management system that is continuously updated and changed as technologies, security, and compliance requirements change. - -The Certificate Policy (CP) defines the overall policies and requirements of a PKI, the Certification Practice Statement (CPS) provides detailed operational procedures followed by the Certification Authority (CA), and the disclosure statement offers transparency about the CA's identity and services to relying parties. -",G.2.3,Certification practice statement is documented and published,"In addition to a CP, there is typically a Certification Practice Statement (CPS). While a CP is more at a strategic level, detailed information about how things should be carried out is part of a CPS (tactical level). The CP and CPS can be combined into a single managed document, however they are typically split for most of the PKI implementations for better orientation. - -The CPS covers the same items as the CP, but includes technical detail of how the CP is implemented. All parties involved in the PKI should be aware of the CPS and follow it. The CPS is a living document that is continuously updated and changed as technologies, security, and compliance requirements change. -","Assessment -- The CPS is properly documented in its full scope -- CPS is published and available to all parties involved -- Interview with the management and PKI responsible personnel to confirm the CPS is accurate and followed -- Confirm that the information in the CPS is consistent with the information in the CP - -References -- RFC 3647 - Internet X.509 Public Key Infrastructure Certificate Policy and Certification Practices Framework -- ISO/IEC 27001 - Information security management systems -- ETSI EN 319 411-1 - Policy and security requirements for Trust Service Providers issuing certificates -" -G.2,Policies and documentation,"Documented policies plays an important role in the secure and consistent management of the PKI. The goal is to minimize financial and operational threats and risks in the digital world. Well-described policies and security measures increase overall trust in the ecosystem of trust services and are a condition for successful operation. The basis for these matters lies in relevant laws and regulations, international standards and best practices. - -It consists of: -- formal policies and practice statements for supported PKI services and use-cases -- formal management of agreements between parties involved in the PKI -- certificate and key management rules -- roles and responsibilities in the management of the PKI -- documented disclosure statements -- maintenance and review of policies and documentation -- code of practice for information security management, techniques and risk management - -Properly documented policies keeps the PKI assets trusted over the time and serves as a basis for integrated processes and procedures. It is a living management system that is continuously updated and changed as technologies, security, and compliance requirements change. - -The Certificate Policy (CP) defines the overall policies and requirements of a PKI, the Certification Practice Statement (CPS) provides detailed operational procedures followed by the Certification Authority (CA), and the disclosure statement offers transparency about the CA's identity and services to relying parties. -",G.2.4,Disclosure statement is documented and published,"The disclosure statement (DS) is a document that describes the PKI and its services. It refers to a document that discloses the relevant information about the CA and its services to the relying parties. - -It typically includes information like: -- CA's identity, legal status, and contact information -- Certificate types, verification procedures and compliance with standards -- Reliance limits -- Obligations of the CA and the relying parties -- Warranty and liability limitations -- Agreement, CP and CPS -- Privacy policy -- Refund policy and claims -- Information on audit and compliance - -The purpose of a DS is to provide transparency to relying parties, allowing them to assess the trustworthiness and reliability of the CA before relying on its certificates. -","Assessment -- The DS is properly documented in its full scope -- DS is published and available to all parties involved -- Interview with the management and PKI responsible personnel to confirm the DS is accurate -- Confirm that the information in the DS is consistent with the information in the CP and CPS - -References -- ETSI EN 319 411-1 - Policy and security requirements for Trust Service Providers issuing certificates -" -G.2,Policies and documentation,"Documented policies plays an important role in the secure and consistent management of the PKI. The goal is to minimize financial and operational threats and risks in the digital world. Well-described policies and security measures increase overall trust in the ecosystem of trust services and are a condition for successful operation. The basis for these matters lies in relevant laws and regulations, international standards and best practices. - -It consists of: -- formal policies and practice statements for supported PKI services and use-cases -- formal management of agreements between parties involved in the PKI -- certificate and key management rules -- roles and responsibilities in the management of the PKI -- documented disclosure statements -- maintenance and review of policies and documentation -- code of practice for information security management, techniques and risk management - -Properly documented policies keeps the PKI assets trusted over the time and serves as a basis for integrated processes and procedures. It is a living management system that is continuously updated and changed as technologies, security, and compliance requirements change. - -The Certificate Policy (CP) defines the overall policies and requirements of a PKI, the Certification Practice Statement (CPS) provides detailed operational procedures followed by the Certification Authority (CA), and the disclosure statement offers transparency about the CA's identity and services to relying parties. -",G.2.5,Policies are periodically reviewed and updated,"Policies are living documents that are continuously updated and changed as technologies, security, and compliance requirements change. The policies should be reviewed and updated periodically. The frequency of review should be determined by the organization. Good practice is to review policies at least annually or when there are significant changes in the PKI or its environment. -","Assessment -- The policies are reviewed and updated periodically -- Check the last review date of the policies -- Implementation of review process -- Validation of documentation and reviews -- Interview with the management and PKI responsible personnel to confirm the policies are reviewed and updated periodically - -References -- RFC 3647 - Internet X.509 Public Key Infrastructure Certificate Policy and Certification Practices Framework -- ISO/IEC 27001 - Information security management systems -- ETSI EN 319 401 - General Policy Requirements for Trust Service Providers -" -G.3,Compliance,"Compliance refers to the ability of an organization to adhere to relevant laws, regulations, and standards related to the scope of the PKI. A properly implemented PKI Compliance program ensures that an organization's PKI is protected from threats and risks that could result in financial loss, reputational damage, legal liabilities, or eventually in the loss of trust. - -The compliance process helps to manage a PKI in a way that meets legal and regulatory requirements, and ensures information is used and protected appropriately, according to defined and documented policies and practices statements. - -Compliance is important for several reasons, including: -- It supports the risk management process associated with the PKI assets -- Minimize reputation issues that can lead to the loss of trust -- Provides assurance for the relying parties and subscribers -- Proves adherence to legal requirements - -Overall, compliance and related procedures help to ensure that the PKI is managed and maintained according to the relevant laws, regulations, and standards. This minimizes the risk of loss of trust and provides assurance to PKI participants. -",G.3.1,"Compliance policies are defined, implemented, and communicated","Compliance policies are a critical component of an organization’s risk management strategy to help ensure that the PKI system is secure, reliable, trustworthy, and meets any applicable regulatory requirements. - -By defining appropriate policies and related procedures and communicating these to all stakeholders who rely on the PKI, the organization can ensure that administrators, operators, and users are properly authenticated and authorized to access the system and that appropriate controls are in place to prevent unauthorized access or misuse of the PKI. - -Having a sound set of compliance policies defined, implemented, and communicated can help to demonstrate that the organization took reasonable steps to protect the PKI and may result in reduced legal liability in the event of a breach due to improper or malicious use of the PKI. - -The compliance policies typically include: -- Laws, industry regulations and government legislation that apply to the organization business and PKI -- Roles and responsibilities -- Compliance program management requirements -- Reporting and auditing requirements -- References to relevant documents (anti-trust, anti-fraud, anti-bribery, anti-money laundering, due diligence, etc.) -- Any other relevant information that rule compliance -","Assessment -- Documented audit and accountability policies -- Documented communication plan for informing stakeholders of the policies -- Formalized process for stakeholder acknowledgement upon receipt of the policies - -References -- ISO 37301 - Compliance management systems and related standard -- NIST Risk Management Framework -" -G.3,Compliance,"Compliance refers to the ability of an organization to adhere to relevant laws, regulations, and standards related to the scope of the PKI. A properly implemented PKI Compliance program ensures that an organization's PKI is protected from threats and risks that could result in financial loss, reputational damage, legal liabilities, or eventually in the loss of trust. - -The compliance process helps to manage a PKI in a way that meets legal and regulatory requirements, and ensures information is used and protected appropriately, according to defined and documented policies and practices statements. - -Compliance is important for several reasons, including: -- It supports the risk management process associated with the PKI assets -- Minimize reputation issues that can lead to the loss of trust -- Provides assurance for the relying parties and subscribers -- Proves adherence to legal requirements - -Overall, compliance and related procedures help to ensure that the PKI is managed and maintained according to the relevant laws, regulations, and standards. This minimizes the risk of loss of trust and provides assurance to PKI participants. -",G.3.2,A program to monitor compliance with the policies is established,"A PKI compliance monitoring program typically involves ongoing monitoring and testing of the controls and procedures to detect potential compliance violations associated with rules and regulations that govern the issuance, update, or revocation of certificates. - -These programs often include a risk assessment to identify and assess potential risks that could lead to non-compliance, including regulatory changes, operational changes, or employee turnover. - -The monitoring process may include reviewing documentation, conducting interviews with key stakeholders, and reporting any issues or compliance violations. Reporting from compliance monitoring should be communicated to those stakeholders who committed the violation(s) and those stakeholders who are empowered to take corrective action to address the violations observed. -","Assessment -- Documented practices regarding periodic and aperiodic compliance assessments -- Documented practices for regularly review and reporting of security issues -- Documented and implemented processes for investigation and response to suspicious activities - -References -- ISO 37301 - Compliance management systems and related standard -- NIST Risk Management Framework -" -G.3,Compliance,"Compliance refers to the ability of an organization to adhere to relevant laws, regulations, and standards related to the scope of the PKI. A properly implemented PKI Compliance program ensures that an organization's PKI is protected from threats and risks that could result in financial loss, reputational damage, legal liabilities, or eventually in the loss of trust. - -The compliance process helps to manage a PKI in a way that meets legal and regulatory requirements, and ensures information is used and protected appropriately, according to defined and documented policies and practices statements. - -Compliance is important for several reasons, including: -- It supports the risk management process associated with the PKI assets -- Minimize reputation issues that can lead to the loss of trust -- Provides assurance for the relying parties and subscribers -- Proves adherence to legal requirements - -Overall, compliance and related procedures help to ensure that the PKI is managed and maintained according to the relevant laws, regulations, and standards. This minimizes the risk of loss of trust and provides assurance to PKI participants. -",G.3.3,Responsibilities for the compliance are formally defined and assigned,"Within the organization, there should exist clear and well documented guidelines outlining which individual, group or team is responsible for ensuring that PKI policies are being followed. This applies to governance and oversight in addition to operational policies and procedures. - -Documenting specifically ""who"" shall be responsible for ensuring PKI policies are being enforced enhances accountability and trustworthiness of the PKI by enforcing the mentality that ""someone is watching"". This will help to mitigate risks associated with improper or malicious acts. -","Assessment -- For each defined procedure, a specific individual or team is identified and assigned to perform the tasks associated with the procedure -- Interview with the personnel to confirm understanding of the role and responsibilities - -References -- ISO 37301 - Compliance management systems and related standard -- NIST Risk Management Framework -" -G.3,Compliance,"Compliance refers to the ability of an organization to adhere to relevant laws, regulations, and standards related to the scope of the PKI. A properly implemented PKI Compliance program ensures that an organization's PKI is protected from threats and risks that could result in financial loss, reputational damage, legal liabilities, or eventually in the loss of trust. - -The compliance process helps to manage a PKI in a way that meets legal and regulatory requirements, and ensures information is used and protected appropriately, according to defined and documented policies and practices statements. - -Compliance is important for several reasons, including: -- It supports the risk management process associated with the PKI assets -- Minimize reputation issues that can lead to the loss of trust -- Provides assurance for the relying parties and subscribers -- Proves adherence to legal requirements - -Overall, compliance and related procedures help to ensure that the PKI is managed and maintained according to the relevant laws, regulations, and standards. This minimizes the risk of loss of trust and provides assurance to PKI participants. -",G.3.4,"List of relevant laws, regulations, and standards, exist and is maintained","To better understand the relevance to PKI, one should understand the differences between laws, regulations, and standards. - -Laws are legal rules that are enacted by a governing body, such as a federal, state or local government. They are binding and enforceable by the legal system within the jurisdiction of the governing body that enacted them. Violating law can lead to legal consequences, such as fines or imprisonment. - -Regulations are derived from laws and are often meant to supplement and clarify the broader provisions outlined in the laws. Compliance with regulations is mandatory and non-compliance can result in penalties or other legal consequences. - -Standards are voluntary guidelines or specifications typically established by a particular industry group or standards organization. Standards usually define best practices, technical specifications, quality benchmarks, and other criteria and are meant as a means of ensuring consistency, interoperability, and quality. Typically, compliance with standards is not legally required, however, lack of conformance to standards can lead to diminished interoperability and reduced trust. - -With respect to PKI, it is very important to understand what laws, regulations and standards are relevant to the PKI and its ancillary systems. For example, given that PKI involves cryptography, one must be certain to adhere to government laws regarding use and deployment of cryptographic products and solutions. - -And, many times, a PKI will make use of hardware cryptographic modules for key generation and storage. Therefore, it’s critical to ensure that the hardware cryptographic modules comply with the relevant standards. There are many laws, regulations and standards that apply to PKI. As such, it is necessary to maintain a list of the ones that are relevant to your organization to help ensure that none are being overlooked. -","Assessment -- Documented list of applicable laws, regulations and standards is maintained -- Procedures established for periodic review of the laws, regulations and standards -- Procedures established to remediate any deficiencies or non-compliance issues identified -- Procedures established to communicate results of the periodic reviews - -References -- ISO 37301 - Compliance management systems and related standard -- NIST Risk Management Framework -" -G.4,Processes and procedures,"Proper and effective processes and procedures related to PKI operations and management are essential for the successful implementation of the PKI. The processes and procedures should be aligned with the overall organizational policies and statements. - -Process is a set of activities that are performed in a specific order to achieve a specific goal. The process should be documented and measured. The process is also repeatable and can be improved over time, based on the evaluation, feedback, or risk assessment. The scope of the processes is defined by the policies. - -Procedure is a set of instructions that describe how to perform a specific task. The procedure should be also documented and can be used as a reference for the process. Procedure can include specific instructions for the process, such as how to perform a specific task, or how to use a specific tool. - -Processes and procedure typically cover (but are not limited to) the following areas: -- infrastructure management -- data privacy and security -- business continuity, disaster recovery, contingency planning -- supply chain management -- physical security and access control -- incident management -- audit and compliance, evidence and reporting, archiving -- risk management and assessment -",G.4.1,Scope of processes and procedure is aligned with policies,"The scope of the processes and procedures should be aligned with the policies and statements. Each implementation and use case can have different scope, but the scope should be defined and documented, with all applicable processes, procedures, and eventually instructions. - -The alignment with the policies helps to ensure that the processes and procedures are aligned with the PKI implementation goals and needs, and can be effectively trusted over the time. A simple matrix can be used to ensure that all applicable policies and statements are covered by the processes and procedures. - -The completeness of the processes and procedures can be evaluated by the risk assessment, audit, or by the feedback from the users. -","Assessment -The following is a sample evidence and information that can be collected during the assessment: -- Documented scope of the processes and procedures -- Alignment with the PKI policies and statements -- Interview with the PKI management - -References -- RFC 3647 - Internet X.509 Public Key Infrastructure Certificate Policy and Certification Practices Framework -- ISO/IEC 27001 - Information security management systems -" -G.4,Processes and procedures,"Proper and effective processes and procedures related to PKI operations and management are essential for the successful implementation of the PKI. The processes and procedures should be aligned with the overall organizational policies and statements. - -Process is a set of activities that are performed in a specific order to achieve a specific goal. The process should be documented and measured. The process is also repeatable and can be improved over time, based on the evaluation, feedback, or risk assessment. The scope of the processes is defined by the policies. - -Procedure is a set of instructions that describe how to perform a specific task. The procedure should be also documented and can be used as a reference for the process. Procedure can include specific instructions for the process, such as how to perform a specific task, or how to use a specific tool. - -Processes and procedure typically cover (but are not limited to) the following areas: -- infrastructure management -- data privacy and security -- business continuity, disaster recovery, contingency planning -- supply chain management -- physical security and access control -- incident management -- audit and compliance, evidence and reporting, archiving -- risk management and assessment -",G.4.2,Processes and procedures are formally documented and followed,"Identified processes and procedures needs to be properly designed and documented with all relevant information like scope, purpose, inputs, outputs, roles and responsibilities, and other. The processes and procedures should be also reviewed and approved by the management. -Once the processes and procedures are published, appropriate training is required to ensure they are followed by the PKI management and staff. Without following the processes and procedures, the PKI can be exposed to the risks and threats, and eventually lose any established trust. -","Assessment -The following is sample evidence and information that can be collected during the assessment: -- Documented processes and procedures -- Completeness of the processes and procedures documentation -- Evidence of the processes and procedures usage -- Interview with the PKI management and staff -- Training materials covering the processes and procedures - -References -- ISO/IEC 27001 - Information security management systems -- ENISA Publications -" -G.4,Processes and procedures,"Proper and effective processes and procedures related to PKI operations and management are essential for the successful implementation of the PKI. The processes and procedures should be aligned with the overall organizational policies and statements. - -Process is a set of activities that are performed in a specific order to achieve a specific goal. The process should be documented and measured. The process is also repeatable and can be improved over time, based on the evaluation, feedback, or risk assessment. The scope of the processes is defined by the policies. - -Procedure is a set of instructions that describe how to perform a specific task. The procedure should be also documented and can be used as a reference for the process. Procedure can include specific instructions for the process, such as how to perform a specific task, or how to use a specific tool. - -Processes and procedure typically cover (but are not limited to) the following areas: -- infrastructure management -- data privacy and security -- business continuity, disaster recovery, contingency planning -- supply chain management -- physical security and access control -- incident management -- audit and compliance, evidence and reporting, archiving -- risk management and assessment -",G.4.3,Recurring activities are executed on time,"Recurring activities are the activities that are performed on a regular basis, such as certificate management operations, backup procedures, security reviews, risk assessment, reviews of logs and security events, and other. - -Each activity should be tracked and have a frequency defined, for example, some activities may be performed daily, weekly, monthly, quarterly, or yearly. The activities should be performed on time, and any delays should be properly tracked and reported. - -Recurring activities needs to be incorporated into the processes and procedures to support the PKI implementation. -","Assessment -The following is sample evidence and information that can be collected during the assessment: -- Documented business as usual activities -- Evidence of the business as usual activities execution -- Business as usual activities tracking and reporting -- Calendar of activities -- Interview with the PKI management and staff - -References -- ISO/IEC 27001 - Information security management systems -- RFC 3647 - Internet X.509 Public Key Infrastructure Certificate Policy and Certification Practices Framework -" -G.4,Processes and procedures,"Proper and effective processes and procedures related to PKI operations and management are essential for the successful implementation of the PKI. The processes and procedures should be aligned with the overall organizational policies and statements. - -Process is a set of activities that are performed in a specific order to achieve a specific goal. The process should be documented and measured. The process is also repeatable and can be improved over time, based on the evaluation, feedback, or risk assessment. The scope of the processes is defined by the policies. - -Procedure is a set of instructions that describe how to perform a specific task. The procedure should be also documented and can be used as a reference for the process. Procedure can include specific instructions for the process, such as how to perform a specific task, or how to use a specific tool. - -Processes and procedure typically cover (but are not limited to) the following areas: -- infrastructure management -- data privacy and security -- business continuity, disaster recovery, contingency planning -- supply chain management -- physical security and access control -- incident management -- audit and compliance, evidence and reporting, archiving -- risk management and assessment -",G.4.4,Evidence from procedures is collected and maintained,"Each process, procedure, instruction, or activity would not be effective without evidence confirming that it was performed. The evidence should be descriptive with all relevant information, such as date and time, who performed the activity, what was the result, and other information, if needed. - -The evidence can be collected and maintained in various forms, such as logs, reports, notes, screenshots, etc. The evidence should be collected and maintained for the defined period of time, and should be available for the audit or other purposes. -","Assessment -The following is sample evidence and information that can be collected during the assessment: -- Evidence of the execution of the processes and procedures -- Interview with the PKI management and staff -- Logs, reports, notes, screenshots, and other evidence - -References -- ISO/IEC 27001 - Information security management systems -- RFC 3647 - Internet X.509 Public Key Infrastructure Certificate Policy and Certification Practices Framework -- ENISA Publications -" -G.4,Processes and procedures,"Proper and effective processes and procedures related to PKI operations and management are essential for the successful implementation of the PKI. The processes and procedures should be aligned with the overall organizational policies and statements. - -Process is a set of activities that are performed in a specific order to achieve a specific goal. The process should be documented and measured. The process is also repeatable and can be improved over time, based on the evaluation, feedback, or risk assessment. The scope of the processes is defined by the policies. - -Procedure is a set of instructions that describe how to perform a specific task. The procedure should be also documented and can be used as a reference for the process. Procedure can include specific instructions for the process, such as how to perform a specific task, or how to use a specific tool. - -Processes and procedure typically cover (but are not limited to) the following areas: -- infrastructure management -- data privacy and security -- business continuity, disaster recovery, contingency planning -- supply chain management -- physical security and access control -- incident management -- audit and compliance, evidence and reporting, archiving -- risk management and assessment -",G.4.5,Processes and procedures are reviewed and updated,"The processes and procedures should be reviewed and updated on a regular basis, based on the feedback, risk assessment, audit, or other. The review should be performed by the management, and the updates should be approved by the management. - -The review and update of the processes and procedures helps to keep the PKI implementation up to date, and helps to ensure that the processes and procedures are effective and efficient. -","Assessment -The following is sample evidence and information that can be collected during the assessment: -- Documented review and update process -- Evidence of the review and update of the processes and procedures -- Interview with the PKI management and staff - -References -- ISO/IEC 27001 - Information security management systems -- RFC 3647 - Internet X.509 Public Key Infrastructure Certificate Policy and Certification Practices Framework -- ENISA Publications -" -M.5,Key management,"Key management is the set of techniques and procedures supporting the establishment and maintenance of keying relationships between parties and components in the public key infrastructure. Key management encompasses techniques and procedures supporting: -- Initialization of system users and components; -- Generation, distribution, and installation of keying material; -- Controlling the use of keying material; -- Update, revocation, and destruction of keying material; and -- Storage, backup/recovery, and archival of keying material. - -The key management is important for the PKI to maintain trust. It should be an integral part of the PKI procedures. Proper key management is one of the basic stones on which the PKI stands and relies on. -",M.5.1,Key management roles and responsibilities are documented and formally assigned,"Proper definition of roles and responsibilities for key management operations establishes a good basis for accountability and auditing. The roles and responsibilities should follow key management policy, principles, and boundaries. - -Personnel should be formally assigned to the role based on appropriate skills, and background check to ensure that there are no external risks associated that can cause potential compromise of key management. - -Naming or assignment records should contain relevant information such as: -- Identification of personnel -- Role to be assigned -- Date of appointment -- Confirmation of required skills -- Acknowledgment of responsibilities -","Assessment -- Documented roles and responsibilities -- Signed naming protocol of personnel to role(s) -- Roles and responsibilities matrix (that may be used to cross-check if there are any conflicting roles) -- Validation of required knowledge and skills -- Review according to the key management policy - -References -- ISO/IEC 27001 and related standards -" -M.5,Key management,"Key management is the set of techniques and procedures supporting the establishment and maintenance of keying relationships between parties and components in the public key infrastructure. Key management encompasses techniques and procedures supporting: -- Initialization of system users and components; -- Generation, distribution, and installation of keying material; -- Controlling the use of keying material; -- Update, revocation, and destruction of keying material; and -- Storage, backup/recovery, and archival of keying material. - -The key management is important for the PKI to maintain trust. It should be an integral part of the PKI procedures. Proper key management is one of the basic stones on which the PKI stands and relies on. -",M.5.2,Inventory of cryptographic keys is documented and maintained,"Inventory of cryptographic keys is important and a strategic database for organizations to: -- Monitor cryptographic key status and compliance -- Quickly react to changes and incidents (deprecation of algorithms, compromise, new attacks and vulnerabilities) -- Understand impact of lifecycle changes, migration and use of keys - -Although the cryptographic key inventory may be implemented and maintained using various tools and approaches, it should serve the purpose of having a consistent and accurate map of all cryptographic keys deployed in the organization with details like algorithm, key length, usage, storage, location, generation and distribution method, backup and recovery, key check value, fingerprint, number of share or components, owner or responsible person, uniqueness, crypto-periods, or any other applicable attributes and properties of the key. - -Inventory should follow procedures and business as usual activities to keep it accurate and updated in time. -","Assessment -- Documented inventory of cryptographic keys -- Accuracy and consistency -- Completeness of inventory -- Validation of cryptographic key records - -References -- NIST SP 800-57 Recommendation for Key Management -- ISO/IEC 11770 Key Management -" -M.5,Key management,"Key management is the set of techniques and procedures supporting the establishment and maintenance of keying relationships between parties and components in the public key infrastructure. Key management encompasses techniques and procedures supporting: -- Initialization of system users and components; -- Generation, distribution, and installation of keying material; -- Controlling the use of keying material; -- Update, revocation, and destruction of keying material; and -- Storage, backup/recovery, and archival of keying material. - -The key management is important for the PKI to maintain trust. It should be an integral part of the PKI procedures. Proper key management is one of the basic stones on which the PKI stands and relies on. -",M.5.3,Inventory of cryptographic devices is documented and maintained,"Sensitive cryptographic keys are protected by hardware security modules that can have various forms and comply with security standards such as FIPS 140-3 or Common Criteria Protection Profiles. The keys may be in some case software-protected when there is no high risk associated with its compromise. - -The approved ways of protecting cryptographic keys should have defined rules, which can be specified by the key management policy and followed using the key management procedures. Cryptographic devices that protect keys may be quickly identified using the inventory of cryptographic keys with reference to an inventory of cryptographic devices. - -The inventory of cryptographic devices should contain relevant information such as: -- Vendor and device model identification -- Serial numbers -- Hardware / firmware / software versions -- Security certification and expiration dates -- Locations -","Assessment -- Documented requirements for cryptographic devices -- Documented inventory of cryptographic devices -- Completeness, accuracy, and consistency of inventory -- Validation of records - -References -- NIST SP 800-57 Recommendation for Key Management -- ISO/IEC 11770 Key Management -" -M.5,Key management,"Key management is the set of techniques and procedures supporting the establishment and maintenance of keying relationships between parties and components in the public key infrastructure. Key management encompasses techniques and procedures supporting: -- Initialization of system users and components; -- Generation, distribution, and installation of keying material; -- Controlling the use of keying material; -- Update, revocation, and destruction of keying material; and -- Storage, backup/recovery, and archival of keying material. - -The key management is important for the PKI to maintain trust. It should be an integral part of the PKI procedures. Proper key management is one of the basic stones on which the PKI stands and relies on. -",M.5.4,Each cryptographic key is defined and has documented lifecycle procedures,"Each cryptographic key type that is defined and used for specific use-case should have a complete description of its lifecycle. Each lifecycle phase has a proper description of the process and is backed up with the procedure that is executed when needed. - -The key can have various lifecycle phases, such as generation, registration, initialization, distribution, loading, storage, archiving, backup, recovery, revocation, removal, destruction, or others applicable for the key. - -The lifecycle phases contains appropriate description of the procedure such as: -- Prerequisites for execution -- Required roles and permissions -- Procedure and records -","Assessment -- Examine the definition of cryptographic key -- Documented key lifecycle phases -- Documented procedures and related records for the key lifecycle -- Lifecycle is integrated and followed in the organization - -References -- NIST SP 800-57 Recommendation for Key Management -- ISO/IEC 11770 Key Management -" -M.5,Key management,"Key management is the set of techniques and procedures supporting the establishment and maintenance of keying relationships between parties and components in the public key infrastructure. Key management encompasses techniques and procedures supporting: -- Initialization of system users and components; -- Generation, distribution, and installation of keying material; -- Controlling the use of keying material; -- Update, revocation, and destruction of keying material; and -- Storage, backup/recovery, and archival of keying material. - -The key management is important for the PKI to maintain trust. It should be an integral part of the PKI procedures. Proper key management is one of the basic stones on which the PKI stands and relies on. -",M.5.5,Cryptographic cipher suites and protocols are documented and maintained,"Protocols and encryption strengths may quickly change or be deprecated due to identification of vulnerabilities or design flaws. In order to support current and future data security needs, the organization should know where cryptography is used and understand how they would be able to respond rapidly to changes impacting the strength of their cryptographic implementations. - -Specific rules and boundaries to be applied for cryptographic cipher suites and protocols should be documented in encryption management policy that reflect the current status of cryptography practice. - -Cipher suites and protocols should be regularly checked against the implemented technology and configuration. Any deviation from the documented and allowed protocols should be fixed. -","Assessment -- Documented encryption management policy -- Validation of implementation and used protocols against what is documented -- Accuracy of the description -- Security and vulnerabilities of applicable cipher suites and protocols - -References -- NIST SP 800-57 Recommendation for Key Management -- ISO/IEC 11770 Key Management -- NIST SP 800-131A Transitioning the Use of Cryptographic Algorithms and Key Lengths -" -M.5,Key management,"Key management is the set of techniques and procedures supporting the establishment and maintenance of keying relationships between parties and components in the public key infrastructure. Key management encompasses techniques and procedures supporting: -- Initialization of system users and components; -- Generation, distribution, and installation of keying material; -- Controlling the use of keying material; -- Update, revocation, and destruction of keying material; and -- Storage, backup/recovery, and archival of keying material. - -The key management is important for the PKI to maintain trust. It should be an integral part of the PKI procedures. Proper key management is one of the basic stones on which the PKI stands and relies on. -",M.5.6,Key management is periodically reviewed and updated,"Key management policy, processes and procedures related to cryptographic keys, inventory and lifecycle should be periodically reviewed, updated and approved. The frequency of review should be based on the organizational risks and needs to be protected against current and future trends. - -Periodical review helps to keep the key management accurate and helps to maintain required skills and knowledge. -It provides assurance that the expected controls are active and working as intended. -","Assessment -- Risk management and review frequency -- Implementation of review process -- Validation of documentation and reviews - -References -- ISO/IEC 27001 and related standards -" -M.6,Certificate management,"Certificate management is the set of techniques and procedures supporting certificate lifecycle management. Certificate management encompasses techniques and procedures supporting: -- Definition of certificate profiles -- Generation of certificates -- Installation and orchestration of certificates -- Inventory of certificates -- State management of certificates, i.e. expiration and revocation -- Discovery of certificates - -The techniques can be applied to an organization that makes use of PKI, or from an organization (or part of an organization) that operates a PKI for others. This category primarily targets an organization from a usage perspective, albeit the certificate lifecycle management is equally important for an organization that operates a PKI for someone else. -",M.6.1,Certificate profiles are documented,"Certificate profiles specify the contents of certificates for one or more use cases. It defines things such as: -- Certificate use case(s) for certificates covered by specific profiles -- Naming standards for subject distinguished name and subject alternative names, which are allowed and mandatory fields. -- Certificate validity periods -- Certificate extensions, mandatory and allowed extensions, their criticality and possible values -- Allowed key types and signature algorithms -- Revocation profiles, i.e. CRL and/or OCSP -","Assessment -- Documented scope of applicability -- Documented and approved certificate profiles -- Content of the profiles is complete and unambiguous -- Certificate profiles are implemented in certificattion authority -- Certificate profiles are enforced by certification authority -- Certificate profiles are compatible with RFC5280, or deviations are well documented -- Profiles for CRLs and/or OCSP usage, i.e. validity periods, issuance intervals, max revocation time delay, etc - -References -Most certificate profiles aim for compatibility with RFC 5280 for maximum interoperability. Some examples of specific profiles are given below. -- RFC 5280 - Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile -- CA/B Forum baseline requirements -- ETSI Qualified Certificate Profiles -- ETSI 319-411-1 -- ETSI 319-411-2 -- 3GPP 33.310 - Network Domain Security (NDS); Authentication Framework (AF) -- UNISIG SUBSET-137 -" -M.6,Certificate management,"Certificate management is the set of techniques and procedures supporting certificate lifecycle management. Certificate management encompasses techniques and procedures supporting: -- Definition of certificate profiles -- Generation of certificates -- Installation and orchestration of certificates -- Inventory of certificates -- State management of certificates, i.e. expiration and revocation -- Discovery of certificates - -The techniques can be applied to an organization that makes use of PKI, or from an organization (or part of an organization) that operates a PKI for others. This category primarily targets an organization from a usage perspective, albeit the certificate lifecycle management is equally important for an organization that operates a PKI for someone else. -",M.6.2,Certificate cipher suites are documented,"Cipher suites, for certificates specifically defining key algorithms, key security levels and signature algorithms are important to be crypto agile. For example, the change of the cipher suites can be required when the cryptographic algorithm becomes broken, or deprecated. An organization should have a clear rationale to the usage of specific algorithms, and how long they will be valid and what may replace them in the future. -","Assessment -- Determine the scope of applicability -- Documented and approved cipher suites with rationale for inclusion of algorithms -- Documented agile path for migration to other algorithms when needed -- Cipher suites are enforced by certification authority - -References -- RFC 5280 - Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile -- SOG-IS crypto algorithms -- NIST Suite B -- NIST approved algorithms CNSA 2.0 -- NIST SP 800-208 - Recommendation for Stateful Hash-Based Signature Schemes -" -M.6,Certificate management,"Certificate management is the set of techniques and procedures supporting certificate lifecycle management. Certificate management encompasses techniques and procedures supporting: -- Definition of certificate profiles -- Generation of certificates -- Installation and orchestration of certificates -- Inventory of certificates -- State management of certificates, i.e. expiration and revocation -- Discovery of certificates - -The techniques can be applied to an organization that makes use of PKI, or from an organization (or part of an organization) that operates a PKI for others. This category primarily targets an organization from a usage perspective, albeit the certificate lifecycle management is equally important for an organization that operates a PKI for someone else. -",M.6.3,Certificate lifecycle management is documented,"Issuance of certificates follow specific procedures, be it manual processes or automated processes using standard or non-standard PKI protocol. An organization should be clear about the full life cycle management of certificates: -1. Certificate Application and the validation procedures used, by RAs and CAs -2. Certificate Issuance and protocols used for enrollment, on-line and off-line -3. Certificate Renewal, Re-key and Modification, upon expiration or other causes - - Process of monitoring certificates for expiration and timely renewal processes prevent common issues -4. Certificate Revocation - - When certificates need to be revoked it is important to have a well-defined certificate revocation process: - - How subjects can request a certificate be revoked - - How to report misuse of certificates - - Expected time for revocation to be completed after a revocation request -5. Certificate status dissemination - - How revocation information is disseminated to relying parties -6. Key escrow and recovery -7. Trust anchor management - - Trust anchors on machines and devices are a key point of trust management in the organization. Unmanaged trust stores can cause both outages and security issues. -","Assessment -- Documented application and validation rules -- Documented process for issuing certificates - - configuration of protocols -- Documented Certificate Acceptance and certificate subject installation procedures -- Documented renewal criteria, where re-key is nessecary and which certificate modifications are allowed - - Documented criticality of expiration for different use cases - - Automated monitoring and alerting of expiration for critical systems - - Automated certificate renewal -- Documented revocation process - - Documented revocation procedures, both for subjects and administrators - - If suspension is used the process to lift (or remove) suspension - - Documented contact points for reports in the organizations or from relying parties - - List of relying parties that depend on updated revocation information -- Documented Certificate status service - - OCSP and/or CRLs - - Documentation how relying parties get access to revocation information -- Documented process for key escrow and recovery when encryption keys need to be stored centrally -- Documented trust anchor management - - Distribution of new and updated trust anchors (Root CA certificates) - -References -Examples of process, protocols and profiled usage: -- RFC 4210 - Internet X.509 Public Key Infrastructure Certificate Management Protocol (CMP) -- CA/B Forum baseline requirements -- 3GPP 33.310 - Network Domain Security (NDS); Authentication Framework (AF) -- UNISIG SUBSET-137 -" -M.6,Certificate management,"Certificate management is the set of techniques and procedures supporting certificate lifecycle management. Certificate management encompasses techniques and procedures supporting: -- Definition of certificate profiles -- Generation of certificates -- Installation and orchestration of certificates -- Inventory of certificates -- State management of certificates, i.e. expiration and revocation -- Discovery of certificates - -The techniques can be applied to an organization that makes use of PKI, or from an organization (or part of an organization) that operates a PKI for others. This category primarily targets an organization from a usage perspective, albeit the certificate lifecycle management is equally important for an organization that operates a PKI for someone else. -",M.6.4,Inventory of issued certificates is documented,"Certificate inventory consists of all known certificates and provides an overview of known certificates in the organization. Certificates in inventory are subject to certificate lifecycle management. The certificate inventory is important for the organization because: -- It provides immediate access to the current status of certificates -- Provides possibility to react on certificate-related events (compromise, change, expiration, etc.) -- Understand impact of lifecycle changes -- It gives information on all locations of certificates -- Can enforce and maintain ownership of certificates - -The certificate inventory therefore consists of information related to certificate like certificate attributes, validity and validation information, fingerprint and serial number, trust chain, owner, public key, signature algorithm, certificate type, compliance information, certificate locations, change history, or any other attributes and properties of the certificates that is required. -","Assessment -- Documented inventory - - How inventory is maintained across the organization -- Documented certificate inventory management -- Validation of certificate inventory records -- Effectiveness of the certificate inventory implementation - -References -- RFC 3647 - Internet X.509 Public Key Infrastructure - Certificate Policy and Certification Practices Framework - Certificate Life-Cycle Operational Requirements -- NIST SP 800-57 Part 1 Rev. 5 - certificate inventory management -" -M.6,Certificate management,"Certificate management is the set of techniques and procedures supporting certificate lifecycle management. Certificate management encompasses techniques and procedures supporting: -- Definition of certificate profiles -- Generation of certificates -- Installation and orchestration of certificates -- Inventory of certificates -- State management of certificates, i.e. expiration and revocation -- Discovery of certificates - -The techniques can be applied to an organization that makes use of PKI, or from an organization (or part of an organization) that operates a PKI for others. This category primarily targets an organization from a usage perspective, albeit the certificate lifecycle management is equally important for an organization that operates a PKI for someone else. -",M.6.5,Certificate discovery process is documented,"Certificate discovery process protects an organization from unknown certificates that may be deployed in the infrastructure. Unknown certificates may be further issued by unauthorized certification authorities and mislead users of services. Certificate discovery helps to maintain current inventory of certificates, but does not depend on the inventory and is not nessecary to maintain an inventory. Certificate discovery process should be implemented based on supported certificates and use-cases, for example: -- To scan the network for certificates used on known protocols and ports to discover certificates that can potentially cause service outage or breach -- Search for the certificates on file system to discover unauthorized or unsecured certificates - -Discovery process should be run frequently on the specified locations and the certificate inventory should be updated based on the results of the certificate discovery to keep it current. -","Assessment -- Documented certificate discovery requirements -- Documented certificate discovery process and frequency -- The supporting tools for the certificate discovery -- Certificate inventory is updated with discovered certificates - -References -N/A -" -M.6,Certificate management,"Certificate management is the set of techniques and procedures supporting certificate lifecycle management. Certificate management encompasses techniques and procedures supporting: -- Definition of certificate profiles -- Generation of certificates -- Installation and orchestration of certificates -- Inventory of certificates -- State management of certificates, i.e. expiration and revocation -- Discovery of certificates - -The techniques can be applied to an organization that makes use of PKI, or from an organization (or part of an organization) that operates a PKI for others. This category primarily targets an organization from a usage perspective, albeit the certificate lifecycle management is equally important for an organization that operates a PKI for someone else. -",M.6.6,Certificate management is periodically reviewed and updated,"No certificate issuance and management system works over long periods of time without changes to use-cases, processes, protocols and algorithms. It is important that the certificate management is periodically reviewed and updated to avoid gaps. The frequency of review should be based on the organizational risks and needs to be protected against current and future trends. - -Periodical review helps to keep the certificate management accurate and helps to maintain required skills and knowledge. -It provides assurance that the expected controls are active and working as intended. -","Assessment -- Documented process for reviewing the certificate management process and systems -- Ability to implement updates to certificate management system -- Document management system and validation of review - -References -- ISO/IEC 27001 and related standards -" -M.6,Certificate management,"Certificate management is the set of techniques and procedures supporting certificate lifecycle management. Certificate management encompasses techniques and procedures supporting: -- Definition of certificate profiles -- Generation of certificates -- Installation and orchestration of certificates -- Inventory of certificates -- State management of certificates, i.e. expiration and revocation -- Discovery of certificates - -The techniques can be applied to an organization that makes use of PKI, or from an organization (or part of an organization) that operates a PKI for others. This category primarily targets an organization from a usage perspective, albeit the certificate lifecycle management is equally important for an organization that operates a PKI for someone else. -",M.6.7,Organizational PKI governance,"Large organizations commonly have several PKI systems spread out in the organization. Some can be consolidated, but in many cases different PKI silos exists for good reasons. Having a central governance of PKIs across the organization will help to maintain best practices, ensure secure PKI operations, re-use PKI knowledge in the organization, ensure consistent profiles and avoid unnecessary duplication of effort. -","Assessment -- Documented PKIs used in the organization - - Different PKI technologies used - - Installed PKI instances -- Documented PKI best practices - - Installation procedures to avoid re-learning the same issues in different parts of the organization - - Configuration to ensure consistent and interoperable certificates where applicable - - Security to maintain a security base line across the whole organization - -References -N/A -" -M.7,Infrastructure management,"The PKI implementation is a combination of software, hardware, network service, and resources that are needed to operate and manage the environment. -The environment can be hosted on-premise, in the cloud, or in a hybrid environment. - -Independent of the hosting model, the PKI environment needs to be properly managed and maintained, which requires resources and processes. -The infrastructure management refers to management of the technical and operational components of the PKI environment, which includes software, hardware, network, equipment, facilities, and other related resources. - -The PKI components may be distributed across multiple locations and managed by different teams. Therefore, it is important to have a clear description of the operational infrastructure with all dependencies and prerequisites. The infrastructure management should be aligned with the overall strategy of the organization and the scope of the PKI. - -When the infrastructure and environment where the PKI is implemented are not effectively managed and maintained, the complexity of the environment increases and the risk of failure increases as well. The infrastructure is often one of the key targets for attackers, therefore it is important to ensure that it is properly secured and available. -",M.7.1,Network and deployment infrastructure is documented,"The network and deployment documentation of the infrastructure should be aligned with the architecture and design of the PKI. In other terms, it provides details about how the implementation is done in the real environment. - -The network and deployment infrastructure should be properly documented and maintained. The documentation should include the following: -- PKI components and their dependencies -- Facilities and equipment -- Deployment infrastructure description -- Clustering and load balancing -- Network topology and diagram -- Communication and open ports requirements -- Supporting cloud providers and services -- Supporting systems and services (identity management, access control, logging, monitoring, etc.) -","Assessment -The following is sample evidence that can be used to assess the requirement: -- Network topology and diagram -- Deployment documentation -- Sample configuration of network to compare with the documentation -- Integration with supporting and other systems -- Interview with the network administrators - -References -- ISO/IEC 20000 and related standards -- ISO/IEC 27001 - Information security management systems -- Guidance for Containers and Container Orchestration Tools -" -M.7,Infrastructure management,"The PKI implementation is a combination of software, hardware, network service, and resources that are needed to operate and manage the environment. -The environment can be hosted on-premise, in the cloud, or in a hybrid environment. - -Independent of the hosting model, the PKI environment needs to be properly managed and maintained, which requires resources and processes. -The infrastructure management refers to management of the technical and operational components of the PKI environment, which includes software, hardware, network, equipment, facilities, and other related resources. - -The PKI components may be distributed across multiple locations and managed by different teams. Therefore, it is important to have a clear description of the operational infrastructure with all dependencies and prerequisites. The infrastructure management should be aligned with the overall strategy of the organization and the scope of the PKI. - -When the infrastructure and environment where the PKI is implemented are not effectively managed and maintained, the complexity of the environment increases and the risk of failure increases as well. The infrastructure is often one of the key targets for attackers, therefore it is important to ensure that it is properly secured and available. -",M.7.2,Separation and segmentation principles are applied,"The PKI environment should be properly separated and segmented from other environments and systems. The separation and segmentation should be applied on all levels, including network, infrastructure, and application. The separation and segmentation should be applied based on the security requirements and risk assessment. -Segmentation isolates the PKI environment from the remaining environment and reduces the risk of unauthorized access and data leakage. It also helps to reduce the impact of a potential compromise of the PKI environment from other systems and environments. Segmentation can be achieved using a number of physical or logical methods, such as: -- Properly configured internal network security controls -- Routers with strong access control lists -- Other technologies that restrict access to a particular segment of a network -For the proper maintenance of the infrastructure and deployed PKI components, the staging/testing environment should be available in the same configuration as the production environment. If needed, development environments can be used for testing and development purposes. -Production, staging, and development environments should be logically separated and isolated from each other, including the data that is used in the environments. -","Assessment -The following is sample evidence that can be used to assess the requirement: -- Network topology and diagram -- Implementation of network isolation -- Separation of production and testing environments -- Sample data -- Interview with the network administrators - -References -- ISO/IEC 20000 and related standards -- ISO/IEC 27001 - Information security management systems -" -M.7,Infrastructure management,"The PKI implementation is a combination of software, hardware, network service, and resources that are needed to operate and manage the environment. -The environment can be hosted on-premise, in the cloud, or in a hybrid environment. - -Independent of the hosting model, the PKI environment needs to be properly managed and maintained, which requires resources and processes. -The infrastructure management refers to management of the technical and operational components of the PKI environment, which includes software, hardware, network, equipment, facilities, and other related resources. - -The PKI components may be distributed across multiple locations and managed by different teams. Therefore, it is important to have a clear description of the operational infrastructure with all dependencies and prerequisites. The infrastructure management should be aligned with the overall strategy of the organization and the scope of the PKI. - -When the infrastructure and environment where the PKI is implemented are not effectively managed and maintained, the complexity of the environment increases and the risk of failure increases as well. The infrastructure is often one of the key targets for attackers, therefore it is important to ensure that it is properly secured and available. -",M.7.3,Network vulnerability management is implemented and maintained,"The network vulnerability management is a process that is used to identify, classify, remediate, and mitigate vulnerabilities in the network infrastructure and protects PKI implementation from potential attacks. The process should be implemented and maintained in order to ensure that the network infrastructure is properly secured and protected from potential attacks. - -The network vulnerability management should include the following: -- Included in the overall vulnerability management process -- Periodical scanning of the network infrastructure -- Identification of vulnerabilities -- Categorization and prioritization of vulnerabilities and remediation -- Updating and patching requirements -","Assessment -The following is sample evidence that can be used to assess the requirement: -- Network vulnerability management process -- Results from last network vulnerability scan -- Remediation plan -- Interview with the network administrators - -References -- Common Vulnerability Scoring System (CVSS) -- ISO/IEC 20000 and related standards -- ISO/IEC 27001 - Information security management systems -" -M.7,Infrastructure management,"The PKI implementation is a combination of software, hardware, network service, and resources that are needed to operate and manage the environment. -The environment can be hosted on-premise, in the cloud, or in a hybrid environment. - -Independent of the hosting model, the PKI environment needs to be properly managed and maintained, which requires resources and processes. -The infrastructure management refers to management of the technical and operational components of the PKI environment, which includes software, hardware, network, equipment, facilities, and other related resources. - -The PKI components may be distributed across multiple locations and managed by different teams. Therefore, it is important to have a clear description of the operational infrastructure with all dependencies and prerequisites. The infrastructure management should be aligned with the overall strategy of the organization and the scope of the PKI. - -When the infrastructure and environment where the PKI is implemented are not effectively managed and maintained, the complexity of the environment increases and the risk of failure increases as well. The infrastructure is often one of the key targets for attackers, therefore it is important to ensure that it is properly secured and available. -",M.7.4,Infrastructure recovery objectives controls,"In case of issues with the infrastructure, it should be possible to quickly identify the root cause and recover the infrastructure to the operational state. The recovery objectives should be defined and aligned with the overall business continuity and disaster recovery strategy of the organization. - -The infrastructure should be frequently backed up and the backups should be stored in a secure location. The backups should be tested and validated on a regular basis. Infrastructure managed as code may help to reduce complexity and increase the speed of recovery. -","Assessment -The following is sample evidence that can be used to assess the requirement: -- Infrastructure recovery objectives -- Backup and recovery plan -- Infrastructure configuration as a code -- Interview with the infrastructure administrators - -References -- ISO/IEC 20000 and related standards -- ISO/IEC 27001 - Information security management systems -" -M.7,Infrastructure management,"The PKI implementation is a combination of software, hardware, network service, and resources that are needed to operate and manage the environment. -The environment can be hosted on-premise, in the cloud, or in a hybrid environment. - -Independent of the hosting model, the PKI environment needs to be properly managed and maintained, which requires resources and processes. -The infrastructure management refers to management of the technical and operational components of the PKI environment, which includes software, hardware, network, equipment, facilities, and other related resources. - -The PKI components may be distributed across multiple locations and managed by different teams. Therefore, it is important to have a clear description of the operational infrastructure with all dependencies and prerequisites. The infrastructure management should be aligned with the overall strategy of the organization and the scope of the PKI. - -When the infrastructure and environment where the PKI is implemented are not effectively managed and maintained, the complexity of the environment increases and the risk of failure increases as well. The infrastructure is often one of the key targets for attackers, therefore it is important to ensure that it is properly secured and available. -",M.7.5,Infrastructure activities are periodically reviewed,"Infrastructure management related activities should be periodically reviewed, updated and approved. The frequency of review should be based on the organizational risks and needs to be protected against current and future trends. - -Periodical review helps to keep the infrastructure management accurate and helps to maintain required skills and knowledge. -It provides assurance that the expected controls are active and working as intended. - -The review can include the following: -- Changes made to the infrastructure -- Regular checks of firewall rules -- Review of the network topology -- Review of the network segmentation -- Regular checks of access control lists -- Vulnerability reports and timely remediation -- Review and correlation of logs -- And other activities related to the infrastructure management -","Assessment -The following is sample evidence that can be used to assess the requirement: -- Infrastructure management activities review frequency -- Organizational implementation of review process -- Validation of documentation, reports, records, and reviews - -References -- ISO/IEC 20000 and related standards -- ISO/IEC 27001 - Information security management systems -" -M.8,Change management and agility,"Change management and agility is important to control the PKI implementation and configuration changes, adjustments, modifications, and improvements. Technologies are changing fast and the PKI needs to be able to adapt to the changes. - The same applies for security vulnerabilities, deprecation of algorithms, and other changes that can significantly affect the PKI. - -The change management should provide a robust and reliable process to ensure that every change is properly assessed, approved, and implemented. The process should be aligned with the organizational change management process and should be followed by all stakeholders. - -Agility means that the PKI is able to adapt to the changes quickly and efficiently. Agility is applied to technologies, processes, algorithms, and other parts of the PKI implementation. Efficient adaptation to the changes makes the PKI more reliable and trustworthy, reducing operational risks. -",M.8.1,The policy for change management and agility is documented,"The policy for change management and agility should be documented and approved by the management. The policy contains principles and boundaries for the implementation of the change management and agility requirements. Typically, it can be documented on the organizational level and applied to all systems and services, including the PKI implementation. - -The PKI may have specific requirements for change management and agility, and therefore it may be recommended to have a separate policy for the PKI implementation. The policy should be aligned with organizational policy and should be approved by the responsible personnel for the PKI. - -The policy contains the following information: -- Approach to change management and agility -- Principles and boundaries for change management and agility -- Roles and responsibilities -- Requirements for change management and agility -- Tools and technologies used for change management -- And other relevant information -","Assessment -The following is sample evidence that can be used to assess the requirement: -- Documented policy for change management and agility -- Alignment with organizational policy -- Approval by the management -- Understanding of the policy by the PKI personnel -- And other relevant evidence - -References -- COBIT (Control Objectives for Information and Related Technologies) -- ISO/IEC 20000 and related standards -- The Information Technology Infrastructure Library (ITIL) -" -M.8,Change management and agility,"Change management and agility is important to control the PKI implementation and configuration changes, adjustments, modifications, and improvements. Technologies are changing fast and the PKI needs to be able to adapt to the changes. - The same applies for security vulnerabilities, deprecation of algorithms, and other changes that can significantly affect the PKI. - -The change management should provide a robust and reliable process to ensure that every change is properly assessed, approved, and implemented. The process should be aligned with the organizational change management process and should be followed by all stakeholders. - -Agility means that the PKI is able to adapt to the changes quickly and efficiently. Agility is applied to technologies, processes, algorithms, and other parts of the PKI implementation. Efficient adaptation to the changes makes the PKI more reliable and trustworthy, reducing operational risks. -",M.8.2,Request for change structure is documented and followed,"The request for change structure is the basic stone of each change management process. It provides information about a change, its scope, and other relevant data. The request for change structure should be formally documented and followed by all stakeholders involved. - -Request for change can contain any change that can affect the PKI implementation, including: -- PKI upgrades, updates, and patches -- New components or functionalities -- Changes in the configuration of the PKI -- Changes in the algorithms and protocols - -Request for change structure should cover the following information: -- Description of the change -- Scope of the change -- Category of the change -- Impacted systems and services -- Back-out procedure in case of failure -- Testing requirements -- And other relevant information -","Assessment -The following is sample evidence that can be used to assess the requirement: -- Documented request for change structure -- Sample of change request -- Review implemented changes and compare with the request for change - -References -- COBIT (Control Objectives for Information and Related Technologies) -- ISO/IEC 20000 and related standards -- The Information Technology Infrastructure Library (ITIL) -" -M.8,Change management and agility,"Change management and agility is important to control the PKI implementation and configuration changes, adjustments, modifications, and improvements. Technologies are changing fast and the PKI needs to be able to adapt to the changes. - The same applies for security vulnerabilities, deprecation of algorithms, and other changes that can significantly affect the PKI. - -The change management should provide a robust and reliable process to ensure that every change is properly assessed, approved, and implemented. The process should be aligned with the organizational change management process and should be followed by all stakeholders. - -Agility means that the PKI is able to adapt to the changes quickly and efficiently. Agility is applied to technologies, processes, algorithms, and other parts of the PKI implementation. Efficient adaptation to the changes makes the PKI more reliable and trustworthy, reducing operational risks. -",M.8.3,The change management process is documented and implemented,"The change management process is the core of the change management and agile systems. It provides a robust and reliable process to ensure that every change is properly assessed, approved, implemented, and eventually reviewed. - -The change management process should be documented, communicated, and integrated into the organization. The process states how a request for change can be submitted and how it is processed, which includes assessment and approval of the change, implementation of the change, functional testing after the change, and review of the change. -","Assessment -The following is sample evidence that can be used to assess the requirement: -- Documented change management process -- Sample of change request -- Steps involved in the change management process -- Interview with the responsible personnel - -References -- COBIT (Control Objectives for Information and Related Technologies) -- ISO/IEC 20000 and related standards -- The Information Technology Infrastructure Library (ITIL) -" -M.8,Change management and agility,"Change management and agility is important to control the PKI implementation and configuration changes, adjustments, modifications, and improvements. Technologies are changing fast and the PKI needs to be able to adapt to the changes. - The same applies for security vulnerabilities, deprecation of algorithms, and other changes that can significantly affect the PKI. - -The change management should provide a robust and reliable process to ensure that every change is properly assessed, approved, and implemented. The process should be aligned with the organizational change management process and should be followed by all stakeholders. - -Agility means that the PKI is able to adapt to the changes quickly and efficiently. Agility is applied to technologies, processes, algorithms, and other parts of the PKI implementation. Efficient adaptation to the changes makes the PKI more reliable and trustworthy, reducing operational risks. -",M.8.4,Requirements for agility are identified,"Agility provides the ability to adapt to changes quickly and efficiently. Agility and change management are closely related and should be considered together. The future-proof PKI implementation should be able to identify the requirements for agility and implement them in a timely manner. - -Agility can be considered on operational and technical levels. Operational agility means that the PKI is able to adapt to changes in the operational environment, including any changes to the organizational structure, processes, and other operational aspects. Technical agility means that the PKI is able to adapt to changes in the technologies, algorithms, protocols, and other technical aspects. - -Identification of requirements where agility is needed is important to ensure changes are implemented when needed. -","Assessment -The following is sample evidence that can be used to assess the requirement: -- Agility requirements of the PKI implementation -- Configuration changes -- Changes in the operational environment -- Changes in the technologies -- And other relevant evidence - -References -- COBIT (Control Objectives for Information and Related Technologies) -- ISO/IEC 20000 and related standards -- The Information Technology Infrastructure Library (ITIL) -" -M.8,Change management and agility,"Change management and agility is important to control the PKI implementation and configuration changes, adjustments, modifications, and improvements. Technologies are changing fast and the PKI needs to be able to adapt to the changes. - The same applies for security vulnerabilities, deprecation of algorithms, and other changes that can significantly affect the PKI. - -The change management should provide a robust and reliable process to ensure that every change is properly assessed, approved, and implemented. The process should be aligned with the organizational change management process and should be followed by all stakeholders. - -Agility means that the PKI is able to adapt to the changes quickly and efficiently. Agility is applied to technologies, processes, algorithms, and other parts of the PKI implementation. Efficient adaptation to the changes makes the PKI more reliable and trustworthy, reducing operational risks. -",M.8.5,Change management and agility is periodically reviewed,"The change management and agility requirements should be periodically reviewed to ensure that they are still valid and relevant. The review should be performed by the responsible personnel and should be documented. A good practice is to review the change management and agility requirements at least once a year, however, the frequency of the review can be different depending on the PKI implementation. -","Assessment -- Change management review frequency -- Implementation of review process and documentation -- Interview with the responsible personnel - -References -- COBIT (Control Objectives for Information and Related Technologies) -- ISO/IEC 20000 and related standards -- The Information Technology Infrastructure Library (ITIL) -" -O.9,Resilience,"Resilience is the key for any organization wanting to thrive in an ever-changing world, which is obviously s very important factor for any PKI implementation. The PKI is planned to be trusted for multiple years, if not decades. Therefore, the ability to absorb and adapt to the unpredictability, while continuing to deliver on the objectives is becoming mandatory. - -A robust resilience framework helps organizations future-proof their PKI oriented business, detailing key principles, attributes and activities that are followed to ensure that the PKI implementation will be trusted, secure, and effective all the time. -",O.9.1,Risk assessment and business impact analysis,"Proper risk assessment provides robust understanding about the risks and their impact on the business and organization PKI. The risk assessment results (for example potential loss scenarios) are documented and serves as input for the business impact analysis to identify the critical PKI-related business processes and their dependencies. - -Documented results of the business impact analysis are used to develop recovery strategies for the PKI implementation with required resources and availability. -","Assessment -The following is sample evidence that can be used to assess the requirement: -- Risk management and assessment process -- Documented risk assessment results -- Documented business impact analysis results -- Documented recovery strategies -- Understanding of the resilience and approval of the results -- Interview with the PKI management - -References -- ISO/IEC 27005 - Guidance on managing information security risks -- NIST Risk Management Framework -- ISO/TS 22317 - Guidelines for business impact analysis -" -O.9,Resilience,"Resilience is the key for any organization wanting to thrive in an ever-changing world, which is obviously s very important factor for any PKI implementation. The PKI is planned to be trusted for multiple years, if not decades. Therefore, the ability to absorb and adapt to the unpredictability, while continuing to deliver on the objectives is becoming mandatory. - -A robust resilience framework helps organizations future-proof their PKI oriented business, detailing key principles, attributes and activities that are followed to ensure that the PKI implementation will be trusted, secure, and effective all the time. -",O.9.2,Cyber-security management and incident planning,"Cyber-security management covers activities to ensure that the PKI is protected against known and zero-day vulnerabilities, cyberattacks and other threats. The operational procedures and technologies are evolving and the PKI needs to be able to adapt to the changes. Without knowing the threats and vulnerabilities, it is not possible to plan for the resilience and properly plan for incident response. - -Incident response planning helps to ensure that the organization is able to respond to the suspected incidents. Incident response plans should be documented and tested regularly. The result of executed incident response plans should be documented and used to improve the plan, even if it was a false alarm. - -Cyber-security management and incident planning covers important aspects such as vulnerability management and security operations center (SOC) identification and response to potential incidents. -","Assessment -The following is sample evidence that can be used to assess the requirement: -- Documented vulnerability management -- Vulnerability scanning results -- Documented incident response plans -- Documented incident response test results -- Monitoring of cyber-security threats -- Interview with the security operations team - -References -- ISO/IEC 27001 - Information security management systems -- Common Vulnerabilities and Exposures (CVE) Program -- NIST Special Publication 800-61 Revision 2 - Computer Security Incident Handling Guide -- SANS Guide to Security Operations -" -O.9,Resilience,"Resilience is the key for any organization wanting to thrive in an ever-changing world, which is obviously s very important factor for any PKI implementation. The PKI is planned to be trusted for multiple years, if not decades. Therefore, the ability to absorb and adapt to the unpredictability, while continuing to deliver on the objectives is becoming mandatory. - -A robust resilience framework helps organizations future-proof their PKI oriented business, detailing key principles, attributes and activities that are followed to ensure that the PKI implementation will be trusted, secure, and effective all the time. -",O.9.3,Business continuity planning and disaster recovery,"The business continuity planning and disaster recovery are the key activities to ensure availability of the PKI operations. The business continuity planning is used to define the recovery time objectives (RTO) and recovery point objectives (RPO) for the PKI. The RTO and RPO are used to define the required resources and their availability. - -Requirements for the business continuity and disaster recovery should be properly defined. It contains backups of the PKI resources, such as hardware security modules (HSM), databases, configuration files, etc. The availability of backups should be tested regularly to ensure that the backups are available when needed, especially during the disaster. - -Proper measures are applied to identify the disaster and a communication matrix is maintained to ensure that the right people are informed about the disaster on time and the recovery process can be started. - -The following parts are typically covered: -- Scope of the business continuity and disaster recovery -- Roles and responsibilities -- Activation of disaster recovery -- Physical locations -- Communication matrix -- Other requirements and information needed -","Assessment -The following is sample evidence that can be used to assess the requirement: -- Documented business continuity and disaster recovery plans -- Documented recovery time objectives (RTO) and recovery point objectives (RPO) -- Documented backup and recovery procedures -- Communication matrix and contact information -- Availability of backups and other requirements to execute the disaster recovery procedure -- Periodically tested effectiveness of the disaster recovery - -References -- ISO/IEC 22301 - Business continuity management systems -- NIST Special Publication 800-34 Revision 1 - Contingency Planning Guide for Federal Information Systems -" -O.9,Resilience,"Resilience is the key for any organization wanting to thrive in an ever-changing world, which is obviously s very important factor for any PKI implementation. The PKI is planned to be trusted for multiple years, if not decades. Therefore, the ability to absorb and adapt to the unpredictability, while continuing to deliver on the objectives is becoming mandatory. - -A robust resilience framework helps organizations future-proof their PKI oriented business, detailing key principles, attributes and activities that are followed to ensure that the PKI implementation will be trusted, secure, and effective all the time. -",O.9.4,Technology future proofing,"Applicable technology should always be future proofed to ensure that the PKI is able to adapt to changes, and will support the organization PKI in the future when new standards, algorithms, and approach will be developed. - -When deciding to apply new technologies, or evaluating if the current technology is still suitable and support the goals of the PKI implementation, the following should be considered: -- Technology is supported by the vendor -- Industry standards are applied for interoperability and security -- Review and references on the vendor and technology -- Applicability of the technology for long-term use -- Vulnerabilities and security reports of the technology -- Integration capabilities and customizations needed -- Open source vs. proprietary technology -","Assessment -The following is sample evidence that can be used to assess the requirement: -- Interview with the CTO or CIO -- Documentation of the technology future proofing -- RFI and RFP documents -- Vendor and technology check - -References -- ISO 223XX Security and resilience standards -- ISO/IEC 22301 - Business continuity management systems -" -O.9,Resilience,"Resilience is the key for any organization wanting to thrive in an ever-changing world, which is obviously s very important factor for any PKI implementation. The PKI is planned to be trusted for multiple years, if not decades. Therefore, the ability to absorb and adapt to the unpredictability, while continuing to deliver on the objectives is becoming mandatory. - -A robust resilience framework helps organizations future-proof their PKI oriented business, detailing key principles, attributes and activities that are followed to ensure that the PKI implementation will be trusted, secure, and effective all the time. -",O.9.5,Competence and information sharing,"Organization environments may change over time. The impact of changes can be in various forms, for example: -- personnel can rotate in their positions, new people can be hired, or people can leave the organization -- technologies are changing, therefore required skills and knowledge may change -- procedures and eventually management of the PKI will be adjusted - -The organization needs to ensure that the competence of the personnel is maintained and the information is shared to not lose the knowledge introduced by changes within known and unknown variables. The organization should have a plan to ensure that the competence is maintained for the most critical parts of the PKI. - -The competence and information sharing is an important part to achieve the resilience of the PKI implementation by having relevant information and competencies ready when needed. -","Assessment -The following is sample evidence that can be used to assess the requirement: -- Documentation and collaboration -- Onboarding and offboarding procedures -- Building competence and knowledge sharing - -References -- ISO 223XX Security and resilience standards -" -O.9,Resilience,"Resilience is the key for any organization wanting to thrive in an ever-changing world, which is obviously s very important factor for any PKI implementation. The PKI is planned to be trusted for multiple years, if not decades. Therefore, the ability to absorb and adapt to the unpredictability, while continuing to deliver on the objectives is becoming mandatory. - -A robust resilience framework helps organizations future-proof their PKI oriented business, detailing key principles, attributes and activities that are followed to ensure that the PKI implementation will be trusted, secure, and effective all the time. -",O.9.6,Continual review and improvement,"The resilience of the PKI implementation should be reviewed and improved regularly. The review and improvement process should be documented and the results should be used to improve the resilience of the PKI implementation. The frequency of review should be based on the organizational risks and needs to be protected against current and future trends. -","Assessment -The following is sample evidence that can be used to assess the requirement: -- Resilience effectiveness review frequency -- Implementation of review process -- Validation of documentation and reviews -- Training records - -References -- ISO 223XX Security and resilience standards -- NIST Special Publications 800 - 30, 34, 37, 46, 53, 84 -" -O.10,Automation,"Automation of certificate management is the process of using technology to perform tasks with reduced human assistance. Automation is used to improve the efficiency of the PKI management and to reduce the risk of human error. Automation can be used to perform tasks that are repetitive, time-consuming, or difficult to perform manually. - -On the other hand the automation can introduce new risks and challenges. The automation should be used only for tasks that are well-defined and that can be performed in a reliable way. - -Justified, well-designed, and documented automation of certificate lifecycle management can significantly contribute to the efficiency of the PKI management while reducing the risk of human error. However, automation is not a silver bullet and should be controlled, monitored, and audited to prevent the risk of misuse. -",O.10.1,Process automation description,"Every automated certificate management process should be properly described and documented. The documentation should contain information relevant to the process automation and understanding the reasons for automation. Monitoring, auditing, and potential measures and controls would be ineffective without proper description and understanding of the automation process. - -The description can include for example the following: -- Use-case or process to be automated -- Reasons for automation -- Description of the automation process -- Involved tools and technologies -- Monitoring and auditing requirements -- Potential measures and controls -- Exceptions -- Logging and reporting -- Any other relevant information and requirements -","Assessment -The following is sample evidence that can be used to assess the requirement: -- Process automation description -- Interview with the process owner -- Interview with administrators -- Sample of automated process logs - -References -N/A -" -O.10,Automation,"Automation of certificate management is the process of using technology to perform tasks with reduced human assistance. Automation is used to improve the efficiency of the PKI management and to reduce the risk of human error. Automation can be used to perform tasks that are repetitive, time-consuming, or difficult to perform manually. - -On the other hand the automation can introduce new risks and challenges. The automation should be used only for tasks that are well-defined and that can be performed in a reliable way. - -Justified, well-designed, and documented automation of certificate lifecycle management can significantly contribute to the efficiency of the PKI management while reducing the risk of human error. However, automation is not a silver bullet and should be controlled, monitored, and audited to prevent the risk of misuse. -",O.10.2,Monitoring and auditing of automated process,"The automated process of certificate management can cause significant damage if misused or misconfigured. The monitoring and auditing of the automated process is essential to prevent the risk of misuse and to detect any potential issues, inefficiencies, or exceptions. - -The monitoring and auditing should be performed on a regular basis and should be aligned with the overall monitoring and auditing strategy of the organization. -It should provide sufficient information to detect any potential issues with the automated process. For successful detection or identification of issues, proper expectations should be based on the description of the automated process. -","Assessment -Monitoring of automated processes should be supported by monitoring tools and technologies that can provide the necessary overview, reporting, and potential alerting in case of issues. -The following is sample evidence that can be used to assess the requirement: -- Documented monitoring and auditing measures -- Monitoring and auditing tools and technologies applied -- Sample report or dashboard from monitoring -- Interview with responsible personnel -- Simulate failure of the automated certificate management process and verify that the failure is detected and reported - -References -N/A -" -O.10,Automation,"Automation of certificate management is the process of using technology to perform tasks with reduced human assistance. Automation is used to improve the efficiency of the PKI management and to reduce the risk of human error. Automation can be used to perform tasks that are repetitive, time-consuming, or difficult to perform manually. - -On the other hand the automation can introduce new risks and challenges. The automation should be used only for tasks that are well-defined and that can be performed in a reliable way. - -Justified, well-designed, and documented automation of certificate lifecycle management can significantly contribute to the efficiency of the PKI management while reducing the risk of human error. However, automation is not a silver bullet and should be controlled, monitored, and audited to prevent the risk of misuse. -",O.10.3,Incidents and exceptions handling,"No automation is perfect and covers everything. There can be edge cases and other situations that were not part of the initial analysis or were simply forgotten. Therefore, there will always be exceptions and incidents that will require manual intervention. The automated process should be able to handle such exceptions and incidents in a way that will not cause any significant damage or disruption to the service. - -It may happen that some certificates are required to be handled manually and therefore the exception should be approved and documented. - -Handling of exceptional situations should be covered in the documentation, stating what should be done in case of an exception or incident: -- Communication of the exception -- Approval of the exception -- Incident handling and reporting -- Any other relevant information - -The handling of exceptions should be tested and verified on a regular basis to ensure that the process is working as expected. -","Assessment -The following is sample evidence that can be used to assess the requirement: -- Documented exceptions -- Interview with responsible personnel about how to handle exceptions or incidents - -References -N/A -" -O.11,Interoperability,"Interoperability means the ability of two or more systems or components to exchange information and to use the information that has been exchanged. - -A PKI is composed of multiple components, which are often provided by different vendors, or can be developed and maintained in-house. Interoperability keeps the PKI components working together and allows the PKI to function properly in the long term. - -Adopting open standards and protocols helps to ensure interoperability between PKI components and Relying Party (RP) applications and avoids vendor lock-in that may lead to interoperability issues in the future, especially when the PKI needs to be trusted for a long time, may have no control over RPs or needs to be scaled. - -Interoperability includes the following aspects: -- Interface specifications -- Data formats -- Communication protocols -- Algorithms -- Open standards - -Main principles of interoperability are: -- Transparency and openness -- Technology neutrality -- Reusability and scalability -- Security and privacy -- Accessibility -- Sustainability -- Portability and extensibility -",O.11.1,Maintain PKI interoperability strategy,"The interoperability strategy defines the interoperability requirements and the approach to achieve interoperability between the PKI components to ensure the PKI implementation is able to adopt new technologies and standards in the future, and will not be locked-in to a specific vendor. - -PKI interoperability strategy should be maintained, documented, and integrated in the organization. It should cover at least the following information: -- Application of interoperability -- Using open standards and protocols -- Conditions for PKI components to be interoperable -- Restrictions on the use of proprietary interfaces -- Interoperability testing -- Requirements for migration to new technologies -- Requirements for vendors -- Other relevant information -","Assessment -The following evidence should be available for the assessment of the requirement: -- Documented and approved interoperability strategy -- Interoperability strategy is integrated in the organization -- Interview with the responsible person(s) to verify understanding of the interoperability strategy -- Review documentation for PKI components to verify the requirements for interoperability - -References -- The Open Group Architecture Framework (TOGAF) -" -O.11,Interoperability,"Interoperability means the ability of two or more systems or components to exchange information and to use the information that has been exchanged. - -A PKI is composed of multiple components, which are often provided by different vendors, or can be developed and maintained in-house. Interoperability keeps the PKI components working together and allows the PKI to function properly in the long term. - -Adopting open standards and protocols helps to ensure interoperability between PKI components and Relying Party (RP) applications and avoids vendor lock-in that may lead to interoperability issues in the future, especially when the PKI needs to be trusted for a long time, may have no control over RPs or needs to be scaled. - -Interoperability includes the following aspects: -- Interface specifications -- Data formats -- Communication protocols -- Algorithms -- Open standards - -Main principles of interoperability are: -- Transparency and openness -- Technology neutrality -- Reusability and scalability -- Security and privacy -- Accessibility -- Sustainability -- Portability and extensibility -",O.11.2,Documented integration guidance,"To have effective interoperability between PKI components, it is important to have a proper integration in place that serves the purpose and does not expose any potential risks. Available and documented integration guidance for the developers and administrators should be maintained and updated regularly. - -The integration guidance should be available for all critical PKI components and should cover at least the following information: -- Integration requirements and prerequisites -- Applicable standards and protocols -- Integration architecture -- Integration testing -","Assessment -The following evidence should be available for the assessment of the requirement: -- Documented integration guidance for all critical PKI components -- Interview with the system administrators and developers -- Review of the integration guidance -- System configuration review - -References -- The Open Group Architecture Framework (TOGAF) -- Integration instructions provided by the vendors -" -O.11,Interoperability,"Interoperability means the ability of two or more systems or components to exchange information and to use the information that has been exchanged. - -A PKI is composed of multiple components, which are often provided by different vendors, or can be developed and maintained in-house. Interoperability keeps the PKI components working together and allows the PKI to function properly in the long term. - -Adopting open standards and protocols helps to ensure interoperability between PKI components and Relying Party (RP) applications and avoids vendor lock-in that may lead to interoperability issues in the future, especially when the PKI needs to be trusted for a long time, may have no control over RPs or needs to be scaled. - -Interoperability includes the following aspects: -- Interface specifications -- Data formats -- Communication protocols -- Algorithms -- Open standards - -Main principles of interoperability are: -- Transparency and openness -- Technology neutrality -- Reusability and scalability -- Security and privacy -- Accessibility -- Sustainability -- Portability and extensibility -",O.11.3,Adoption and application of open standards,"Open standards are publicly available standards that are developed and maintained by communities or standardization bodies. Open standards are developed through a consensus-based process and are available to everyone without any restrictions. Open standards are usually free to use and implement. - -The open standards are important for interoperability as they are typically technology-agnostic and are supported by technologies and solutions. Open standards are applicable for interfaces, communication protocols, cryptographic algorithms, data formats, automation and orchestration, and other aspects of the PKI. - -The adoption of open standards significant increase interoperability and reduce the risk of vendor lock-in. -","Assessment -The following evidence should be available for the assessment of the requirement: -- Documented list of open standards used by the PKI -- Policies requiring the use of open standards -- Interview with the responsible person to verify understanding of the open standards -- Review of training materials - -References -- Open Standards Principles -- IETF Request for Comments (RFC) -- OASIS Standards -- ISO Standards -- ITU Standards -- NIST Standards -- ETSI Standards -" -O.12,Monitoring and auditing,"Monitoring and auditing establish the necessary controls to detect and respond to security events and to provide evidence of compliance with the disclosed business practices. -The events and logs typically serves as a basis for incident response and forensic analysis in case of security incidents, however, they can also be used for other purposes, such as performance analysis, capacity planning, and troubleshooting. - -Monitoring and auditing provide reasonable assurance that: -- Unauthorized PKI system usage is detected -- Critical high impact events are monitored -- Appropriate logs are collected and relevant issues are alerted -- The confidentiality and integrity of current and archived audit logs are maintained for the required period of time -- Audit logs are completely and confidentially archived in accordance with disclosed business practices -- Events and logs are reviewed periodically by authorized personnel - -The outputs from the monitoring and auditing activities are typically used as inputs for the risk assessment and management activities, including incident response management and investigation of high impact events. -",O.12.1,Monitoring events and logging requirements are defined and documented,"The monitoring and logging requirements should be defined and documented in the CP, CPS, or other relevant documents. The requirements should be aligned with the overall PKI policies and statements, and should be based on the risk assessment and management activities. - -The requirements can typically include: -- Events to be monitored -- Frequency of monitoring -- Logs to be collected -- Retention period for logs -- Audit trail requirements -- Audit log protection requirements -- Formatting and interpretation of logs (syslog, JSON, XML, CEF, etc.) -- And other relevant requirements -","Assessment -- Documented monitoring and logging requirements -- Policies and procedures for monitoring and logging -- Review of records -- Interviews with personnel - -References -- ISO/IEC 27001 - Information security management systems -- ISO/IEC 20000 and related standards -- ISO/IEC 27099 - Public key infrastructure -" -O.12,Monitoring and auditing,"Monitoring and auditing establish the necessary controls to detect and respond to security events and to provide evidence of compliance with the disclosed business practices. -The events and logs typically serves as a basis for incident response and forensic analysis in case of security incidents, however, they can also be used for other purposes, such as performance analysis, capacity planning, and troubleshooting. - -Monitoring and auditing provide reasonable assurance that: -- Unauthorized PKI system usage is detected -- Critical high impact events are monitored -- Appropriate logs are collected and relevant issues are alerted -- The confidentiality and integrity of current and archived audit logs are maintained for the required period of time -- Audit logs are completely and confidentially archived in accordance with disclosed business practices -- Events and logs are reviewed periodically by authorized personnel - -The outputs from the monitoring and auditing activities are typically used as inputs for the risk assessment and management activities, including incident response management and investigation of high impact events. -",O.12.2,Event logs from systems are collected,"The event logs from systems should be collected and available for analysis, including correlation with other records. Centralized logging is recommended to ensure that the logs are collected and stored consistently. Solution like security information and event management (SIEM) can be used to collect and analyze the logs. - -The availability of records for analysis depends on understanding logging format and interpretation of the information, therefore each system should provide logs in a consistent format that can be further processed and analyzed (or automated). - -Logs and events should be collected from all systems that are relevant for the PKI implementation, such as key life cycle management events. - -The event should contain sufficient information to identify the event, including: -- User identification -- Type of event -- Date and time -- Success or failure indication -- Origination of event -- Identity or name of affected data, system component, or resource -- Additional details -","Assessment -- Logs are collected from systems -- Logs have a consistent format and can be further processed and analyzed -- Review of records and their formatting -- Review of configuration standards for logging -- Interviews with personnel to check the understanding of logging format and interpretation of the information - -References -- ISO/IEC 27001 - Information security management systems -- ISO/IEC 20000 and related standards -- NIST - Guide to Computer Security Log Management -- ISO/IEC 27099 - Public key infrastructure -" -O.12,Monitoring and auditing,"Monitoring and auditing establish the necessary controls to detect and respond to security events and to provide evidence of compliance with the disclosed business practices. -The events and logs typically serves as a basis for incident response and forensic analysis in case of security incidents, however, they can also be used for other purposes, such as performance analysis, capacity planning, and troubleshooting. - -Monitoring and auditing provide reasonable assurance that: -- Unauthorized PKI system usage is detected -- Critical high impact events are monitored -- Appropriate logs are collected and relevant issues are alerted -- The confidentiality and integrity of current and archived audit logs are maintained for the required period of time -- Audit logs are completely and confidentially archived in accordance with disclosed business practices -- Events and logs are reviewed periodically by authorized personnel - -The outputs from the monitoring and auditing activities are typically used as inputs for the risk assessment and management activities, including incident response management and investigation of high impact events. -",O.12.3,Audit trail can be reconstructed from audit logs,"Audit logging should be implemented to ensure that the audit trail can be reconstructed from audit logs any time. Audit logs are typically recorded for any user executed events that are important for security of the PKI implementation. Audit logs should be stored in a secure location. The audit logs should be protected against unauthorized access, modification, and deletion. - -Typically, the following events are important for security of the PKI implementation: -- All individual user accesses to sensitive data -- All actions taken by any individual with root or administrative privileges -- Access to all audit trails -- Invalid logical access attempts -- Use of and changes to identification and authentication mechanisms - including but not limited to creation of new accounts and elevation of privileges - and all changes, additions, or deletions to accounts with root or administrative privileges -- Initialization, stopping, or pausing of the audit logs -- Creation and deletion of system-level objects -","Assessment -- Audit trail can be reconstructed from audit logs -- Audit logs are stored in a secure location -- Audit logs are protected against unauthorized access, modification, and deletion -- Review of records -- Interviews with personnel to understand the audit logging implementation - -References -- RFC 3647 - Internet X.509 Public Key Infrastructure Certificate Policy and Certification Practices Framework -- NIST - Guide to Computer Security Log Management -- ISO/IEC 27001 - Information security management systems -- ISO/IEC 27099 - Public key infrastructure -" -O.12,Monitoring and auditing,"Monitoring and auditing establish the necessary controls to detect and respond to security events and to provide evidence of compliance with the disclosed business practices. -The events and logs typically serves as a basis for incident response and forensic analysis in case of security incidents, however, they can also be used for other purposes, such as performance analysis, capacity planning, and troubleshooting. - -Monitoring and auditing provide reasonable assurance that: -- Unauthorized PKI system usage is detected -- Critical high impact events are monitored -- Appropriate logs are collected and relevant issues are alerted -- The confidentiality and integrity of current and archived audit logs are maintained for the required period of time -- Audit logs are completely and confidentially archived in accordance with disclosed business practices -- Events and logs are reviewed periodically by authorized personnel - -The outputs from the monitoring and auditing activities are typically used as inputs for the risk assessment and management activities, including incident response management and investigation of high impact events. -",O.12.4,Monitoring of operational and security events is implemented,"Monitoring of operational and security events should be implemented to ensure that the PKI implementation is operating as expected and that the security events are detected and responded to in a timely manner and that evidence of any malicious event is identified. The monitoring should be implemented for all critical systems and components, including the CA, RA, OCSP, HSM, and other relevant systems. - -Monitoring should be aligned with the monitoring and auditing requirements defined in the CP, CPS, and other relevant documents. The monitoring should be implemented to ensure that the requirements are met. -","Assessment -- Monitoring of operational and security events is implemented according to the requirements -- Review of monitoring implementation, including CA key life cycle management related events, security sensitive events, and other relevant events -- Review of monitoring events and alerts -- Interviews with personnel responsible for monitoring - -References -- ISO/IEC 27001 - Information security management systems -- ISO/IEC 20000 and related standards -- ISO/IEC 27099 - Public key infrastructure -" -O.12,Monitoring and auditing,"Monitoring and auditing establish the necessary controls to detect and respond to security events and to provide evidence of compliance with the disclosed business practices. -The events and logs typically serves as a basis for incident response and forensic analysis in case of security incidents, however, they can also be used for other purposes, such as performance analysis, capacity planning, and troubleshooting. - -Monitoring and auditing provide reasonable assurance that: -- Unauthorized PKI system usage is detected -- Critical high impact events are monitored -- Appropriate logs are collected and relevant issues are alerted -- The confidentiality and integrity of current and archived audit logs are maintained for the required period of time -- Audit logs are completely and confidentially archived in accordance with disclosed business practices -- Events and logs are reviewed periodically by authorized personnel - -The outputs from the monitoring and auditing activities are typically used as inputs for the risk assessment and management activities, including incident response management and investigation of high impact events. -",O.12.5,Critical events are immediately alerted and resolved according to incident response plans,"Critical events should be immediately alerted and resolved according to incident response plans. Monitoring implementation should ensure that critical events are detected and alerted in a timely manner. This can be done manually or in an automated way. -","Assessment -- Review of requirements for alerting on critical event, including security sensitive events -- Review of monitoring implementation -- Review of documentation of critical events -- Interviews with personnel to check the understanding of critical events and their handling - -References -- ISO/IEC 27001 - Information security management systems -- ISO/IEC 20000 and related standards -- ISO/IEC 27099 - Public key infrastructure -" -O.12,Monitoring and auditing,"Monitoring and auditing establish the necessary controls to detect and respond to security events and to provide evidence of compliance with the disclosed business practices. -The events and logs typically serves as a basis for incident response and forensic analysis in case of security incidents, however, they can also be used for other purposes, such as performance analysis, capacity planning, and troubleshooting. - -Monitoring and auditing provide reasonable assurance that: -- Unauthorized PKI system usage is detected -- Critical high impact events are monitored -- Appropriate logs are collected and relevant issues are alerted -- The confidentiality and integrity of current and archived audit logs are maintained for the required period of time -- Audit logs are completely and confidentially archived in accordance with disclosed business practices -- Events and logs are reviewed periodically by authorized personnel - -The outputs from the monitoring and auditing activities are typically used as inputs for the risk assessment and management activities, including incident response management and investigation of high impact events. -",O.12.6,Review of events and logs is periodically performed,"Logs and events should be reviewed frequently, preferably automatically, to determine security related issues, potential systems failure, identify anomalies or suspected activity. Regular review should be confirmed by authorized personnel who can proactively identify issues before they become problems. - -The review of logs and events should be performed periodically and the frequency should be based on the risk assessment. Any potential issues should be reported and resolved according to the incident response plans. -","Assessment -- Review of logs and events is performed periodically -- Review of logs and events is performed according to the requirements -- Review of logs and events is confirmed by authorized personnel -- Interview with personnel responsible for review of logs and events - -References -- ISO/IEC 27001 - Information security management systems -- ISO/IEC 20000 and related standards -- NIST - Guide to Computer Security Log Management -- ISO/IEC 27099 - Public key infrastructure -" -R.13,Sourcing,"PKI is a complex system that requires a lot of resources to be managed and maintained. Proper sourcing of the resources is one of the key factors of a mature infrastructure that can maintain and improve trust over the time. The resources can be: -- Financial resources needed to maintain the PKI -- Computing resources like hardware, software, tools, technologies -- Human resources (personnel) -- Management resources like processes and procedures - -Sourcing is a process of defining the required resources and their specification, availability, and management. Sourcing requires monitoring and periodic review of the resources needed and alignment with the overall strategy of the organization and scope of the PKI. -",R.13.1,Resources are identified and documented,"Resources needed for proper management of the PKI are identified and documented. Resources should be aligned with the PKI scope and use-case(s) that should be supported. The main question to answer here is ""Do we know what resources we need to manage the PKI?"". -","Assessment -The following is sample evidence that can be used to assess the requirement: -- Resource management process -- Documented requirements on the resources -- Categorization of resources (an example can be people, processes, procedures, tools, technologies) -- Alignment with the scope of the use-case - -References -N/A -" -R.13,Sourcing,"PKI is a complex system that requires a lot of resources to be managed and maintained. Proper sourcing of the resources is one of the key factors of a mature infrastructure that can maintain and improve trust over the time. The resources can be: -- Financial resources needed to maintain the PKI -- Computing resources like hardware, software, tools, technologies -- Human resources (personnel) -- Management resources like processes and procedures - -Sourcing is a process of defining the required resources and their specification, availability, and management. Sourcing requires monitoring and periodic review of the resources needed and alignment with the overall strategy of the organization and scope of the PKI. -",R.13.2,Resources are clearly defined,"Identified resources should be properly defined and specified. The specification depends on the type of the resource and can include for example the following: -- People: required skills to perform the tasks, roles, and responsibilities -- Tools: description, supported technologies -- Technologies: required functionality and performance -- Financial resources: required budget, funding sources -- Management resources: processes and procedures, inputs, outputs -- Other resources: description, specification, requirements - -Without clearly defined resources, there could be misuse of the organization’s assets or inconsistent interaction with personnel and other parties, leading to insecure and untrusted implementation of the PKI. -","Assessment -The following is a sample evidence that can be used to assess the requirement: -- Resource management process -- Documented requirements on the resources -- Categorization of resources (an example can be: people, processes, procedures, tools, technologies) -- Alignment with the scope of the use-case -- Interview personnel in various roles - -References -- ISO/IEC 20000 and related standards -" -R.13,Sourcing,"PKI is a complex system that requires a lot of resources to be managed and maintained. Proper sourcing of the resources is one of the key factors of a mature infrastructure that can maintain and improve trust over the time. The resources can be: -- Financial resources needed to maintain the PKI -- Computing resources like hardware, software, tools, technologies -- Human resources (personnel) -- Management resources like processes and procedures - -Sourcing is a process of defining the required resources and their specification, availability, and management. Sourcing requires monitoring and periodic review of the resources needed and alignment with the overall strategy of the organization and scope of the PKI. -",R.13.3,Availability of resources,"Identified and defined resources should be available at the required capacity. The availability of the resources should be aligned with the overall strategy of the organization and scope of the PKI. The availability of the resources should be controlled to ensure that the resources are available when needed. -","Assessment -- Review of the resource management process -- Review of the capacity or demand management process -- Alignment with the strategy of the organization and scope of the PKI -- Review of the assignment of the resources to the tasks -- Utilization and performance of the services - -References -- ISO/IEC 20000 and related standards -" -R.13,Sourcing,"PKI is a complex system that requires a lot of resources to be managed and maintained. Proper sourcing of the resources is one of the key factors of a mature infrastructure that can maintain and improve trust over the time. The resources can be: -- Financial resources needed to maintain the PKI -- Computing resources like hardware, software, tools, technologies -- Human resources (personnel) -- Management resources like processes and procedures - -Sourcing is a process of defining the required resources and their specification, availability, and management. Sourcing requires monitoring and periodic review of the resources needed and alignment with the overall strategy of the organization and scope of the PKI. -",R.13.4,Resources are periodically reviewed,"Resource should be periodically reviewed to ensure the accurate use of the resources and secure operations. Frequency of the review depends on the complexity and criticality of the infrastructure. Good practice is to perform reviews at least once a year. - -Review includes the following (but not limited to) -- Analysis that the resources continue to match with the scope and capacity required to provide the services -- Review of the specifications of the resources to continue support of the PKI -- Review announcements and technology trends (for example “end of life” plans for a technology) -- Documentation of any remediation plan, updates to sourcing of the PKI, that should be approved by the management -","Assessment -- Review of changes to the PKI scope -- Review of the capacity or available resources -- Vendor announcements -- Technology trends -- Skills and knowledge of the personnel - -References -N/A -" -R.14,Knowledge and training,"The purpose of this category is to ensure that the PKI personnel have the required knowledge and skills to perform their duties and responsibilities. -Education and continuous gathering of required knowledge and skills to manage the PKI is important to be aware and properly react to current trends and threats that may impact the PKI. - -Each of the personnel should be aware of the PKI policies and procedures, and should be able to perform their duties and responsibilities in accordance with the PKI policies and procedures. -",R.14.1,Establish training plan,"The training plan should be established and maintained to ensure that personnel have the required knowledge and skills to perform their duties and responsibilities. It should reflect the current state of the PKI implementation and be updated when the PKI implementation changes, and provide necessary information for all personnel that are involved in the PKI implementation. - -Training plan is built with PKI needs and requirements in mind and should cover: -- Training prerequisites -- Training matrix (who needs to be trained and what training should be received) -- Training schedule -- Training format and methods -- Requirements on training reports and records -- Training plan review and update - -There can be different methods of training, depending on the needs and requirements: -- Instructor-led training -- Internal or external webinars -- Coaching -- Self-paced training -- Online resources -- Shadowing or reverse-shadowing -","Assessment -- Documented training plan -- Training plan is up-to-date -- Training plan is approved and communicated to all personnel -- Training plan is integrated in organization - -References -- NIST SP 800-16 Information Technology Security Training Requirements: a Role- and Performance-Based Model -- NIST SP 800-50 Building an Information Technology Security Awareness and Training Program -- European Cybersecurity Skills Framework (ECSF) -" -R.14,Knowledge and training,"The purpose of this category is to ensure that the PKI personnel have the required knowledge and skills to perform their duties and responsibilities. -Education and continuous gathering of required knowledge and skills to manage the PKI is important to be aware and properly react to current trends and threats that may impact the PKI. - -Each of the personnel should be aware of the PKI policies and procedures, and should be able to perform their duties and responsibilities in accordance with the PKI policies and procedures. -",R.14.2,Responsible personnel receive training,"The responsible personnel should be aware of the current policies and procedures that are related to the context of the PKI implementation. Training should be provided to personnel that are responsible for the management, operation, and administration of the PKI. - -Training is provided in accordance with the current and approved training plan. - -Methods and training content can vary, depending on personnel roles and covers: -- New hires as part of the onboarding process -- Periodic training for all personnel (the frequency of the training depends on the role and responsibilities) - -For each training, attendance should be recorded and documented, and in case the training is not completed, the reason should be documented. -In case there are requirements for score or threshold to be achieved, the results should be documented. -","Assessment -- Review training matrix -- Review documented training results -- Review training records -- Relevancy of the training content -- Training is provided in accordance with the training plan -- Training completeness - -References -- NIST SP 800-16 Information Technology Security Training Requirements: a Role- and Performance-Based Model -- NIST SP 800-50 Building an Information Technology Security Awareness and Training Program -- European Cybersecurity Skills Framework (ECSF) -" -R.14,Knowledge and training,"The purpose of this category is to ensure that the PKI personnel have the required knowledge and skills to perform their duties and responsibilities. -Education and continuous gathering of required knowledge and skills to manage the PKI is important to be aware and properly react to current trends and threats that may impact the PKI. - -Each of the personnel should be aware of the PKI policies and procedures, and should be able to perform their duties and responsibilities in accordance with the PKI policies and procedures. -",R.14.3,Perform security awareness training,"Security awareness education is an ongoing activity. The security awareness program is implemented to make all personnel aware of their role in protecting the security and establishing trust by the PKI implementation. It should stay up to date to reflect latest security trends, threats, and challenges. - -Security awareness should ensure that personnel are knowledgeable about the threat landscape, their responsibility for the operation of relevant security controls, and are able to access assistance and guidance when required. - -Different methods can be applied to provide security awareness, for example: -- Posters and letters with the specific topic -- Team meetings and webinars -- Security incentives and rewards -- Training and education -","Assessment -- Examine security awareness program -- Interview personnel to verify that they are aware of their responsibilities -- Review security awareness training records -- Security awareness training is provided in accordance with the training plan -- Review content of the security awareness training - -References -- NIST SP 800-50 Building an Information Technology Security Awareness and Training Program -- PCI SSC - Best Practices for Implementing a - Security Awareness Program -- Raising Awareness of Cybersecurity -" -R.14,Knowledge and training,"The purpose of this category is to ensure that the PKI personnel have the required knowledge and skills to perform their duties and responsibilities. -Education and continuous gathering of required knowledge and skills to manage the PKI is important to be aware and properly react to current trends and threats that may impact the PKI. - -Each of the personnel should be aware of the PKI policies and procedures, and should be able to perform their duties and responsibilities in accordance with the PKI policies and procedures. -",R.14.4,Establish education plan,"Proper education plan is required to stay up to date with the development of the latest technologies, security practices, and controls that have impact on the PKI and its future development. - -The education plan should establish a robust base for the personnel to gain relevant knowledge that are out of scope of the internal training plan, but should be aligned with it to ensure that the personnel are able to perform their duties and responsibilities. The education plan should cover: -- Education requirements and prerequisites -- Recommended education approach and methods -- Approach to monitor and assess the education results - -Methods to provide education can vary: -- Internal or external courses -- Incentives and rewards -- Mentoring, coaching, and shadowing -- Competitions and challenges -","Assessment -- Review education plan and its alignment with the training plan -- Interview personnel to verify their educational goals -- Validate education records - -References -- NIST SP 800-16 Information Technology Security Training Requirements: a Role- and Performance-Based Model -- NIST SP 800-50 Building an Information Technology Security Awareness and Training Program -- European Cybersecurity Skills Framework (ECSF) -" -R.14,Knowledge and training,"The purpose of this category is to ensure that the PKI personnel have the required knowledge and skills to perform their duties and responsibilities. -Education and continuous gathering of required knowledge and skills to manage the PKI is important to be aware and properly react to current trends and threats that may impact the PKI. - -Each of the personnel should be aware of the PKI policies and procedures, and should be able to perform their duties and responsibilities in accordance with the PKI policies and procedures. -",R.14.5,Periodically review knowledge,"The training plan should be reviewed and updated periodically to ensure that it is up-to-date and covers all aspects of the specific PKI implementation. - -Periodical review of the training plans helps to maintain required skills and knowledge for the responsible personnel. -It provides assurance that the expected controls are active and working as intended. -","Assessment -- Training plan review process -- Implementation of review process -- Validation of documentation and reviews - -References -- NIST SP 800-16 Information Technology Security Training Requirements: a Role- and Performance-Based Model -- NIST SP 800-50 Building an Information Technology Security Awareness and Training Program -- European Cybersecurity Skills Framework (ECSF) -" -R.15,Awareness,"Providing awareness about the PKI and its purpose in the organization and outside ensures that each PKI participant understands it properly and is timely informed about any important events that may impact the participant. - -The awareness is important for all PKI participants to know how to handle exceptional situations and how to react to them. It is also important to know how to communicate and when so as to not misunderstand any issues or incidents. -",R.15.1,Establish and maintain awareness plan,"Awareness plan should be established and maintained to ensure that the PKI participants are aware of all relevant events related to the PKI implementation and its purpose in the organization and outside. It should cover at lease the following information: -- How the organization discloses information to PKI participants -- Contact information -- How are changes communicated -- Who is responsible for accurate awareness -- Resolving communication issues and incidents - -Every PKI participant should receive information and relevant resource in a timely manner according to the awareness plan. -","Assessment -- Documented awareness plan -- Awareness plan is up-to-date -- Review awareness content to ensure that it is contains relevant information -- Awareness plan is approved and communicated to all PKI participants -- Awareness plan is integrated in the organization - -References -- RFC 3647 Internet X.509 Public Key Infrastructure Certificate Policy and Certification Practices Framework -- ETSI EN 319 401 - General Policy Requirements for Trust Service Providers -" -R.15,Awareness,"Providing awareness about the PKI and its purpose in the organization and outside ensures that each PKI participant understands it properly and is timely informed about any important events that may impact the participant. - -The awareness is important for all PKI participants to know how to handle exceptional situations and how to react to them. It is also important to know how to communicate and when so as to not misunderstand any issues or incidents. -",R.15.2,Disclose PKI information,"Information about the policies, processes, and procedures that are maintained by the PKI should be disclosed to the PKI participants. This information should be available on a timely basis and in a form that is understandable to the PKI participants. - -Organization maintaining the PKI implementation should disclose the following information on a website or other appropriate media that can be reached by the PKI participants: -- Certificate Policy -- Certification Practice Statement -- Revocation information -- Valid CA certificates -- Vulnerability reports -- Audit reports -- Contact information -- Obligations of the PKI participants -- Legal liability of the PKI participants -- Warranty information -- Disclaimer information -- Privacy and data protection information -- Other relevant information -","Assessment -- Review disclosure statement content to ensure that it is contains relevant information -- Disclosure statement is approved and communicated to all PKI participants -- Information is available to all PKI participants -- Information is up-to-date - -References -- RFC 3647 Internet X.509 Public Key Infrastructure Certificate Policy and Certification Practices Framework -- ETSI EN 319 401 - General Policy Requirements for Trust Service Providers -" -R.15,Awareness,"Providing awareness about the PKI and its purpose in the organization and outside ensures that each PKI participant understands it properly and is timely informed about any important events that may impact the participant. - -The awareness is important for all PKI participants to know how to handle exceptional situations and how to react to them. It is also important to know how to communicate and when so as to not misunderstand any issues or incidents. -",R.15.3,Establish single point of contact,"The single point of contact (SPOC) provides a convenient way for any PKI participant to contact the organization and responsible personnel of the PKI implementation. The single point of contact should be available 24/7 and should be able to provide relevant information and trigger appropriate procedures if needed based on the situation. - -Contact information for the SPOC should be disclosed to all PKI participants. -The SPOC may be reached through different communication channels, such as: -- Email -- Phone -- Web site form -- Other -","Assessment -- Contact SPOC to ensure that it is available and responds in a timely manner -- Review that the SPOC communicates according to the awareness plan -- Review that the SPOC is able to provide relevant information and trigger appropriate procedures if needed based on the situation - -References -- RFC 3647 Internet X.509 Public Key Infrastructure Certificate Policy and Certification Practices Framework -- ETSI EN 319 401 - General Policy Requirements for Trust Service Providers -" -R.15,Awareness,"Providing awareness about the PKI and its purpose in the organization and outside ensures that each PKI participant understands it properly and is timely informed about any important events that may impact the participant. - -The awareness is important for all PKI participants to know how to handle exceptional situations and how to react to them. It is also important to know how to communicate and when so as to not misunderstand any issues or incidents. -",R.15.4,Timely communication of important information,"In the event of an incident with high impact to the security and established trust of the PKI implementation, the organization should communicate the information to the PKI participants in a timely manner to avoid increased escalation of the event and inform participants of further actions that may be required to execute. - -Example of events that require timely communication may be: -- Compromise of the private key -- Changes in the Certificate Policy -- Changes in the Certification Practice Statement -- Security breach -- Other events that may require immediate action by the PKI participants -","Assessment -- Documented procedures to timely inform PKI participants about high impact events -- Review that the procedures are followed -- Interview personnel to ensure that they are aware of the procedures and know how to communicate the information - -References -- RFC 3647 Internet X.509 Public Key Infrastructure Certificate Policy and Certification Practices Framework -- ETSI EN 319 401 - General Policy Requirements for Trust Service Providers -" diff --git a/integrations/eramba/pkimm-2.0.0.csv b/integrations/eramba/pkimm-2.0.0.csv deleted file mode 100644 index da35f8b..0000000 --- a/integrations/eramba/pkimm-2.0.0.csv +++ /dev/null @@ -1,1997 +0,0 @@ -G.strategy-and-vision,Strategy and vision,"Trusted and secure PKI must be properly managed and supported by the organization. The existence of a strategy and vision for the PKI is one of the key factors for the success of the PKI and contributes to the overall maturity. The strategy and vision should be aligned with the organizational goals and approach and should be followed and measured regularly. - -Formal documentation about the business drivers, scope, and design of the PKI helps to ensure that the PKI is properly aligned and understood to support the organizational. The documentation should be reviewed and updated regularly to ensure that the PKI is aligned with the organizational goals and needs. - -Undefined or unclear understanding and leadership can cause loss of the established trust and can lead to the failure of the PKI quickly. -",G.strategy-and-vision.sponsor-support,Organizational sponsor and support,"The success of the PKI implementation highly depends on the organization top management support. Top management typically also acts as a sponsor of the PKI, meaning that they allocate and approve budget needed to build and maintain the PKI. - -The basic assumption is that the established digital trust is going to be maintained and developed for years, and therefore it is important to have a long-term vision and strategy for the PKI. The strategy and vision should be aligned with the overall organizational goals and approach. -","Assessment -The following is sample evidence that can be used to assess the requirement: -- Interview with the top management -- Documented strategy and vision -- Documented organizational goals and approach -- Understanding of why the PKI is needed and what is the value for the organization -- Support and sponsorship of the top management - -References -- ISO/IEC 27001 - Information security management systems" -G.strategy-and-vision,Strategy and vision,"Trusted and secure PKI must be properly managed and supported by the organization. The existence of a strategy and vision for the PKI is one of the key factors for the success of the PKI and contributes to the overall maturity. The strategy and vision should be aligned with the organizational goals and approach and should be followed and measured regularly. - -Formal documentation about the business drivers, scope, and design of the PKI helps to ensure that the PKI is properly aligned and understood to support the organizational. The documentation should be reviewed and updated regularly to ensure that the PKI is aligned with the organizational goals and needs. - -Undefined or unclear understanding and leadership can cause loss of the established trust and can lead to the failure of the PKI quickly. -",G.strategy-and-vision.responsible-leadership,Formal assignment of responsible leadership,"Proper leadership and responsible person should be assigned by the management to fulfil the role for the establishment, maintenance, and development of the PKI according to the strategy and vision. The responsible person should be able to make decisions and take actions to ensure the PKI is aligned with the organizational goals and needs. -","Assessment -The formal assignment of the responsible person should be documented and approved by the management. Formal document should contains identification of the person and understanding of the role and responsibilities. -Interview with the responsible person should confirm the understanding of the role and responsibilities, driving the PKI implementation according to the organizational strategy. - -References -- ISO/IEC 27001 - Information security management systems" -G.strategy-and-vision,Strategy and vision,"Trusted and secure PKI must be properly managed and supported by the organization. The existence of a strategy and vision for the PKI is one of the key factors for the success of the PKI and contributes to the overall maturity. The strategy and vision should be aligned with the organizational goals and approach and should be followed and measured regularly. - -Formal documentation about the business drivers, scope, and design of the PKI helps to ensure that the PKI is properly aligned and understood to support the organizational. The documentation should be reviewed and updated regularly to ensure that the PKI is aligned with the organizational goals and needs. - -Undefined or unclear understanding and leadership can cause loss of the established trust and can lead to the failure of the PKI quickly. -",G.strategy-and-vision.scope-and-drivers,Scope and business drivers for PKI,"The scope of the PKI should be clearly defined and documented. The scope should be defined in terms of the use-cases that the PKI is going to support. Each use-case can have a different requirements and therefore different strategy. The use-cases should be defined in terms of the business drivers that are going to be supported by the PKI. Business drivers helps to document alignment with the overall organizational goals. - -The scope and business drivers can be considered as a formal high-level overview of the PKI strategy and vision. -Its purpose is also to create a common understanding of the organizational PKI and to provide direction for the detailed design and implementation. -The target audience consists typically of architects, experts, advisors, management, and sponsors. -","Assessment -The following is sample evidence that can be used to assess the requirement: -- Documented scope of the PKI -- Documented business drivers -- Documented use-cases -- Documented alignment with the organizational goals - -References -- ISO/IEC 27001 - Information security management systems -- The Open Group Architecture Framework (TOGAF)" -G.strategy-and-vision,Strategy and vision,"Trusted and secure PKI must be properly managed and supported by the organization. The existence of a strategy and vision for the PKI is one of the key factors for the success of the PKI and contributes to the overall maturity. The strategy and vision should be aligned with the organizational goals and approach and should be followed and measured regularly. - -Formal documentation about the business drivers, scope, and design of the PKI helps to ensure that the PKI is properly aligned and understood to support the organizational. The documentation should be reviewed and updated regularly to ensure that the PKI is aligned with the organizational goals and needs. - -Undefined or unclear understanding and leadership can cause loss of the established trust and can lead to the failure of the PKI quickly. -",G.strategy-and-vision.architecture,Architecture and design of the PKI,"The architecture and design of the PKI should be documented to provide a clear understanding of the implementation and technologies that are involved. The architecture and design should be aligned with the scope and business drivers for the PKI and should be reviewed and updated regularly. - -The architecture and design typically consists of the following: -- Functional and technical design description -- Description of logical components -- Network infrastructure design -- Technology involved -- Integration requirements and interfaces (APIs) -- Support systems (such as IAM, logging, monitoring, etc.) -- Operational requirements -- Security requirements -- Deployment options -- Staging and testing - -The architecture and design are further used for the implementation of the PKI and serves as an input for the PKI team. It can be also used for the procurement of the PKI components and services that are needed for the implementation. -","Assessment -The following is sample evidence that can be used to assess the requirement: -- Documented architecture and design -- Alignment with the scope and business drivers -- Interview with the PKI team to confirm the understanding of the architecture and design - -References -- ETSI EN 319 401 - General Policy Requirements for Trust Service Providers -- The Open Group Architecture Framework (TOGAF)" -G.policies-and-documentation,Policies and documentation,"Documented policies plays an important role in the secure and consistent management of the PKI. The goal is to minimize financial and operational threats and risks in the digital world. Well-described policies and security measures increase overall trust in the ecosystem of trust services and are a condition for successful operation. The basis for these matters lies in relevant laws and regulations, international standards and best practices. - -It consists of: -- formal policies and practice statements for supported PKI services and use-cases -- formal management of agreements between parties involved in the PKI -- certificate and key management rules -- roles and responsibilities in the management of the PKI -- documented disclosure statements -- maintenance and review of policies and documentation -- code of practice for information security management, techniques and risk management - -Properly documented policies keeps the PKI assets trusted over the time and serves as a basis for integrated processes and procedures. It is a living management system that is continuously updated and changed as technologies, security, and compliance requirements change. - -The Certificate Policy (CP) defines the overall policies and requirements of a PKI, the Certification Practice Statement (CPS) provides detailed operational procedures followed by the Certification Authority (CA), and the disclosure statement offers transparency about the CA's identity and services to relying parties. -",G.policies-and-documentation.policy-scope,The scope of policies is defined and documented,"Each PKI implementation and use case is different, therefore it requires different care. The scope of policies that are applicable for the implementation should be defined and documented. When the proper description of the policies scope is provided, it helps all parties involved to understand the purpose of the policies and their applicability. - -The scope can include the following: -- Identification of the policies required for the implementation -- Reasoning why the policies are required or not required -- Structure of policies and documentation -- List of policies with references, versions, etc. -- Any other relevant information -","Assessment -- The scope of policies is defined and documented -- The scope of policies is complete -- Interview with the management and PKI responsible personnel to confirm the scope - -References -- RFC 3647 - Internet X.509 Public Key Infrastructure Certificate Policy and Certification Practices Framework -- ISO/IEC 27001 - Information security management systems -- ETSI EN 319 401 - General Policy Requirements for Trust Service Providers" -G.policies-and-documentation,Policies and documentation,"Documented policies plays an important role in the secure and consistent management of the PKI. The goal is to minimize financial and operational threats and risks in the digital world. Well-described policies and security measures increase overall trust in the ecosystem of trust services and are a condition for successful operation. The basis for these matters lies in relevant laws and regulations, international standards and best practices. - -It consists of: -- formal policies and practice statements for supported PKI services and use-cases -- formal management of agreements between parties involved in the PKI -- certificate and key management rules -- roles and responsibilities in the management of the PKI -- documented disclosure statements -- maintenance and review of policies and documentation -- code of practice for information security management, techniques and risk management - -Properly documented policies keeps the PKI assets trusted over the time and serves as a basis for integrated processes and procedures. It is a living management system that is continuously updated and changed as technologies, security, and compliance requirements change. - -The Certificate Policy (CP) defines the overall policies and requirements of a PKI, the Certification Practice Statement (CPS) provides detailed operational procedures followed by the Certification Authority (CA), and the disclosure statement offers transparency about the CA's identity and services to relying parties. -",G.policies-and-documentation.certificate-policy,Certificate policy is documented and published,"Certificate Policy (CP) is used to establish the controls of the issuing party and the roles and responsibilities of its entities for the specific PKI implementation and use case. It's used to provide assurance to partners and show the trustworthiness by the use of standards. It can be considered as a high level contract between the parties involved in the PKI and therefore should be published and available to all parties involved. - -CPs are described in a document form where the content may differ. Multiple policies can be part of a single document for different use cases. A CP contains a set of rules that indicates the applicability of a certificate to a particular community and/or class of applications with common security requirements or level of security (for instance certificates for the purpose of: persons, domains, organizations, authenticity and confidentiality, services). To uniquely identify the purpose of the certificates the CP contains unique numbers (Object Identifier, OID) which needs to be registered. - -In general a CP addresses the following items: -- Types of certificates -- Document name and identification -- PKI participants -- Certificate usage -- Policy administration -- Definitions -- Publication and repository responsibilities -- Identification and authentication -- Certificate life-cycle operational requirements -- Facility management and operational controls -- Technical security controls -- Certificate, CRL, and OCSP profiles -- Compliance audit and other assessments - - Other business and legal matters -","Assessment -- The CP is properly documented in its full scope -- The CP clearly defines the scope of the policy, such as the purpose of the security and assurance levels, the type and use of its certificates and parties involved -- The legal rights and responsibilities of parties are described in the CP -- CP has listed correct object identifiers for the purpose it's used for -- Verify that the CP is published and available to all parties involved -- Interview with the management and PKI responsible personnel to confirm the CP is accurate and followed - -References -- RFC 3647 - Internet X.509 Public Key Infrastructure Certificate Policy and Certification Practices Framework -- ISO/IEC 27001 - Information security management systems -- ETSI EN 319 411-1 - Policy and security requirements for Trust Service Providers issuing certificates" -G.policies-and-documentation,Policies and documentation,"Documented policies plays an important role in the secure and consistent management of the PKI. The goal is to minimize financial and operational threats and risks in the digital world. Well-described policies and security measures increase overall trust in the ecosystem of trust services and are a condition for successful operation. The basis for these matters lies in relevant laws and regulations, international standards and best practices. - -It consists of: -- formal policies and practice statements for supported PKI services and use-cases -- formal management of agreements between parties involved in the PKI -- certificate and key management rules -- roles and responsibilities in the management of the PKI -- documented disclosure statements -- maintenance and review of policies and documentation -- code of practice for information security management, techniques and risk management - -Properly documented policies keeps the PKI assets trusted over the time and serves as a basis for integrated processes and procedures. It is a living management system that is continuously updated and changed as technologies, security, and compliance requirements change. - -The Certificate Policy (CP) defines the overall policies and requirements of a PKI, the Certification Practice Statement (CPS) provides detailed operational procedures followed by the Certification Authority (CA), and the disclosure statement offers transparency about the CA's identity and services to relying parties. -",G.policies-and-documentation.practice-statement,Certification practice statement is documented and published,"In addition to a CP, there is typically a Certification Practice Statement (CPS). While a CP is more at a strategic level, detailed information about how things should be carried out is part of a CPS (tactical level). The CP and CPS can be combined into a single managed document, however they are typically split for most of the PKI implementations for better orientation. - -The CPS covers the same items as the CP, but includes technical detail of how the CP is implemented. All parties involved in the PKI should be aware of the CPS and follow it. The CPS is a living document that is continuously updated and changed as technologies, security, and compliance requirements change. -","Assessment -- The CPS is properly documented in its full scope -- CPS is published and available to all parties involved -- Interview with the management and PKI responsible personnel to confirm the CPS is accurate and followed -- Confirm that the information in the CPS is consistent with the information in the CP - -References -- RFC 3647 - Internet X.509 Public Key Infrastructure Certificate Policy and Certification Practices Framework -- ISO/IEC 27001 - Information security management systems -- ETSI EN 319 411-1 - Policy and security requirements for Trust Service Providers issuing certificates" -G.policies-and-documentation,Policies and documentation,"Documented policies plays an important role in the secure and consistent management of the PKI. The goal is to minimize financial and operational threats and risks in the digital world. Well-described policies and security measures increase overall trust in the ecosystem of trust services and are a condition for successful operation. The basis for these matters lies in relevant laws and regulations, international standards and best practices. - -It consists of: -- formal policies and practice statements for supported PKI services and use-cases -- formal management of agreements between parties involved in the PKI -- certificate and key management rules -- roles and responsibilities in the management of the PKI -- documented disclosure statements -- maintenance and review of policies and documentation -- code of practice for information security management, techniques and risk management - -Properly documented policies keeps the PKI assets trusted over the time and serves as a basis for integrated processes and procedures. It is a living management system that is continuously updated and changed as technologies, security, and compliance requirements change. - -The Certificate Policy (CP) defines the overall policies and requirements of a PKI, the Certification Practice Statement (CPS) provides detailed operational procedures followed by the Certification Authority (CA), and the disclosure statement offers transparency about the CA's identity and services to relying parties. -",G.policies-and-documentation.disclosure-statement,Disclosure statement is documented and published,"The disclosure statement (DS) is a document that describes the PKI and its services. It refers to a document that discloses the relevant information about the CA and its services to the relying parties. - -It typically includes information like: -- CA's identity, legal status, and contact information -- Certificate types, verification procedures and compliance with standards -- Reliance limits -- Obligations of the CA and the relying parties -- Warranty and liability limitations -- Agreement, CP and CPS -- Privacy policy -- Refund policy and claims -- Information on audit and compliance - -The purpose of a DS is to provide transparency to relying parties, allowing them to assess the trustworthiness and reliability of the CA before relying on its certificates. -","Assessment -- The DS is properly documented in its full scope -- DS is published and available to all parties involved -- Interview with the management and PKI responsible personnel to confirm the DS is accurate -- Confirm that the information in the DS is consistent with the information in the CP and CPS - -References -- ETSI EN 319 411-1 - Policy and security requirements for Trust Service Providers issuing certificates" -G.policies-and-documentation,Policies and documentation,"Documented policies plays an important role in the secure and consistent management of the PKI. The goal is to minimize financial and operational threats and risks in the digital world. Well-described policies and security measures increase overall trust in the ecosystem of trust services and are a condition for successful operation. The basis for these matters lies in relevant laws and regulations, international standards and best practices. - -It consists of: -- formal policies and practice statements for supported PKI services and use-cases -- formal management of agreements between parties involved in the PKI -- certificate and key management rules -- roles and responsibilities in the management of the PKI -- documented disclosure statements -- maintenance and review of policies and documentation -- code of practice for information security management, techniques and risk management - -Properly documented policies keeps the PKI assets trusted over the time and serves as a basis for integrated processes and procedures. It is a living management system that is continuously updated and changed as technologies, security, and compliance requirements change. - -The Certificate Policy (CP) defines the overall policies and requirements of a PKI, the Certification Practice Statement (CPS) provides detailed operational procedures followed by the Certification Authority (CA), and the disclosure statement offers transparency about the CA's identity and services to relying parties. -",G.policies-and-documentation.policy-review,Policies are periodically reviewed and updated,"Policies are living documents that are continuously updated and changed as technologies, security, and compliance requirements change. The policies should be reviewed and updated periodically. The frequency of review should be determined by the organization. Good practice is to review policies at least annually or when there are significant changes in the PKI or its environment. -","Assessment -- The policies are reviewed and updated periodically -- Check the last review date of the policies -- Implementation of review process -- Validation of documentation and reviews -- Interview with the management and PKI responsible personnel to confirm the policies are reviewed and updated periodically - -References -- RFC 3647 - Internet X.509 Public Key Infrastructure Certificate Policy and Certification Practices Framework -- ISO/IEC 27001 - Information security management systems -- ETSI EN 319 401 - General Policy Requirements for Trust Service Providers" -G.compliance,Compliance,"Compliance refers to the ability of an organization to adhere to relevant laws, regulations, and standards related to the scope of the PKI. A properly implemented PKI Compliance program ensures that an organization's PKI is protected from threats and risks that could result in financial loss, reputational damage, legal liabilities, or eventually in the loss of trust. - -The compliance process helps to manage a PKI in a way that meets legal and regulatory requirements, and ensures information is used and protected appropriately, according to defined and documented policies and practices statements. - -Compliance is important for several reasons, including: -- It supports the risk management process associated with the PKI assets -- Minimize reputation issues that can lead to the loss of trust -- Provides assurance for the relying parties and subscribers -- Proves adherence to legal requirements - -Overall, compliance and related procedures help to ensure that the PKI is managed and maintained according to the relevant laws, regulations, and standards. This minimizes the risk of loss of trust and provides assurance to PKI participants. -",G.compliance.compliance-policies,"Compliance policies are defined, implemented, and communicated","Compliance policies are a critical component of an organization’s risk management strategy to help ensure that the PKI system is secure, reliable, trustworthy, and meets any applicable regulatory requirements. - -By defining appropriate policies and related procedures and communicating these to all stakeholders who rely on the PKI, the organization can ensure that administrators, operators, and users are properly authenticated and authorized to access the system and that appropriate controls are in place to prevent unauthorized access or misuse of the PKI. - -Having a sound set of compliance policies defined, implemented, and communicated can help to demonstrate that the organization took reasonable steps to protect the PKI and may result in reduced legal liability in the event of a breach due to improper or malicious use of the PKI. - -The compliance policies typically include: -- Laws, industry regulations and government legislation that apply to the organization business and PKI -- Roles and responsibilities -- Compliance program management requirements -- Reporting and auditing requirements -- References to relevant documents (anti-trust, anti-fraud, anti-bribery, anti-money laundering, due diligence, etc.) -- Any other relevant information that rule compliance -","Assessment -- Documented audit and accountability policies -- Documented communication plan for informing stakeholders of the policies -- Formalized process for stakeholder acknowledgement upon receipt of the policies - -References -- ISO 37301 - Compliance management systems and related standard -- NIST Risk Management Framework" -G.compliance,Compliance,"Compliance refers to the ability of an organization to adhere to relevant laws, regulations, and standards related to the scope of the PKI. A properly implemented PKI Compliance program ensures that an organization's PKI is protected from threats and risks that could result in financial loss, reputational damage, legal liabilities, or eventually in the loss of trust. - -The compliance process helps to manage a PKI in a way that meets legal and regulatory requirements, and ensures information is used and protected appropriately, according to defined and documented policies and practices statements. - -Compliance is important for several reasons, including: -- It supports the risk management process associated with the PKI assets -- Minimize reputation issues that can lead to the loss of trust -- Provides assurance for the relying parties and subscribers -- Proves adherence to legal requirements - -Overall, compliance and related procedures help to ensure that the PKI is managed and maintained according to the relevant laws, regulations, and standards. This minimizes the risk of loss of trust and provides assurance to PKI participants. -",G.compliance.compliance-monitoring,A program to monitor compliance with the policies is established,"A PKI compliance monitoring program typically involves ongoing monitoring and testing of the controls and procedures to detect potential compliance violations associated with rules and regulations that govern the issuance, update, or revocation of certificates. - -These programs often include a risk assessment to identify and assess potential risks that could lead to non-compliance, including regulatory changes, operational changes, or employee turnover. - -The monitoring process may include reviewing documentation, conducting interviews with key stakeholders, and reporting any issues or compliance violations. Reporting from compliance monitoring should be communicated to those stakeholders who committed the violation(s) and those stakeholders who are empowered to take corrective action to address the violations observed. -","Assessment -- Documented practices regarding periodic and aperiodic compliance assessments -- Documented practices for regularly review and reporting of security issues -- Documented and implemented processes for investigation and response to suspicious activities - -References -- ISO 37301 - Compliance management systems and related standard -- NIST Risk Management Framework" -G.compliance,Compliance,"Compliance refers to the ability of an organization to adhere to relevant laws, regulations, and standards related to the scope of the PKI. A properly implemented PKI Compliance program ensures that an organization's PKI is protected from threats and risks that could result in financial loss, reputational damage, legal liabilities, or eventually in the loss of trust. - -The compliance process helps to manage a PKI in a way that meets legal and regulatory requirements, and ensures information is used and protected appropriately, according to defined and documented policies and practices statements. - -Compliance is important for several reasons, including: -- It supports the risk management process associated with the PKI assets -- Minimize reputation issues that can lead to the loss of trust -- Provides assurance for the relying parties and subscribers -- Proves adherence to legal requirements - -Overall, compliance and related procedures help to ensure that the PKI is managed and maintained according to the relevant laws, regulations, and standards. This minimizes the risk of loss of trust and provides assurance to PKI participants. -",G.compliance.compliance-responsibilities,Responsibilities for the compliance are formally defined and assigned,"Within the organization, there should exist clear and well documented guidelines outlining which individual, group or team is responsible for ensuring that PKI policies are being followed. This applies to governance and oversight in addition to operational policies and procedures. - -Documenting specifically ""who"" shall be responsible for ensuring PKI policies are being enforced enhances accountability and trustworthiness of the PKI by enforcing the mentality that ""someone is watching"". This will help to mitigate risks associated with improper or malicious acts. -","Assessment -- For each defined procedure, a specific individual or team is identified and assigned to perform the tasks associated with the procedure -- Interview with the personnel to confirm understanding of the role and responsibilities - -References -- ISO 37301 - Compliance management systems and related standard -- NIST Risk Management Framework" -G.compliance,Compliance,"Compliance refers to the ability of an organization to adhere to relevant laws, regulations, and standards related to the scope of the PKI. A properly implemented PKI Compliance program ensures that an organization's PKI is protected from threats and risks that could result in financial loss, reputational damage, legal liabilities, or eventually in the loss of trust. - -The compliance process helps to manage a PKI in a way that meets legal and regulatory requirements, and ensures information is used and protected appropriately, according to defined and documented policies and practices statements. - -Compliance is important for several reasons, including: -- It supports the risk management process associated with the PKI assets -- Minimize reputation issues that can lead to the loss of trust -- Provides assurance for the relying parties and subscribers -- Proves adherence to legal requirements - -Overall, compliance and related procedures help to ensure that the PKI is managed and maintained according to the relevant laws, regulations, and standards. This minimizes the risk of loss of trust and provides assurance to PKI participants. -",G.compliance.regulatory-inventory,"List of relevant laws, regulations, and standards, exist and is maintained","To better understand the relevance to PKI, one should understand the differences between laws, regulations, and standards. - -Laws are legal rules that are enacted by a governing body, such as a federal, state or local government. They are binding and enforceable by the legal system within the jurisdiction of the governing body that enacted them. Violating law can lead to legal consequences, such as fines or imprisonment. - -Regulations are derived from laws and are often meant to supplement and clarify the broader provisions outlined in the laws. Compliance with regulations is mandatory and non-compliance can result in penalties or other legal consequences. - -Standards are voluntary guidelines or specifications typically established by a particular industry group or standards organization. Standards usually define best practices, technical specifications, quality benchmarks, and other criteria and are meant as a means of ensuring consistency, interoperability, and quality. Typically, compliance with standards is not legally required, however, lack of conformance to standards can lead to diminished interoperability and reduced trust. - -With respect to PKI, it is very important to understand what laws, regulations and standards are relevant to the PKI and its ancillary systems. For example, given that PKI involves cryptography, one must be certain to adhere to government laws regarding use and deployment of cryptographic products and solutions. - -And, many times, a PKI will make use of hardware cryptographic modules for key generation and storage. Therefore, it’s critical to ensure that the hardware cryptographic modules comply with the relevant standards. There are many laws, regulations and standards that apply to PKI. As such, it is necessary to maintain a list of the ones that are relevant to your organization to help ensure that none are being overlooked. -","Assessment -- Documented list of applicable laws, regulations and standards is maintained -- Procedures established for periodic review of the laws, regulations and standards -- Procedures established to remediate any deficiencies or non-compliance issues identified -- Procedures established to communicate results of the periodic reviews - -References -- ISO 37301 - Compliance management systems and related standard -- NIST Risk Management Framework" -G.processes-and-procedures,Processes and procedures,"Proper and effective processes and procedures related to PKI operations and management are essential for the successful implementation of the PKI. The processes and procedures should be aligned with the overall organizational policies and statements. - -Process is a set of activities that are performed in a specific order to achieve a specific goal. The process should be documented and measured. The process is also repeatable and can be improved over time, based on the evaluation, feedback, or risk assessment. The scope of the processes is defined by the policies. - -Procedure is a set of instructions that describe how to perform a specific task. The procedure should be also documented and can be used as a reference for the process. Procedure can include specific instructions for the process, such as how to perform a specific task, or how to use a specific tool. - -Processes and procedure typically cover (but are not limited to) the following areas: -- infrastructure management -- data privacy and security -- business continuity, disaster recovery, contingency planning -- supply chain management -- physical security and access control -- incident management -- audit and compliance, evidence and reporting, archiving -- risk management and assessment -",G.processes-and-procedures.process-scope,Scope of processes and procedure is aligned with policies,"The scope of the processes and procedures should be aligned with the policies and statements. Each implementation and use case can have different scope, but the scope should be defined and documented, with all applicable processes, procedures, and eventually instructions. - -The alignment with the policies helps to ensure that the processes and procedures are aligned with the PKI implementation goals and needs, and can be effectively trusted over the time. A simple matrix can be used to ensure that all applicable policies and statements are covered by the processes and procedures. - -The completeness of the processes and procedures can be evaluated by the risk assessment, audit, or by the feedback from the users. -","Assessment -The following is a sample evidence and information that can be collected during the assessment: -- Documented scope of the processes and procedures -- Alignment with the PKI policies and statements -- Interview with the PKI management - -References -- RFC 3647 - Internet X.509 Public Key Infrastructure Certificate Policy and Certification Practices Framework -- ISO/IEC 27001 - Information security management systems" -G.processes-and-procedures,Processes and procedures,"Proper and effective processes and procedures related to PKI operations and management are essential for the successful implementation of the PKI. The processes and procedures should be aligned with the overall organizational policies and statements. - -Process is a set of activities that are performed in a specific order to achieve a specific goal. The process should be documented and measured. The process is also repeatable and can be improved over time, based on the evaluation, feedback, or risk assessment. The scope of the processes is defined by the policies. - -Procedure is a set of instructions that describe how to perform a specific task. The procedure should be also documented and can be used as a reference for the process. Procedure can include specific instructions for the process, such as how to perform a specific task, or how to use a specific tool. - -Processes and procedure typically cover (but are not limited to) the following areas: -- infrastructure management -- data privacy and security -- business continuity, disaster recovery, contingency planning -- supply chain management -- physical security and access control -- incident management -- audit and compliance, evidence and reporting, archiving -- risk management and assessment -",G.processes-and-procedures.process-documentation,Processes and procedures are formally documented and followed,"Identified processes and procedures needs to be properly designed and documented with all relevant information like scope, purpose, inputs, outputs, roles and responsibilities, and other. The processes and procedures should be also reviewed and approved by the management. -Once the processes and procedures are published, appropriate training is required to ensure they are followed by the PKI management and staff. Without following the processes and procedures, the PKI can be exposed to the risks and threats, and eventually lose any established trust. -","Assessment -The following is sample evidence and information that can be collected during the assessment: -- Documented processes and procedures -- Completeness of the processes and procedures documentation -- Evidence of the processes and procedures usage -- Interview with the PKI management and staff -- Training materials covering the processes and procedures - -References -- ISO/IEC 27001 - Information security management systems -- ENISA Publications" -G.processes-and-procedures,Processes and procedures,"Proper and effective processes and procedures related to PKI operations and management are essential for the successful implementation of the PKI. The processes and procedures should be aligned with the overall organizational policies and statements. - -Process is a set of activities that are performed in a specific order to achieve a specific goal. The process should be documented and measured. The process is also repeatable and can be improved over time, based on the evaluation, feedback, or risk assessment. The scope of the processes is defined by the policies. - -Procedure is a set of instructions that describe how to perform a specific task. The procedure should be also documented and can be used as a reference for the process. Procedure can include specific instructions for the process, such as how to perform a specific task, or how to use a specific tool. - -Processes and procedure typically cover (but are not limited to) the following areas: -- infrastructure management -- data privacy and security -- business continuity, disaster recovery, contingency planning -- supply chain management -- physical security and access control -- incident management -- audit and compliance, evidence and reporting, archiving -- risk management and assessment -",G.processes-and-procedures.bau-execution,Recurring activities are executed on time,"Recurring activities are the activities that are performed on a regular basis, such as certificate management operations, backup procedures, security reviews, risk assessment, reviews of logs and security events, and other. - -Each activity should be tracked and have a frequency defined, for example, some activities may be performed daily, weekly, monthly, quarterly, or yearly. The activities should be performed on time, and any delays should be properly tracked and reported. - -Recurring activities needs to be incorporated into the processes and procedures to support the PKI implementation. -","Assessment -The following is sample evidence and information that can be collected during the assessment: -- Documented business as usual activities -- Evidence of the business as usual activities execution -- Business as usual activities tracking and reporting -- Calendar of activities -- Interview with the PKI management and staff - -References -- ISO/IEC 27001 - Information security management systems -- RFC 3647 - Internet X.509 Public Key Infrastructure Certificate Policy and Certification Practices Framework" -G.processes-and-procedures,Processes and procedures,"Proper and effective processes and procedures related to PKI operations and management are essential for the successful implementation of the PKI. The processes and procedures should be aligned with the overall organizational policies and statements. - -Process is a set of activities that are performed in a specific order to achieve a specific goal. The process should be documented and measured. The process is also repeatable and can be improved over time, based on the evaluation, feedback, or risk assessment. The scope of the processes is defined by the policies. - -Procedure is a set of instructions that describe how to perform a specific task. The procedure should be also documented and can be used as a reference for the process. Procedure can include specific instructions for the process, such as how to perform a specific task, or how to use a specific tool. - -Processes and procedure typically cover (but are not limited to) the following areas: -- infrastructure management -- data privacy and security -- business continuity, disaster recovery, contingency planning -- supply chain management -- physical security and access control -- incident management -- audit and compliance, evidence and reporting, archiving -- risk management and assessment -",G.processes-and-procedures.process-evidence,Evidence from procedures is collected and maintained,"Each process, procedure, instruction, or activity would not be effective without evidence confirming that it was performed. The evidence should be descriptive with all relevant information, such as date and time, who performed the activity, what was the result, and other information, if needed. - -The evidence can be collected and maintained in various forms, such as logs, reports, notes, screenshots, etc. The evidence should be collected and maintained for the defined period of time, and should be available for the audit or other purposes. -","Assessment -The following is sample evidence and information that can be collected during the assessment: -- Evidence of the execution of the processes and procedures -- Interview with the PKI management and staff -- Logs, reports, notes, screenshots, and other evidence - -References -- ISO/IEC 27001 - Information security management systems -- RFC 3647 - Internet X.509 Public Key Infrastructure Certificate Policy and Certification Practices Framework -- ENISA Publications" -G.processes-and-procedures,Processes and procedures,"Proper and effective processes and procedures related to PKI operations and management are essential for the successful implementation of the PKI. The processes and procedures should be aligned with the overall organizational policies and statements. - -Process is a set of activities that are performed in a specific order to achieve a specific goal. The process should be documented and measured. The process is also repeatable and can be improved over time, based on the evaluation, feedback, or risk assessment. The scope of the processes is defined by the policies. - -Procedure is a set of instructions that describe how to perform a specific task. The procedure should be also documented and can be used as a reference for the process. Procedure can include specific instructions for the process, such as how to perform a specific task, or how to use a specific tool. - -Processes and procedure typically cover (but are not limited to) the following areas: -- infrastructure management -- data privacy and security -- business continuity, disaster recovery, contingency planning -- supply chain management -- physical security and access control -- incident management -- audit and compliance, evidence and reporting, archiving -- risk management and assessment -",G.processes-and-procedures.process-improvement,Processes and procedures are reviewed and updated,"The processes and procedures should be reviewed and updated on a regular basis, based on the feedback, risk assessment, audit, or other. The review should be performed by the management, and the updates should be approved by the management. - -The review and update of the processes and procedures helps to keep the PKI implementation up to date, and helps to ensure that the processes and procedures are effective and efficient. -","Assessment -The following is sample evidence and information that can be collected during the assessment: -- Documented review and update process -- Evidence of the review and update of the processes and procedures -- Interview with the PKI management and staff - -References -- ISO/IEC 27001 - Information security management systems -- RFC 3647 - Internet X.509 Public Key Infrastructure Certificate Policy and Certification Practices Framework -- ENISA Publications" -G.cryptography,Cryptography,"The organization defines how it governs the selection, approval, documentation, visibility, and evolution of cryptographic algorithms, cryptographic parameters, and cryptographic protocols used within its PKI and related systems. - -The cryptographic policy and strategic direction should be established. It ensures that cryptographic choices are deliberate, consistent, risk-based, and adaptable over time. - -The organization should separate cryptographic governance (what is allowed and why) from cryptographic implementation (how cryptography is used in systems): -- It defines what cryptography is allowed and why -- It does not define how keys or certificates are technically managed -- It provides a single authoritative source for cryptographic rules - -Cryptographic governance may be implemented using policies, standards, profiles, baselines, or other organizational mechanisms, provided the governance outcomes defined in this category are achieved. - -This category does not address the operational lifecycle of cryptographic keys or certificates, which are covered in the Key Management and Certificate Management categories. -",G.cryptography.crypto-terminology,Cryptographic terminology and scope are defined and documented,"Inconsistent or ambiguous terminology leads to misinterpretation of requirements, incorrect implementation, and duplication across teams. Clear terminology ensures that cryptographic policy, key management, certificate management, and change processes are aligned and understood in the same way. - -The organization should define and document consistent terminology for cryptographic concepts, including: -- Cryptographic algorithms -- Cryptographic keys -- Digital certificates -- Cryptographic protocols -- Cryptographic parameters and security levels -- Cryptographic profiles - -Terminology should be used consistently across policies, standards, and procedures. -","Assessment -- Documented cryptographic definitions exist. -- Terminology is consistently used across PKI documentation. -- Stakeholders demonstrate a shared understanding of terms. - -References -- NIST SP 800-57 Part 1 Rev. 5 - Recommendation for Key Management -- PCI Cryptography Guidance -- CycloneDX - Cryptography Registry" -G.cryptography,Cryptography,"The organization defines how it governs the selection, approval, documentation, visibility, and evolution of cryptographic algorithms, cryptographic parameters, and cryptographic protocols used within its PKI and related systems. - -The cryptographic policy and strategic direction should be established. It ensures that cryptographic choices are deliberate, consistent, risk-based, and adaptable over time. - -The organization should separate cryptographic governance (what is allowed and why) from cryptographic implementation (how cryptography is used in systems): -- It defines what cryptography is allowed and why -- It does not define how keys or certificates are technically managed -- It provides a single authoritative source for cryptographic rules - -Cryptographic governance may be implemented using policies, standards, profiles, baselines, or other organizational mechanisms, provided the governance outcomes defined in this category are achieved. - -This category does not address the operational lifecycle of cryptographic keys or certificates, which are covered in the Key Management and Certificate Management categories. -",G.cryptography.crypto-algorithms,Cryptographic algorithms and parameters are documented and approved,"Without explicit approval rules, cryptographic algorithms are often selected based on defaults, legacy compatibility, or convenience. Documented approvals ensure consistent security levels, reduce technical debt, and enable controlled cryptographic evolution. - -The organization should document: -- Approved cryptographic algorithms -- Approved cryptographic parameters (e.g., key sizes, curves) -- Restricted, deprecated, or prohibited algorithms - -Each decision should include rationale and applicability. -","Assessment -- Approved and prohibited algorithms are documented. -- Parameter requirements are clearly defined. -- Documentation is reviewed periodically. - -References -- NIST SP 800-131A Rev. 2 - Transitioning the Use of Cryptographic Algorithms and Key Lengths" -G.cryptography,Cryptography,"The organization defines how it governs the selection, approval, documentation, visibility, and evolution of cryptographic algorithms, cryptographic parameters, and cryptographic protocols used within its PKI and related systems. - -The cryptographic policy and strategic direction should be established. It ensures that cryptographic choices are deliberate, consistent, risk-based, and adaptable over time. - -The organization should separate cryptographic governance (what is allowed and why) from cryptographic implementation (how cryptography is used in systems): -- It defines what cryptography is allowed and why -- It does not define how keys or certificates are technically managed -- It provides a single authoritative source for cryptographic rules - -Cryptographic governance may be implemented using policies, standards, profiles, baselines, or other organizational mechanisms, provided the governance outcomes defined in this category are achieved. - -This category does not address the operational lifecycle of cryptographic keys or certificates, which are covered in the Key Management and Certificate Management categories. -",G.cryptography.crypto-protocols,Cryptographic protocols and versions are documented and approved,"Protocols define how cryptography is actually used in communication. Even strong algorithms can be undermined by weak or outdated protocol versions. Clear protocol governance prevents insecure defaults and uncontrolled legacy usage. - -The organization should define which cryptographic protocols and protocol versions are approved, restricted, deprecated, or prohibited. -","Assessment -- Protocol and version rules are documented. -- Deprecated or prohibited protocols are identified. -- Exceptions are formally approved. - -References -- NIST SP 800-52 Rev. 2 - Guidelines for the Selection, Configuration, and Use of Transport Layer Security (TLS) Implementations -- OWASP Transport Layer Security Cheat Sheet" -G.cryptography,Cryptography,"The organization defines how it governs the selection, approval, documentation, visibility, and evolution of cryptographic algorithms, cryptographic parameters, and cryptographic protocols used within its PKI and related systems. - -The cryptographic policy and strategic direction should be established. It ensures that cryptographic choices are deliberate, consistent, risk-based, and adaptable over time. - -The organization should separate cryptographic governance (what is allowed and why) from cryptographic implementation (how cryptography is used in systems): -- It defines what cryptography is allowed and why -- It does not define how keys or certificates are technically managed -- It provides a single authoritative source for cryptographic rules - -Cryptographic governance may be implemented using policies, standards, profiles, baselines, or other organizational mechanisms, provided the governance outcomes defined in this category are achieved. - -This category does not address the operational lifecycle of cryptographic keys or certificates, which are covered in the Key Management and Certificate Management categories. -",G.cryptography.crypto-visibility,Visibility into cryptographic usage is established and maintained,"Cryptographic risk cannot be managed if cryptographic usage is unknown. Visibility is essential for impact analysis, deprecation planning, incident response, and cryptographic agility. - -The organization should maintain visibility into where cryptography is used, including algorithms, keys, certificates, and protocols. -","Assessment -- Cryptographic usage information exists for critical systems. -- Visibility supports risk and transition planning. -- Gaps are identified and addressed. - -References -- NIST Cybersecurity Framework - Identify Function -- EUCC Guidelines on Cryptography Inventory -- CycloneDX Cryptography Bill of Materials (CBOM)" -G.cryptography,Cryptography,"The organization defines how it governs the selection, approval, documentation, visibility, and evolution of cryptographic algorithms, cryptographic parameters, and cryptographic protocols used within its PKI and related systems. - -The cryptographic policy and strategic direction should be established. It ensures that cryptographic choices are deliberate, consistent, risk-based, and adaptable over time. - -The organization should separate cryptographic governance (what is allowed and why) from cryptographic implementation (how cryptography is used in systems): -- It defines what cryptography is allowed and why -- It does not define how keys or certificates are technically managed -- It provides a single authoritative source for cryptographic rules - -Cryptographic governance may be implemented using policies, standards, profiles, baselines, or other organizational mechanisms, provided the governance outcomes defined in this category are achieved. - -This category does not address the operational lifecycle of cryptographic keys or certificates, which are covered in the Key Management and Certificate Management categories. -",G.cryptography.crypto-lifecycle,Cryptographic lifecycle and deprecation rules are defined,"Cryptography degrades over time due to advances in computing and cryptanalysis. Explicit lifecycle rules prevent reactive, crisis-driven migrations and support predictable, risk-based transitions. - -The organization should define rules for: -- Approving new cryptography -- Setting expected validity periods -- Deprecating cryptography -- Identifying replacement options -","Assessment -- Lifecycle and deprecation rules are documented. -- Deprecation decisions follow defined criteria. -- Replacement planning is evident. - -References -- NIST SP 800-131A Rev. 2 - Transitioning the Use of Cryptographic Algorithms and Key Lengths -- NIST SP 800-57 Part 1 Rev. 5 - Recommendation for Key Management" -G.cryptography,Cryptography,"The organization defines how it governs the selection, approval, documentation, visibility, and evolution of cryptographic algorithms, cryptographic parameters, and cryptographic protocols used within its PKI and related systems. - -The cryptographic policy and strategic direction should be established. It ensures that cryptographic choices are deliberate, consistent, risk-based, and adaptable over time. - -The organization should separate cryptographic governance (what is allowed and why) from cryptographic implementation (how cryptography is used in systems): -- It defines what cryptography is allowed and why -- It does not define how keys or certificates are technically managed -- It provides a single authoritative source for cryptographic rules - -Cryptographic governance may be implemented using policies, standards, profiles, baselines, or other organizational mechanisms, provided the governance outcomes defined in this category are achieved. - -This category does not address the operational lifecycle of cryptographic keys or certificates, which are covered in the Key Management and Certificate Management categories. -",G.cryptography.crypto-agility,Cryptographic agility is defined and governed,"Cryptographic change is inevitable. Organizations that define and govern cryptographic agility can respond to algorithm compromise, deprecation, and emerging requirements in a controlled and timely manner. - -The organization should define governance and planning for responding to cryptographic change drivers such as: -- algorithm compromise -- algorithm deprecation -- regulatory change -- emerging cryptographic requirements -","Assessment -- Governance for cryptographic transitions is documented. -- Transition planning aligns with organizational change management. -- Preparedness for cryptographic transitions can be demonstrated. - -References -- NIST CSWP 39 - Considerations for Achieving Cryptographic Agility: Strategies and Practices" -M.key-management,Key management,"Key management is the set of techniques and procedures supporting the establishment and maintenance of keying relationships between parties and components in the public key infrastructure. Key management encompasses techniques and procedures supporting: -- Initialization of system users and components; -- Generation, distribution, and installation of keying material; -- Controlling the use of keying material; -- Update, revocation, and destruction of keying material; and -- Storage, backup/recovery, and archival of keying material. - -The key management is important for the PKI to maintain trust. It should be an integral part of the PKI procedures. Proper key management is one of the basic stones on which the PKI stands and relies on. -",M.key-management.key-mgmt-roles,Key management roles and responsibilities are documented and formally assigned,"Proper definition of roles and responsibilities for key management operations establishes a good basis for accountability and auditing. The roles and responsibilities should follow key management policy, principles, and boundaries. - -Personnel should be formally assigned to the role based on appropriate skills, and background check to ensure that there are no external risks associated that can cause potential compromise of key management. - -Naming or assignment records should contain relevant information such as: -- Identification of personnel -- Role to be assigned -- Date of appointment -- Confirmation of required skills -- Acknowledgment of responsibilities -","Assessment -- Documented roles and responsibilities -- Signed naming protocol of personnel to role(s) -- Roles and responsibilities matrix (that may be used to cross-check if there are any conflicting roles) -- Validation of required knowledge and skills -- Review according to the key management policy - -References -- ISO/IEC 27001 and related standards" -M.key-management,Key management,"Key management is the set of techniques and procedures supporting the establishment and maintenance of keying relationships between parties and components in the public key infrastructure. Key management encompasses techniques and procedures supporting: -- Initialization of system users and components; -- Generation, distribution, and installation of keying material; -- Controlling the use of keying material; -- Update, revocation, and destruction of keying material; and -- Storage, backup/recovery, and archival of keying material. - -The key management is important for the PKI to maintain trust. It should be an integral part of the PKI procedures. Proper key management is one of the basic stones on which the PKI stands and relies on. -",M.key-management.key-inventory,Inventory of cryptographic keys is documented and maintained,"Inventory of cryptographic keys is important and a strategic database for organizations to: -- Monitor cryptographic key status and compliance -- Quickly react to changes and incidents (deprecation of algorithms, compromise, new attacks and vulnerabilities) -- Understand impact of lifecycle changes, migration and use of keys - -Although the cryptographic key inventory may be implemented and maintained using various tools and approaches, it should serve the purpose of having a consistent and accurate map of all cryptographic keys deployed in the organization with details like algorithm, key length, usage, storage, location, generation and distribution method, backup and recovery, key check value, fingerprint, number of share or components, owner or responsible person, uniqueness, crypto-periods, or any other applicable attributes and properties of the key. - -Inventory should follow procedures and business as usual activities to keep it accurate and updated in time. -","Assessment -- Documented inventory of cryptographic keys -- Accuracy and consistency -- Completeness of inventory -- Validation of cryptographic key records - -References -- NIST SP 800-57 Part 1 Rev. 5 - Recommendation for Key Management -- ISO/IEC 11770 Key Management" -M.key-management,Key management,"Key management is the set of techniques and procedures supporting the establishment and maintenance of keying relationships between parties and components in the public key infrastructure. Key management encompasses techniques and procedures supporting: -- Initialization of system users and components; -- Generation, distribution, and installation of keying material; -- Controlling the use of keying material; -- Update, revocation, and destruction of keying material; and -- Storage, backup/recovery, and archival of keying material. - -The key management is important for the PKI to maintain trust. It should be an integral part of the PKI procedures. Proper key management is one of the basic stones on which the PKI stands and relies on. -",M.key-management.device-inventory,Inventory of cryptographic devices is documented and maintained,"Sensitive cryptographic keys are protected by hardware security modules that can have various forms and comply with security standards such as FIPS 140-3 or Common Criteria Protection Profiles. The keys may be in some case software-protected when there is no high risk associated with its compromise. - -The approved ways of protecting cryptographic keys should have defined rules, which can be specified by the key management policy and followed using the key management procedures. Cryptographic devices that protect keys may be quickly identified using the inventory of cryptographic keys with reference to an inventory of cryptographic devices. - -The inventory of cryptographic devices should contain relevant information such as: -- Vendor and device model identification -- Serial numbers -- Hardware / firmware / software versions -- Security certification and expiration dates -- Locations -","Assessment -- Documented requirements for cryptographic devices -- Documented inventory of cryptographic devices -- Completeness, accuracy, and consistency of inventory -- Validation of records - -References -- NIST SP 800-57 Part 1 Rev. 5 - Recommendation for Key Management -- ISO/IEC 11770 Key Management" -M.key-management,Key management,"Key management is the set of techniques and procedures supporting the establishment and maintenance of keying relationships between parties and components in the public key infrastructure. Key management encompasses techniques and procedures supporting: -- Initialization of system users and components; -- Generation, distribution, and installation of keying material; -- Controlling the use of keying material; -- Update, revocation, and destruction of keying material; and -- Storage, backup/recovery, and archival of keying material. - -The key management is important for the PKI to maintain trust. It should be an integral part of the PKI procedures. Proper key management is one of the basic stones on which the PKI stands and relies on. -",M.key-management.key-lifecycle,Each cryptographic key is defined and has documented lifecycle procedures,"Each cryptographic key type that is defined and used for specific use-case should have a complete description of its lifecycle. Each lifecycle phase has a proper description of the process and is backed up with the procedure that is executed when needed. - -The key can have various lifecycle phases, such as generation, registration, initialization, distribution, loading, storage, archiving, backup, recovery, revocation, removal, destruction, or others applicable for the key. - -The lifecycle phases contains appropriate description of the procedure such as: -- Prerequisites for execution -- Required roles and permissions -- Procedure and records -","Assessment -- Examine the definition of cryptographic key -- Documented key lifecycle phases -- Documented procedures and related records for the key lifecycle -- Lifecycle is integrated and followed in the organization - -References -- NIST SP 800-57 Part 1 Rev. 5 - Recommendation for Key Management -- ISO/IEC 11770 Key Management" -M.key-management,Key management,"Key management is the set of techniques and procedures supporting the establishment and maintenance of keying relationships between parties and components in the public key infrastructure. Key management encompasses techniques and procedures supporting: -- Initialization of system users and components; -- Generation, distribution, and installation of keying material; -- Controlling the use of keying material; -- Update, revocation, and destruction of keying material; and -- Storage, backup/recovery, and archival of keying material. - -The key management is important for the PKI to maintain trust. It should be an integral part of the PKI procedures. Proper key management is one of the basic stones on which the PKI stands and relies on. -",M.key-management.key-mgmt-review,Key management is periodically reviewed and updated,"Key management policy, processes and procedures related to cryptographic keys, inventory and lifecycle should be periodically reviewed, updated and approved. The frequency of review should be based on the organizational risks and needs to be protected against current and future trends. - -Periodical review helps to keep the key management accurate and helps to maintain required skills and knowledge. -It provides assurance that the expected controls are active and working as intended. -","Assessment -- Risk management and review frequency -- Implementation of review process -- Validation of documentation and reviews - -References -- ISO/IEC 27001 and related standards" -M.certificate-management,Certificate management,"Certificate management is the set of techniques and procedures supporting certificate lifecycle management. Certificate management encompasses techniques and procedures supporting: -- Definition of certificate profiles -- Generation of certificates -- Installation and orchestration of certificates -- Inventory of certificates -- State management of certificates, i.e. expiration and revocation -- Discovery of certificates - -The techniques can be applied to an organization that makes use of PKI, or from an organization (or part of an organization) that operates a PKI for others. This category primarily targets an organization from a usage perspective, albeit the certificate lifecycle management is equally important for an organization that operates a PKI for someone else. -",M.certificate-management.cert-profiles,Certificate profiles are documented,"Certificate profiles specify the contents of certificates for one or more use cases. It defines things such as: -- Certificate use case(s) for certificates covered by specific profiles -- Naming standards for subject distinguished name and subject alternative names, which are allowed and mandatory fields. -- Certificate validity periods -- Certificate extensions, mandatory and allowed extensions, their criticality and possible values -- Allowed key types and signature algorithms -- Revocation profiles, i.e. CRL and/or OCSP -","Assessment -- Documented scope of applicability -- Documented and approved certificate profiles -- Content of the profiles is complete and unambiguous -- Certificate profiles are implemented in certificattion authority -- Certificate profiles are enforced by certification authority -- Certificate profiles are compatible with RFC5280, or deviations are well documented -- Profiles for CRLs and/or OCSP usage, i.e. validity periods, issuance intervals, max revocation time delay, etc - -References -- RFC 5280 - Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile -- CA/B Forum baseline requirements -- ETSI Qualified Certificate Profiles -- ETSI EN 319 411-1 - Policy and security requirements for Trust Service Providers issuing certificates -- ETSI 319-411-2 -- 3GPP 33.310 - Network Domain Security (NDS); Authentication Framework (AF) -- UNISIG SUBSET-137" -M.certificate-management,Certificate management,"Certificate management is the set of techniques and procedures supporting certificate lifecycle management. Certificate management encompasses techniques and procedures supporting: -- Definition of certificate profiles -- Generation of certificates -- Installation and orchestration of certificates -- Inventory of certificates -- State management of certificates, i.e. expiration and revocation -- Discovery of certificates - -The techniques can be applied to an organization that makes use of PKI, or from an organization (or part of an organization) that operates a PKI for others. This category primarily targets an organization from a usage perspective, albeit the certificate lifecycle management is equally important for an organization that operates a PKI for someone else. -",M.certificate-management.cert-lifecycle,Certificate lifecycle management is documented,"Issuance of certificates follow specific procedures, be it manual processes or automated processes using standard or non-standard PKI protocol. An organization should be clear about the full life cycle management of certificates: -1. Certificate Application and the validation procedures used, by RAs and CAs -2. Certificate Issuance and protocols used for enrollment, on-line and off-line -3. Certificate Renewal, Re-key and Modification, upon expiration or other causes - - Process of monitoring certificates for expiration and timely renewal processes prevent common issues -4. Certificate Revocation - - When certificates need to be revoked it is important to have a well-defined certificate revocation process: - - How subjects can request a certificate be revoked - - How to report misuse of certificates - - Expected time for revocation to be completed after a revocation request -5. Certificate status dissemination - - How revocation information is disseminated to relying parties -6. Key escrow and recovery -7. Trust anchor management - - Trust anchors on machines and devices are a key point of trust management in the organization. Unmanaged trust stores can cause both outages and security issues. -","Assessment -- Documented application and validation rules -- Documented process for issuing certificates - - configuration of protocols -- Documented Certificate Acceptance and certificate subject installation procedures -- Documented renewal criteria, where re-key is nessecary and which certificate modifications are allowed - - Documented criticality of expiration for different use cases - - Automated monitoring and alerting of expiration for critical systems - - Automated certificate renewal -- Documented revocation process - - Documented revocation procedures, both for subjects and administrators - - If suspension is used the process to lift (or remove) suspension - - Documented contact points for reports in the organizations or from relying parties - - List of relying parties that depend on updated revocation information -- Documented Certificate status service - - OCSP and/or CRLs - - Documentation how relying parties get access to revocation information -- Documented process for key escrow and recovery when encryption keys need to be stored centrally -- Documented trust anchor management - - Distribution of new and updated trust anchors (Root CA certificates) - -References -- RFC 4210 - Internet X.509 Public Key Infrastructure Certificate Management Protocol (CMP) -- CA/B Forum baseline requirements -- 3GPP 33.310 - Network Domain Security (NDS); Authentication Framework (AF) -- UNISIG SUBSET-137" -M.certificate-management,Certificate management,"Certificate management is the set of techniques and procedures supporting certificate lifecycle management. Certificate management encompasses techniques and procedures supporting: -- Definition of certificate profiles -- Generation of certificates -- Installation and orchestration of certificates -- Inventory of certificates -- State management of certificates, i.e. expiration and revocation -- Discovery of certificates - -The techniques can be applied to an organization that makes use of PKI, or from an organization (or part of an organization) that operates a PKI for others. This category primarily targets an organization from a usage perspective, albeit the certificate lifecycle management is equally important for an organization that operates a PKI for someone else. -",M.certificate-management.cert-inventory,Inventory of issued certificates is documented,"Certificate inventory consists of all known certificates and provides an overview of known certificates in the organization. Certificates in inventory are subject to certificate lifecycle management. The certificate inventory is important for the organization because: -- It provides immediate access to the current status of certificates -- Provides possibility to react on certificate-related events (compromise, change, expiration, etc.) -- Understand impact of lifecycle changes -- It gives information on all locations of certificates -- Can enforce and maintain ownership of certificates - -The certificate inventory therefore consists of information related to certificate like certificate attributes, validity and validation information, fingerprint and serial number, trust chain, owner, public key, signature algorithm, certificate type, compliance information, certificate locations, change history, or any other attributes and properties of the certificates that is required. -","Assessment -- Documented inventory - - How inventory is maintained across the organization -- Documented certificate inventory management -- Validation of certificate inventory records -- Effectiveness of the certificate inventory implementation - -References -- RFC 3647 - Internet X.509 Public Key Infrastructure Certificate Policy and Certification Practices Framework -- NIST SP 800-57 Part 1 Rev. 5 - Recommendation for Key Management" -M.certificate-management,Certificate management,"Certificate management is the set of techniques and procedures supporting certificate lifecycle management. Certificate management encompasses techniques and procedures supporting: -- Definition of certificate profiles -- Generation of certificates -- Installation and orchestration of certificates -- Inventory of certificates -- State management of certificates, i.e. expiration and revocation -- Discovery of certificates - -The techniques can be applied to an organization that makes use of PKI, or from an organization (or part of an organization) that operates a PKI for others. This category primarily targets an organization from a usage perspective, albeit the certificate lifecycle management is equally important for an organization that operates a PKI for someone else. -",M.certificate-management.cert-discovery,Certificate discovery process is documented,"Certificate discovery process protects an organization from unknown certificates that may be deployed in the infrastructure. Unknown certificates may be further issued by unauthorized certification authorities and mislead users of services. Certificate discovery helps to maintain current inventory of certificates, but does not depend on the inventory and is not nessecary to maintain an inventory. Certificate discovery process should be implemented based on supported certificates and use-cases, for example: -- To scan the network for certificates used on known protocols and ports to discover certificates that can potentially cause service outage or breach -- Search for the certificates on file system to discover unauthorized or unsecured certificates - -Discovery process should be run frequently on the specified locations and the certificate inventory should be updated based on the results of the certificate discovery to keep it current. -","Assessment -- Documented certificate discovery requirements -- Documented certificate discovery process and frequency -- The supporting tools for the certificate discovery -- Certificate inventory is updated with discovered certificates - -References -" -M.certificate-management,Certificate management,"Certificate management is the set of techniques and procedures supporting certificate lifecycle management. Certificate management encompasses techniques and procedures supporting: -- Definition of certificate profiles -- Generation of certificates -- Installation and orchestration of certificates -- Inventory of certificates -- State management of certificates, i.e. expiration and revocation -- Discovery of certificates - -The techniques can be applied to an organization that makes use of PKI, or from an organization (or part of an organization) that operates a PKI for others. This category primarily targets an organization from a usage perspective, albeit the certificate lifecycle management is equally important for an organization that operates a PKI for someone else. -",M.certificate-management.cert-mgmt-review,Certificate management is periodically reviewed and updated,"No certificate issuance and management system works over long periods of time without changes to use-cases, processes, protocols and algorithms. It is important that the certificate management is periodically reviewed and updated to avoid gaps. The frequency of review should be based on the organizational risks and needs to be protected against current and future trends. - -Periodical review helps to keep the certificate management accurate and helps to maintain required skills and knowledge. -It provides assurance that the expected controls are active and working as intended. -","Assessment -- Documented process for reviewing the certificate management process and systems -- Ability to implement updates to certificate management system -- Document management system and validation of review - -References -- ISO/IEC 27001 and related standards" -M.certificate-management,Certificate management,"Certificate management is the set of techniques and procedures supporting certificate lifecycle management. Certificate management encompasses techniques and procedures supporting: -- Definition of certificate profiles -- Generation of certificates -- Installation and orchestration of certificates -- Inventory of certificates -- State management of certificates, i.e. expiration and revocation -- Discovery of certificates - -The techniques can be applied to an organization that makes use of PKI, or from an organization (or part of an organization) that operates a PKI for others. This category primarily targets an organization from a usage perspective, albeit the certificate lifecycle management is equally important for an organization that operates a PKI for someone else. -",M.certificate-management.pki-governance,Organizational PKI governance,"Large organizations commonly have several PKI systems spread out in the organization. Some can be consolidated, but in many cases different PKI silos exists for good reasons. Having a central governance of PKIs across the organization will help to maintain best practices, ensure secure PKI operations, re-use PKI knowledge in the organization, ensure consistent profiles and avoid unnecessary duplication of effort. -","Assessment -- Documented PKIs used in the organization - - Different PKI technologies used - - Installed PKI instances -- Documented PKI best practices - - Installation procedures to avoid re-learning the same issues in different parts of the organization - - Configuration to ensure consistent and interoperable certificates where applicable - - Security to maintain a security base line across the whole organization - -References -" -M.infrastructure-management,Infrastructure management,"The PKI implementation is a combination of software, hardware, network service, and resources that are needed to operate and manage the environment. -The environment can be hosted on-premise, in the cloud, or in a hybrid environment. - -Independent of the hosting model, the PKI environment needs to be properly managed and maintained, which requires resources and processes. -The infrastructure management refers to management of the technical and operational components of the PKI environment, which includes software, hardware, network, equipment, facilities, and other related resources. - -The PKI components may be distributed across multiple locations and managed by different teams. Therefore, it is important to have a clear description of the operational infrastructure with all dependencies and prerequisites. The infrastructure management should be aligned with the overall strategy of the organization and the scope of the PKI. - -When the infrastructure and environment where the PKI is implemented are not effectively managed and maintained, the complexity of the environment increases and the risk of failure increases as well. The infrastructure is often one of the key targets for attackers, therefore it is important to ensure that it is properly secured and available. -",M.infrastructure-management.infra-documentation,Network and deployment infrastructure is documented,"The network and deployment documentation of the infrastructure should be aligned with the architecture and design of the PKI. In other terms, it provides details about how the implementation is done in the real environment. - -The network and deployment infrastructure should be properly documented and maintained. The documentation should include the following: -- PKI components and their dependencies -- Facilities and equipment -- Deployment infrastructure description -- Clustering and load balancing -- Network topology and diagram -- Communication and open ports requirements -- Supporting cloud providers and services -- Supporting systems and services (identity management, access control, logging, monitoring, etc.) -","Assessment -The following is sample evidence that can be used to assess the requirement: -- Network topology and diagram -- Deployment documentation -- Sample configuration of network to compare with the documentation -- Integration with supporting and other systems -- Interview with the network administrators - -References -- ISO/IEC 20000 and related standards -- ISO/IEC 27001 - Information security management systems -- Guidance for Containers and Container Orchestration Tools" -M.infrastructure-management,Infrastructure management,"The PKI implementation is a combination of software, hardware, network service, and resources that are needed to operate and manage the environment. -The environment can be hosted on-premise, in the cloud, or in a hybrid environment. - -Independent of the hosting model, the PKI environment needs to be properly managed and maintained, which requires resources and processes. -The infrastructure management refers to management of the technical and operational components of the PKI environment, which includes software, hardware, network, equipment, facilities, and other related resources. - -The PKI components may be distributed across multiple locations and managed by different teams. Therefore, it is important to have a clear description of the operational infrastructure with all dependencies and prerequisites. The infrastructure management should be aligned with the overall strategy of the organization and the scope of the PKI. - -When the infrastructure and environment where the PKI is implemented are not effectively managed and maintained, the complexity of the environment increases and the risk of failure increases as well. The infrastructure is often one of the key targets for attackers, therefore it is important to ensure that it is properly secured and available. -",M.infrastructure-management.network-segmentation,Separation and segmentation principles are applied,"The PKI environment should be properly separated and segmented from other environments and systems. The separation and segmentation should be applied on all levels, including network, infrastructure, and application. The separation and segmentation should be applied based on the security requirements and risk assessment. -Segmentation isolates the PKI environment from the remaining environment and reduces the risk of unauthorized access and data leakage. It also helps to reduce the impact of a potential compromise of the PKI environment from other systems and environments. Segmentation can be achieved using a number of physical or logical methods, such as: -- Properly configured internal network security controls -- Routers with strong access control lists -- Other technologies that restrict access to a particular segment of a network -For the proper maintenance of the infrastructure and deployed PKI components, the staging/testing environment should be available in the same configuration as the production environment. If needed, development environments can be used for testing and development purposes. -Production, staging, and development environments should be logically separated and isolated from each other, including the data that is used in the environments. -","Assessment -The following is sample evidence that can be used to assess the requirement: -- Network topology and diagram -- Implementation of network isolation -- Separation of production and testing environments -- Sample data -- Interview with the network administrators - -References -- ISO/IEC 20000 and related standards -- ISO/IEC 27001 - Information security management systems" -M.infrastructure-management,Infrastructure management,"The PKI implementation is a combination of software, hardware, network service, and resources that are needed to operate and manage the environment. -The environment can be hosted on-premise, in the cloud, or in a hybrid environment. - -Independent of the hosting model, the PKI environment needs to be properly managed and maintained, which requires resources and processes. -The infrastructure management refers to management of the technical and operational components of the PKI environment, which includes software, hardware, network, equipment, facilities, and other related resources. - -The PKI components may be distributed across multiple locations and managed by different teams. Therefore, it is important to have a clear description of the operational infrastructure with all dependencies and prerequisites. The infrastructure management should be aligned with the overall strategy of the organization and the scope of the PKI. - -When the infrastructure and environment where the PKI is implemented are not effectively managed and maintained, the complexity of the environment increases and the risk of failure increases as well. The infrastructure is often one of the key targets for attackers, therefore it is important to ensure that it is properly secured and available. -",M.infrastructure-management.vulnerability-management,Network vulnerability management is implemented and maintained,"The network vulnerability management is a process that is used to identify, classify, remediate, and mitigate vulnerabilities in the network infrastructure and protects PKI implementation from potential attacks. The process should be implemented and maintained in order to ensure that the network infrastructure is properly secured and protected from potential attacks. - -The network vulnerability management should include the following: -- Included in the overall vulnerability management process -- Periodical scanning of the network infrastructure -- Identification of vulnerabilities -- Categorization and prioritization of vulnerabilities and remediation -- Updating and patching requirements -","Assessment -The following is sample evidence that can be used to assess the requirement: -- Network vulnerability management process -- Results from last network vulnerability scan -- Remediation plan -- Interview with the network administrators - -References -- Common Vulnerability Scoring System (CVSS) -- ISO/IEC 20000 and related standards -- ISO/IEC 27001 - Information security management systems" -M.infrastructure-management,Infrastructure management,"The PKI implementation is a combination of software, hardware, network service, and resources that are needed to operate and manage the environment. -The environment can be hosted on-premise, in the cloud, or in a hybrid environment. - -Independent of the hosting model, the PKI environment needs to be properly managed and maintained, which requires resources and processes. -The infrastructure management refers to management of the technical and operational components of the PKI environment, which includes software, hardware, network, equipment, facilities, and other related resources. - -The PKI components may be distributed across multiple locations and managed by different teams. Therefore, it is important to have a clear description of the operational infrastructure with all dependencies and prerequisites. The infrastructure management should be aligned with the overall strategy of the organization and the scope of the PKI. - -When the infrastructure and environment where the PKI is implemented are not effectively managed and maintained, the complexity of the environment increases and the risk of failure increases as well. The infrastructure is often one of the key targets for attackers, therefore it is important to ensure that it is properly secured and available. -",M.infrastructure-management.recovery-objectives,Infrastructure recovery objectives controls,"In case of issues with the infrastructure, it should be possible to quickly identify the root cause and recover the infrastructure to the operational state. The recovery objectives should be defined and aligned with the overall business continuity and disaster recovery strategy of the organization. - -The infrastructure should be frequently backed up and the backups should be stored in a secure location. The backups should be tested and validated on a regular basis. Infrastructure managed as code may help to reduce complexity and increase the speed of recovery. -","Assessment -The following is sample evidence that can be used to assess the requirement: -- Infrastructure recovery objectives -- Backup and recovery plan -- Infrastructure configuration as a code -- Interview with the infrastructure administrators - -References -- ISO/IEC 20000 and related standards -- ISO/IEC 27001 - Information security management systems" -M.infrastructure-management,Infrastructure management,"The PKI implementation is a combination of software, hardware, network service, and resources that are needed to operate and manage the environment. -The environment can be hosted on-premise, in the cloud, or in a hybrid environment. - -Independent of the hosting model, the PKI environment needs to be properly managed and maintained, which requires resources and processes. -The infrastructure management refers to management of the technical and operational components of the PKI environment, which includes software, hardware, network, equipment, facilities, and other related resources. - -The PKI components may be distributed across multiple locations and managed by different teams. Therefore, it is important to have a clear description of the operational infrastructure with all dependencies and prerequisites. The infrastructure management should be aligned with the overall strategy of the organization and the scope of the PKI. - -When the infrastructure and environment where the PKI is implemented are not effectively managed and maintained, the complexity of the environment increases and the risk of failure increases as well. The infrastructure is often one of the key targets for attackers, therefore it is important to ensure that it is properly secured and available. -",M.infrastructure-management.infra-review,Infrastructure activities are periodically reviewed,"Infrastructure management related activities should be periodically reviewed, updated and approved. The frequency of review should be based on the organizational risks and needs to be protected against current and future trends. - -Periodical review helps to keep the infrastructure management accurate and helps to maintain required skills and knowledge. -It provides assurance that the expected controls are active and working as intended. - -The review can include the following: -- Changes made to the infrastructure -- Regular checks of firewall rules -- Review of the network topology -- Review of the network segmentation -- Regular checks of access control lists -- Vulnerability reports and timely remediation -- Review and correlation of logs -- And other activities related to the infrastructure management -","Assessment -The following is sample evidence that can be used to assess the requirement: -- Infrastructure management activities review frequency -- Organizational implementation of review process -- Validation of documentation, reports, records, and reviews - -References -- ISO/IEC 20000 and related standards -- ISO/IEC 27001 - Information security management systems" -M.change-management-and-agility,Change management and agility,"Change management and agility is important to control the PKI implementation and configuration changes, adjustments, modifications, and improvements. Technologies are changing fast and the PKI needs to be able to adapt to the changes. - The same applies for security vulnerabilities, deprecation of algorithms, and other changes that can significantly affect the PKI. - -The change management should provide a robust and reliable process to ensure that every change is properly assessed, approved, and implemented. The process should be aligned with the organizational change management process and should be followed by all stakeholders. - -Agility means that the PKI is able to adapt to the changes quickly and efficiently. Agility is applied to technologies, processes, algorithms, and other parts of the PKI implementation. Efficient adaptation to the changes makes the PKI more reliable and trustworthy, reducing operational risks. -",M.change-management-and-agility.change-policy,The policy for change management and agility is documented,"The policy for change management and agility should be documented and approved by the management. The policy contains principles and boundaries for the implementation of the change management and agility requirements. Typically, it can be documented on the organizational level and applied to all systems and services, including the PKI implementation. - -The PKI may have specific requirements for change management and agility, and therefore it may be recommended to have a separate policy for the PKI implementation. The policy should be aligned with organizational policy and should be approved by the responsible personnel for the PKI. - -The policy contains the following information: -- Approach to change management and agility -- Principles and boundaries for change management and agility -- Roles and responsibilities -- Requirements for change management and agility -- Tools and technologies used for change management -- And other relevant information -","Assessment -The following is sample evidence that can be used to assess the requirement: -- Documented policy for change management and agility -- Alignment with organizational policy -- Approval by the management -- Understanding of the policy by the PKI personnel -- And other relevant evidence - -References -- COBIT (Control Objectives for Information and Related Technologies) -- ISO/IEC 20000 and related standards -- The Information Technology Infrastructure Library (ITIL)" -M.change-management-and-agility,Change management and agility,"Change management and agility is important to control the PKI implementation and configuration changes, adjustments, modifications, and improvements. Technologies are changing fast and the PKI needs to be able to adapt to the changes. - The same applies for security vulnerabilities, deprecation of algorithms, and other changes that can significantly affect the PKI. - -The change management should provide a robust and reliable process to ensure that every change is properly assessed, approved, and implemented. The process should be aligned with the organizational change management process and should be followed by all stakeholders. - -Agility means that the PKI is able to adapt to the changes quickly and efficiently. Agility is applied to technologies, processes, algorithms, and other parts of the PKI implementation. Efficient adaptation to the changes makes the PKI more reliable and trustworthy, reducing operational risks. -",M.change-management-and-agility.change-request,Request for change structure is documented and followed,"The request for change structure is the basic stone of each change management process. It provides information about a change, its scope, and other relevant data. The request for change structure should be formally documented and followed by all stakeholders involved. - -Request for change can contain any change that can affect the PKI implementation, including: -- PKI upgrades, updates, and patches -- New components or functionalities -- Changes in the configuration of the PKI -- Changes in the algorithms and protocols - -Request for change structure should cover the following information: -- Description of the change -- Scope of the change -- Category of the change -- Impacted systems and services -- Back-out procedure in case of failure -- Testing requirements -- And other relevant information -","Assessment -The following is sample evidence that can be used to assess the requirement: -- Documented request for change structure -- Sample of change request -- Review implemented changes and compare with the request for change - -References -- COBIT (Control Objectives for Information and Related Technologies) -- ISO/IEC 20000 and related standards -- The Information Technology Infrastructure Library (ITIL)" -M.change-management-and-agility,Change management and agility,"Change management and agility is important to control the PKI implementation and configuration changes, adjustments, modifications, and improvements. Technologies are changing fast and the PKI needs to be able to adapt to the changes. - The same applies for security vulnerabilities, deprecation of algorithms, and other changes that can significantly affect the PKI. - -The change management should provide a robust and reliable process to ensure that every change is properly assessed, approved, and implemented. The process should be aligned with the organizational change management process and should be followed by all stakeholders. - -Agility means that the PKI is able to adapt to the changes quickly and efficiently. Agility is applied to technologies, processes, algorithms, and other parts of the PKI implementation. Efficient adaptation to the changes makes the PKI more reliable and trustworthy, reducing operational risks. -",M.change-management-and-agility.change-process,The change management process is documented and implemented,"The change management process is the core of the change management and agile systems. It provides a robust and reliable process to ensure that every change is properly assessed, approved, implemented, and eventually reviewed. - -The change management process should be documented, communicated, and integrated into the organization. The process states how a request for change can be submitted and how it is processed, which includes assessment and approval of the change, implementation of the change, functional testing after the change, and review of the change. -","Assessment -The following is sample evidence that can be used to assess the requirement: -- Documented change management process -- Sample of change request -- Steps involved in the change management process -- Interview with the responsible personnel - -References -- COBIT (Control Objectives for Information and Related Technologies) -- ISO/IEC 20000 and related standards -- The Information Technology Infrastructure Library (ITIL)" -M.change-management-and-agility,Change management and agility,"Change management and agility is important to control the PKI implementation and configuration changes, adjustments, modifications, and improvements. Technologies are changing fast and the PKI needs to be able to adapt to the changes. - The same applies for security vulnerabilities, deprecation of algorithms, and other changes that can significantly affect the PKI. - -The change management should provide a robust and reliable process to ensure that every change is properly assessed, approved, and implemented. The process should be aligned with the organizational change management process and should be followed by all stakeholders. - -Agility means that the PKI is able to adapt to the changes quickly and efficiently. Agility is applied to technologies, processes, algorithms, and other parts of the PKI implementation. Efficient adaptation to the changes makes the PKI more reliable and trustworthy, reducing operational risks. -",M.change-management-and-agility.agility-requirements,Requirements for agility are identified,"Agility provides the ability to adapt to changes quickly and efficiently. Agility and change management are closely related and should be considered together. The future-proof PKI implementation should be able to identify the requirements for agility and implement them in a timely manner. - -Agility can be considered on operational and technical levels. Operational agility means that the PKI is able to adapt to changes in the operational environment, including any changes to the organizational structure, processes, and other operational aspects. Technical agility means that the PKI is able to adapt to changes in the technologies, algorithms, protocols, and other technical aspects. - -Identification of requirements where agility is needed is important to ensure changes are implemented when needed. -","Assessment -The following is sample evidence that can be used to assess the requirement: -- Agility requirements of the PKI implementation -- Configuration changes -- Changes in the operational environment -- Changes in the technologies -- And other relevant evidence - -References -- COBIT (Control Objectives for Information and Related Technologies) -- ISO/IEC 20000 and related standards -- The Information Technology Infrastructure Library (ITIL)" -M.change-management-and-agility,Change management and agility,"Change management and agility is important to control the PKI implementation and configuration changes, adjustments, modifications, and improvements. Technologies are changing fast and the PKI needs to be able to adapt to the changes. - The same applies for security vulnerabilities, deprecation of algorithms, and other changes that can significantly affect the PKI. - -The change management should provide a robust and reliable process to ensure that every change is properly assessed, approved, and implemented. The process should be aligned with the organizational change management process and should be followed by all stakeholders. - -Agility means that the PKI is able to adapt to the changes quickly and efficiently. Agility is applied to technologies, processes, algorithms, and other parts of the PKI implementation. Efficient adaptation to the changes makes the PKI more reliable and trustworthy, reducing operational risks. -",M.change-management-and-agility.change-mgmt-review,Change management and agility is periodically reviewed,"The change management and agility requirements should be periodically reviewed to ensure that they are still valid and relevant. The review should be performed by the responsible personnel and should be documented. A good practice is to review the change management and agility requirements at least once a year, however, the frequency of the review can be different depending on the PKI implementation. -","Assessment -- Change management review frequency -- Implementation of review process and documentation -- Interview with the responsible personnel - -References -- COBIT (Control Objectives for Information and Related Technologies) -- ISO/IEC 20000 and related standards -- The Information Technology Infrastructure Library (ITIL)" -O.resilience,Resilience,"Resilience is the key for any organization wanting to thrive in an ever-changing world, which is obviously s very important factor for any PKI implementation. The PKI is planned to be trusted for multiple years, if not decades. Therefore, the ability to absorb and adapt to the unpredictability, while continuing to deliver on the objectives is becoming mandatory. - -A robust resilience framework helps organizations future-proof their PKI oriented business, detailing key principles, attributes and activities that are followed to ensure that the PKI implementation will be trusted, secure, and effective all the time. -",O.resilience.risk-assessment,Risk assessment and business impact analysis,"Proper risk assessment provides robust understanding about the risks and their impact on the business and organization PKI. The risk assessment results (for example potential loss scenarios) are documented and serves as input for the business impact analysis to identify the critical PKI-related business processes and their dependencies. - -Documented results of the business impact analysis are used to develop recovery strategies for the PKI implementation with required resources and availability. -","Assessment -The following is sample evidence that can be used to assess the requirement: -- Risk management and assessment process -- Documented risk assessment results -- Documented business impact analysis results -- Documented recovery strategies -- Understanding of the resilience and approval of the results -- Interview with the PKI management - -References -- ISO/IEC 27005 - Guidance on managing information security risks -- NIST Risk Management Framework -- ISO/TS 22317 - Guidelines for business impact analysis" -O.resilience,Resilience,"Resilience is the key for any organization wanting to thrive in an ever-changing world, which is obviously s very important factor for any PKI implementation. The PKI is planned to be trusted for multiple years, if not decades. Therefore, the ability to absorb and adapt to the unpredictability, while continuing to deliver on the objectives is becoming mandatory. - -A robust resilience framework helps organizations future-proof their PKI oriented business, detailing key principles, attributes and activities that are followed to ensure that the PKI implementation will be trusted, secure, and effective all the time. -",O.resilience.incident-planning,Cyber-security management and incident planning,"Cyber-security management covers activities to ensure that the PKI is protected against known and zero-day vulnerabilities, cyberattacks and other threats. The operational procedures and technologies are evolving and the PKI needs to be able to adapt to the changes. Without knowing the threats and vulnerabilities, it is not possible to plan for the resilience and properly plan for incident response. - -Incident response planning helps to ensure that the organization is able to respond to the suspected incidents. Incident response plans should be documented and tested regularly. The result of executed incident response plans should be documented and used to improve the plan, even if it was a false alarm. - -Cyber-security management and incident planning covers important aspects such as vulnerability management and security operations center (SOC) identification and response to potential incidents. -","Assessment -The following is sample evidence that can be used to assess the requirement: -- Documented vulnerability management -- Vulnerability scanning results -- Documented incident response plans -- Documented incident response test results -- Monitoring of cyber-security threats -- Interview with the security operations team - -References -- ISO/IEC 27001 - Information security management systems -- Common Vulnerabilities and Exposures (CVE) Program -- NIST Special Publication 800-61 Revision 2 - Computer Security Incident Handling Guide -- SANS Guide to Security Operations" -O.resilience,Resilience,"Resilience is the key for any organization wanting to thrive in an ever-changing world, which is obviously s very important factor for any PKI implementation. The PKI is planned to be trusted for multiple years, if not decades. Therefore, the ability to absorb and adapt to the unpredictability, while continuing to deliver on the objectives is becoming mandatory. - -A robust resilience framework helps organizations future-proof their PKI oriented business, detailing key principles, attributes and activities that are followed to ensure that the PKI implementation will be trusted, secure, and effective all the time. -",O.resilience.business-continuity,Business continuity planning and disaster recovery,"The business continuity planning and disaster recovery are the key activities to ensure availability of the PKI operations. The business continuity planning is used to define the recovery time objectives (RTO) and recovery point objectives (RPO) for the PKI. The RTO and RPO are used to define the required resources and their availability. - -Requirements for the business continuity and disaster recovery should be properly defined. It contains backups of the PKI resources, such as hardware security modules (HSM), databases, configuration files, etc. The availability of backups should be tested regularly to ensure that the backups are available when needed, especially during the disaster. - -Proper measures are applied to identify the disaster and a communication matrix is maintained to ensure that the right people are informed about the disaster on time and the recovery process can be started. - -The following parts are typically covered: -- Scope of the business continuity and disaster recovery -- Roles and responsibilities -- Activation of disaster recovery -- Physical locations -- Communication matrix -- Other requirements and information needed -","Assessment -The following is sample evidence that can be used to assess the requirement: -- Documented business continuity and disaster recovery plans -- Documented recovery time objectives (RTO) and recovery point objectives (RPO) -- Documented backup and recovery procedures -- Communication matrix and contact information -- Availability of backups and other requirements to execute the disaster recovery procedure -- Periodically tested effectiveness of the disaster recovery - -References -- ISO/IEC 22301 - Business continuity management systems -- NIST Special Publication 800-34 Revision 1 - Contingency Planning Guide for Federal Information Systems" -O.resilience,Resilience,"Resilience is the key for any organization wanting to thrive in an ever-changing world, which is obviously s very important factor for any PKI implementation. The PKI is planned to be trusted for multiple years, if not decades. Therefore, the ability to absorb and adapt to the unpredictability, while continuing to deliver on the objectives is becoming mandatory. - -A robust resilience framework helps organizations future-proof their PKI oriented business, detailing key principles, attributes and activities that are followed to ensure that the PKI implementation will be trusted, secure, and effective all the time. -",O.resilience.future-proofing,Technology future proofing,"Applicable technology should always be future proofed to ensure that the PKI is able to adapt to changes, and will support the organization PKI in the future when new standards, algorithms, and approach will be developed. - -When deciding to apply new technologies, or evaluating if the current technology is still suitable and support the goals of the PKI implementation, the following should be considered: -- Technology is supported by the vendor -- Industry standards are applied for interoperability and security -- Review and references on the vendor and technology -- Applicability of the technology for long-term use -- Vulnerabilities and security reports of the technology -- Integration capabilities and customizations needed -- Open source vs. proprietary technology -","Assessment -The following is sample evidence that can be used to assess the requirement: -- Interview with the CTO or CIO -- Documentation of the technology future proofing -- RFI and RFP documents -- Vendor and technology check - -References -- ISO 223XX Security and resilience standards -- ISO/IEC 22301 - Business continuity management systems" -O.resilience,Resilience,"Resilience is the key for any organization wanting to thrive in an ever-changing world, which is obviously s very important factor for any PKI implementation. The PKI is planned to be trusted for multiple years, if not decades. Therefore, the ability to absorb and adapt to the unpredictability, while continuing to deliver on the objectives is becoming mandatory. - -A robust resilience framework helps organizations future-proof their PKI oriented business, detailing key principles, attributes and activities that are followed to ensure that the PKI implementation will be trusted, secure, and effective all the time. -",O.resilience.competence-sharing,Competence and information sharing,"Organization environments may change over time. The impact of changes can be in various forms, for example: -- personnel can rotate in their positions, new people can be hired, or people can leave the organization -- technologies are changing, therefore required skills and knowledge may change -- procedures and eventually management of the PKI will be adjusted - -The organization needs to ensure that the competence of the personnel is maintained and the information is shared to not lose the knowledge introduced by changes within known and unknown variables. The organization should have a plan to ensure that the competence is maintained for the most critical parts of the PKI. - -The competence and information sharing is an important part to achieve the resilience of the PKI implementation by having relevant information and competencies ready when needed. -","Assessment -The following is sample evidence that can be used to assess the requirement: -- Documentation and collaboration -- Onboarding and offboarding procedures -- Building competence and knowledge sharing - -References -- ISO 223XX Security and resilience standards" -O.resilience,Resilience,"Resilience is the key for any organization wanting to thrive in an ever-changing world, which is obviously s very important factor for any PKI implementation. The PKI is planned to be trusted for multiple years, if not decades. Therefore, the ability to absorb and adapt to the unpredictability, while continuing to deliver on the objectives is becoming mandatory. - -A robust resilience framework helps organizations future-proof their PKI oriented business, detailing key principles, attributes and activities that are followed to ensure that the PKI implementation will be trusted, secure, and effective all the time. -",O.resilience.continual-improvement,Continual review and improvement,"The resilience of the PKI implementation should be reviewed and improved regularly. The review and improvement process should be documented and the results should be used to improve the resilience of the PKI implementation. The frequency of review should be based on the organizational risks and needs to be protected against current and future trends. -","Assessment -The following is sample evidence that can be used to assess the requirement: -- Resilience effectiveness review frequency -- Implementation of review process -- Validation of documentation and reviews -- Training records - -References -- ISO 223XX Security and resilience standards -- NIST Special Publications 800 - 30, 34, 37, 46, 53, 84" -O.automation,Automation,"Automation of certificate management is the process of using technology to perform tasks with reduced human assistance. Automation is used to improve the efficiency of the PKI management and to reduce the risk of human error. Automation can be used to perform tasks that are repetitive, time-consuming, or difficult to perform manually. - -On the other hand the automation can introduce new risks and challenges. The automation should be used only for tasks that are well-defined and that can be performed in a reliable way. - -Justified, well-designed, and documented automation of certificate lifecycle management can significantly contribute to the efficiency of the PKI management while reducing the risk of human error. However, automation is not a silver bullet and should be controlled, monitored, and audited to prevent the risk of misuse. -",O.automation.automation-description,Process automation description,"Every automated certificate management process should be properly described and documented. The documentation should contain information relevant to the process automation and understanding the reasons for automation. Monitoring, auditing, and potential measures and controls would be ineffective without proper description and understanding of the automation process. - -The description can include for example the following: -- Use-case or process to be automated -- Reasons for automation -- Description of the automation process -- Involved tools and technologies -- Monitoring and auditing requirements -- Potential measures and controls -- Exceptions -- Logging and reporting -- Any other relevant information and requirements -","Assessment -The following is sample evidence that can be used to assess the requirement: -- Process automation description -- Interview with the process owner -- Interview with administrators -- Sample of automated process logs - -References -" -O.automation,Automation,"Automation of certificate management is the process of using technology to perform tasks with reduced human assistance. Automation is used to improve the efficiency of the PKI management and to reduce the risk of human error. Automation can be used to perform tasks that are repetitive, time-consuming, or difficult to perform manually. - -On the other hand the automation can introduce new risks and challenges. The automation should be used only for tasks that are well-defined and that can be performed in a reliable way. - -Justified, well-designed, and documented automation of certificate lifecycle management can significantly contribute to the efficiency of the PKI management while reducing the risk of human error. However, automation is not a silver bullet and should be controlled, monitored, and audited to prevent the risk of misuse. -",O.automation.automation-monitoring,Monitoring and auditing of automated process,"The automated process of certificate management can cause significant damage if misused or misconfigured. The monitoring and auditing of the automated process is essential to prevent the risk of misuse and to detect any potential issues, inefficiencies, or exceptions. - -The monitoring and auditing should be performed on a regular basis and should be aligned with the overall monitoring and auditing strategy of the organization. -It should provide sufficient information to detect any potential issues with the automated process. For successful detection or identification of issues, proper expectations should be based on the description of the automated process. -","Assessment -Monitoring of automated processes should be supported by monitoring tools and technologies that can provide the necessary overview, reporting, and potential alerting in case of issues. -The following is sample evidence that can be used to assess the requirement: -- Documented monitoring and auditing measures -- Monitoring and auditing tools and technologies applied -- Sample report or dashboard from monitoring -- Interview with responsible personnel -- Simulate failure of the automated certificate management process and verify that the failure is detected and reported - -References -" -O.automation,Automation,"Automation of certificate management is the process of using technology to perform tasks with reduced human assistance. Automation is used to improve the efficiency of the PKI management and to reduce the risk of human error. Automation can be used to perform tasks that are repetitive, time-consuming, or difficult to perform manually. - -On the other hand the automation can introduce new risks and challenges. The automation should be used only for tasks that are well-defined and that can be performed in a reliable way. - -Justified, well-designed, and documented automation of certificate lifecycle management can significantly contribute to the efficiency of the PKI management while reducing the risk of human error. However, automation is not a silver bullet and should be controlled, monitored, and audited to prevent the risk of misuse. -",O.automation.exception-handling,Incidents and exceptions handling,"No automation is perfect and covers everything. There can be edge cases and other situations that were not part of the initial analysis or were simply forgotten. Therefore, there will always be exceptions and incidents that will require manual intervention. The automated process should be able to handle such exceptions and incidents in a way that will not cause any significant damage or disruption to the service. - -It may happen that some certificates are required to be handled manually and therefore the exception should be approved and documented. - -Handling of exceptional situations should be covered in the documentation, stating what should be done in case of an exception or incident: -- Communication of the exception -- Approval of the exception -- Incident handling and reporting -- Any other relevant information - -The handling of exceptions should be tested and verified on a regular basis to ensure that the process is working as expected. -","Assessment -The following is sample evidence that can be used to assess the requirement: -- Documented exceptions -- Interview with responsible personnel about how to handle exceptions or incidents - -References -" -O.interoperability,Interoperability,"Interoperability means the ability of two or more systems or components to exchange information and to use the information that has been exchanged. - -A PKI is composed of multiple components, which are often provided by different vendors, or can be developed and maintained in-house. Interoperability keeps the PKI components working together and allows the PKI to function properly in the long term. - -Adopting open standards and protocols helps to ensure interoperability between PKI components and Relying Party (RP) applications and avoids vendor lock-in that may lead to interoperability issues in the future, especially when the PKI needs to be trusted for a long time, may have no control over RPs or needs to be scaled. - -Interoperability includes the following aspects: -- Interface specifications -- Data formats -- Communication protocols -- Algorithms -- Open standards - -Main principles of interoperability are: -- Transparency and openness -- Technology neutrality -- Reusability and scalability -- Security and privacy -- Accessibility -- Sustainability -- Portability and extensibility -",O.interoperability.interop-strategy,Maintain PKI interoperability strategy,"The interoperability strategy defines the interoperability requirements and the approach to achieve interoperability between the PKI components to ensure the PKI implementation is able to adopt new technologies and standards in the future, and will not be locked-in to a specific vendor. - -PKI interoperability strategy should be maintained, documented, and integrated in the organization. It should cover at least the following information: -- Application of interoperability -- Using open standards and protocols -- Conditions for PKI components to be interoperable -- Restrictions on the use of proprietary interfaces -- Interoperability testing -- Requirements for migration to new technologies -- Requirements for vendors -- Other relevant information -","Assessment -The following evidence should be available for the assessment of the requirement: -- Documented and approved interoperability strategy -- Interoperability strategy is integrated in the organization -- Interview with the responsible person(s) to verify understanding of the interoperability strategy -- Review documentation for PKI components to verify the requirements for interoperability - -References -- The Open Group Architecture Framework (TOGAF)" -O.interoperability,Interoperability,"Interoperability means the ability of two or more systems or components to exchange information and to use the information that has been exchanged. - -A PKI is composed of multiple components, which are often provided by different vendors, or can be developed and maintained in-house. Interoperability keeps the PKI components working together and allows the PKI to function properly in the long term. - -Adopting open standards and protocols helps to ensure interoperability between PKI components and Relying Party (RP) applications and avoids vendor lock-in that may lead to interoperability issues in the future, especially when the PKI needs to be trusted for a long time, may have no control over RPs or needs to be scaled. - -Interoperability includes the following aspects: -- Interface specifications -- Data formats -- Communication protocols -- Algorithms -- Open standards - -Main principles of interoperability are: -- Transparency and openness -- Technology neutrality -- Reusability and scalability -- Security and privacy -- Accessibility -- Sustainability -- Portability and extensibility -",O.interoperability.integration-guidance,Documented integration guidance,"To have effective interoperability between PKI components, it is important to have a proper integration in place that serves the purpose and does not expose any potential risks. Available and documented integration guidance for the developers and administrators should be maintained and updated regularly. - -The integration guidance should be available for all critical PKI components and should cover at least the following information: -- Integration requirements and prerequisites -- Applicable standards and protocols -- Integration architecture -- Integration testing -","Assessment -The following evidence should be available for the assessment of the requirement: -- Documented integration guidance for all critical PKI components -- Interview with the system administrators and developers -- Review of the integration guidance -- System configuration review - -References -- The Open Group Architecture Framework (TOGAF)" -O.interoperability,Interoperability,"Interoperability means the ability of two or more systems or components to exchange information and to use the information that has been exchanged. - -A PKI is composed of multiple components, which are often provided by different vendors, or can be developed and maintained in-house. Interoperability keeps the PKI components working together and allows the PKI to function properly in the long term. - -Adopting open standards and protocols helps to ensure interoperability between PKI components and Relying Party (RP) applications and avoids vendor lock-in that may lead to interoperability issues in the future, especially when the PKI needs to be trusted for a long time, may have no control over RPs or needs to be scaled. - -Interoperability includes the following aspects: -- Interface specifications -- Data formats -- Communication protocols -- Algorithms -- Open standards - -Main principles of interoperability are: -- Transparency and openness -- Technology neutrality -- Reusability and scalability -- Security and privacy -- Accessibility -- Sustainability -- Portability and extensibility -",O.interoperability.open-standards,Adoption and application of open standards,"Open standards are publicly available standards that are developed and maintained by communities or standardization bodies. Open standards are developed through a consensus-based process and are available to everyone without any restrictions. Open standards are usually free to use and implement. - -The open standards are important for interoperability as they are typically technology-agnostic and are supported by technologies and solutions. Open standards are applicable for interfaces, communication protocols, cryptographic algorithms, data formats, automation and orchestration, and other aspects of the PKI. - -The adoption of open standards significant increase interoperability and reduce the risk of vendor lock-in. -","Assessment -The following evidence should be available for the assessment of the requirement: -- Documented list of open standards used by the PKI -- Policies requiring the use of open standards -- Interview with the responsible person to verify understanding of the open standards -- Review of training materials - -References -- Open Standards Principles -- IETF Request for Comments (RFC) -- OASIS Standards -- ISO Standards -- ITU Standards -- NIST Standards -- ETSI Standards" -O.monitoring-and-auditing,Monitoring and auditing,"Monitoring and auditing establish the necessary controls to detect and respond to security events and to provide evidence of compliance with the disclosed business practices. -The events and logs typically serves as a basis for incident response and forensic analysis in case of security incidents, however, they can also be used for other purposes, such as performance analysis, capacity planning, and troubleshooting. - -Monitoring and auditing provide reasonable assurance that: -- Unauthorized PKI system usage is detected -- Critical high impact events are monitored -- Appropriate logs are collected and relevant issues are alerted -- The confidentiality and integrity of current and archived audit logs are maintained for the required period of time -- Audit logs are completely and confidentially archived in accordance with disclosed business practices -- Events and logs are reviewed periodically by authorized personnel - -The outputs from the monitoring and auditing activities are typically used as inputs for the risk assessment and management activities, including incident response management and investigation of high impact events. -",O.monitoring-and-auditing.logging-requirements,Monitoring events and logging requirements are defined and documented,"The monitoring and logging requirements should be defined and documented in the CP, CPS, or other relevant documents. The requirements should be aligned with the overall PKI policies and statements, and should be based on the risk assessment and management activities. - -The requirements can typically include: -- Events to be monitored -- Frequency of monitoring -- Logs to be collected -- Retention period for logs -- Audit trail requirements -- Audit log protection requirements -- Formatting and interpretation of logs (syslog, JSON, XML, CEF, etc.) -- And other relevant requirements -","Assessment -- Documented monitoring and logging requirements -- Policies and procedures for monitoring and logging -- Review of records -- Interviews with personnel - -References -- ISO/IEC 27001 - Information security management systems -- ISO/IEC 20000 and related standards -- ISO/IEC 27099 - Public key infrastructure" -O.monitoring-and-auditing,Monitoring and auditing,"Monitoring and auditing establish the necessary controls to detect and respond to security events and to provide evidence of compliance with the disclosed business practices. -The events and logs typically serves as a basis for incident response and forensic analysis in case of security incidents, however, they can also be used for other purposes, such as performance analysis, capacity planning, and troubleshooting. - -Monitoring and auditing provide reasonable assurance that: -- Unauthorized PKI system usage is detected -- Critical high impact events are monitored -- Appropriate logs are collected and relevant issues are alerted -- The confidentiality and integrity of current and archived audit logs are maintained for the required period of time -- Audit logs are completely and confidentially archived in accordance with disclosed business practices -- Events and logs are reviewed periodically by authorized personnel - -The outputs from the monitoring and auditing activities are typically used as inputs for the risk assessment and management activities, including incident response management and investigation of high impact events. -",O.monitoring-and-auditing.log-collection,Event logs from systems are collected,"The event logs from systems should be collected and available for analysis, including correlation with other records. Centralized logging is recommended to ensure that the logs are collected and stored consistently. Solution like security information and event management (SIEM) can be used to collect and analyze the logs. - -The availability of records for analysis depends on understanding logging format and interpretation of the information, therefore each system should provide logs in a consistent format that can be further processed and analyzed (or automated). - -Logs and events should be collected from all systems that are relevant for the PKI implementation, such as key life cycle management events. - -The event should contain sufficient information to identify the event, including: -- User identification -- Type of event -- Date and time -- Success or failure indication -- Origination of event -- Identity or name of affected data, system component, or resource -- Additional details -","Assessment -- Logs are collected from systems -- Logs have a consistent format and can be further processed and analyzed -- Review of records and their formatting -- Review of configuration standards for logging -- Interviews with personnel to check the understanding of logging format and interpretation of the information - -References -- ISO/IEC 27001 - Information security management systems -- ISO/IEC 20000 and related standards -- NIST - Guide to Computer Security Log Management -- ISO/IEC 27099 - Public key infrastructure" -O.monitoring-and-auditing,Monitoring and auditing,"Monitoring and auditing establish the necessary controls to detect and respond to security events and to provide evidence of compliance with the disclosed business practices. -The events and logs typically serves as a basis for incident response and forensic analysis in case of security incidents, however, they can also be used for other purposes, such as performance analysis, capacity planning, and troubleshooting. - -Monitoring and auditing provide reasonable assurance that: -- Unauthorized PKI system usage is detected -- Critical high impact events are monitored -- Appropriate logs are collected and relevant issues are alerted -- The confidentiality and integrity of current and archived audit logs are maintained for the required period of time -- Audit logs are completely and confidentially archived in accordance with disclosed business practices -- Events and logs are reviewed periodically by authorized personnel - -The outputs from the monitoring and auditing activities are typically used as inputs for the risk assessment and management activities, including incident response management and investigation of high impact events. -",O.monitoring-and-auditing.audit-trail,Audit trail can be reconstructed from audit logs,"Audit logging should be implemented to ensure that the audit trail can be reconstructed from audit logs any time. Audit logs are typically recorded for any user executed events that are important for security of the PKI implementation. Audit logs should be stored in a secure location. The audit logs should be protected against unauthorized access, modification, and deletion. - -Typically, the following events are important for security of the PKI implementation: -- All individual user accesses to sensitive data -- All actions taken by any individual with root or administrative privileges -- Access to all audit trails -- Invalid logical access attempts -- Use of and changes to identification and authentication mechanisms - including but not limited to creation of new accounts and elevation of privileges - and all changes, additions, or deletions to accounts with root or administrative privileges -- Initialization, stopping, or pausing of the audit logs -- Creation and deletion of system-level objects -","Assessment -- Audit trail can be reconstructed from audit logs -- Audit logs are stored in a secure location -- Audit logs are protected against unauthorized access, modification, and deletion -- Review of records -- Interviews with personnel to understand the audit logging implementation - -References -- RFC 3647 - Internet X.509 Public Key Infrastructure Certificate Policy and Certification Practices Framework -- NIST - Guide to Computer Security Log Management -- ISO/IEC 27001 - Information security management systems -- ISO/IEC 27099 - Public key infrastructure" -O.monitoring-and-auditing,Monitoring and auditing,"Monitoring and auditing establish the necessary controls to detect and respond to security events and to provide evidence of compliance with the disclosed business practices. -The events and logs typically serves as a basis for incident response and forensic analysis in case of security incidents, however, they can also be used for other purposes, such as performance analysis, capacity planning, and troubleshooting. - -Monitoring and auditing provide reasonable assurance that: -- Unauthorized PKI system usage is detected -- Critical high impact events are monitored -- Appropriate logs are collected and relevant issues are alerted -- The confidentiality and integrity of current and archived audit logs are maintained for the required period of time -- Audit logs are completely and confidentially archived in accordance with disclosed business practices -- Events and logs are reviewed periodically by authorized personnel - -The outputs from the monitoring and auditing activities are typically used as inputs for the risk assessment and management activities, including incident response management and investigation of high impact events. -",O.monitoring-and-auditing.event-monitoring,Monitoring of operational and security events is implemented,"Monitoring of operational and security events should be implemented to ensure that the PKI implementation is operating as expected and that the security events are detected and responded to in a timely manner and that evidence of any malicious event is identified. The monitoring should be implemented for all critical systems and components, including the CA, RA, OCSP, HSM, and other relevant systems. - -Monitoring should be aligned with the monitoring and auditing requirements defined in the CP, CPS, and other relevant documents. The monitoring should be implemented to ensure that the requirements are met. -","Assessment -- Monitoring of operational and security events is implemented according to the requirements -- Review of monitoring implementation, including CA key life cycle management related events, security sensitive events, and other relevant events -- Review of monitoring events and alerts -- Interviews with personnel responsible for monitoring - -References -- ISO/IEC 27001 - Information security management systems -- ISO/IEC 20000 and related standards -- ISO/IEC 27099 - Public key infrastructure" -O.monitoring-and-auditing,Monitoring and auditing,"Monitoring and auditing establish the necessary controls to detect and respond to security events and to provide evidence of compliance with the disclosed business practices. -The events and logs typically serves as a basis for incident response and forensic analysis in case of security incidents, however, they can also be used for other purposes, such as performance analysis, capacity planning, and troubleshooting. - -Monitoring and auditing provide reasonable assurance that: -- Unauthorized PKI system usage is detected -- Critical high impact events are monitored -- Appropriate logs are collected and relevant issues are alerted -- The confidentiality and integrity of current and archived audit logs are maintained for the required period of time -- Audit logs are completely and confidentially archived in accordance with disclosed business practices -- Events and logs are reviewed periodically by authorized personnel - -The outputs from the monitoring and auditing activities are typically used as inputs for the risk assessment and management activities, including incident response management and investigation of high impact events. -",O.monitoring-and-auditing.critical-event-alerting,Critical events are immediately alerted and resolved according to incident response plans,"Critical events should be immediately alerted and resolved according to incident response plans. Monitoring implementation should ensure that critical events are detected and alerted in a timely manner. This can be done manually or in an automated way. -","Assessment -- Review of requirements for alerting on critical event, including security sensitive events -- Review of monitoring implementation -- Review of documentation of critical events -- Interviews with personnel to check the understanding of critical events and their handling - -References -- ISO/IEC 27001 - Information security management systems -- ISO/IEC 20000 and related standards -- ISO/IEC 27099 - Public key infrastructure" -O.monitoring-and-auditing,Monitoring and auditing,"Monitoring and auditing establish the necessary controls to detect and respond to security events and to provide evidence of compliance with the disclosed business practices. -The events and logs typically serves as a basis for incident response and forensic analysis in case of security incidents, however, they can also be used for other purposes, such as performance analysis, capacity planning, and troubleshooting. - -Monitoring and auditing provide reasonable assurance that: -- Unauthorized PKI system usage is detected -- Critical high impact events are monitored -- Appropriate logs are collected and relevant issues are alerted -- The confidentiality and integrity of current and archived audit logs are maintained for the required period of time -- Audit logs are completely and confidentially archived in accordance with disclosed business practices -- Events and logs are reviewed periodically by authorized personnel - -The outputs from the monitoring and auditing activities are typically used as inputs for the risk assessment and management activities, including incident response management and investigation of high impact events. -",O.monitoring-and-auditing.log-review,Review of events and logs is periodically performed,"Logs and events should be reviewed frequently, preferably automatically, to determine security related issues, potential systems failure, identify anomalies or suspected activity. Regular review should be confirmed by authorized personnel who can proactively identify issues before they become problems. - -The review of logs and events should be performed periodically and the frequency should be based on the risk assessment. Any potential issues should be reported and resolved according to the incident response plans. -","Assessment -- Review of logs and events is performed periodically -- Review of logs and events is performed according to the requirements -- Review of logs and events is confirmed by authorized personnel -- Interview with personnel responsible for review of logs and events - -References -- ISO/IEC 27001 - Information security management systems -- ISO/IEC 20000 and related standards -- NIST - Guide to Computer Security Log Management -- ISO/IEC 27099 - Public key infrastructure" -R.sourcing,Sourcing,"PKI is a complex system that requires a lot of resources to be managed and maintained. Proper sourcing of the resources is one of the key factors of a mature infrastructure that can maintain and improve trust over the time. The resources can be: -- Financial resources needed to maintain the PKI -- Computing resources like hardware, software, tools, technologies -- Human resources (personnel) -- Management resources like processes and procedures - -Sourcing is a process of defining the required resources and their specification, availability, and management. Sourcing requires monitoring and periodic review of the resources needed and alignment with the overall strategy of the organization and scope of the PKI. -",R.sourcing.resource-identification,Resources are identified and documented,"Resources needed for proper management of the PKI are identified and documented. Resources should be aligned with the PKI scope and use-case(s) that should be supported. The main question to answer here is ""Do we know what resources we need to manage the PKI?"". -","Assessment -The following is sample evidence that can be used to assess the requirement: -- Resource management process -- Documented requirements on the resources -- Categorization of resources (an example can be people, processes, procedures, tools, technologies) -- Alignment with the scope of the use-case - -References -" -R.sourcing,Sourcing,"PKI is a complex system that requires a lot of resources to be managed and maintained. Proper sourcing of the resources is one of the key factors of a mature infrastructure that can maintain and improve trust over the time. The resources can be: -- Financial resources needed to maintain the PKI -- Computing resources like hardware, software, tools, technologies -- Human resources (personnel) -- Management resources like processes and procedures - -Sourcing is a process of defining the required resources and their specification, availability, and management. Sourcing requires monitoring and periodic review of the resources needed and alignment with the overall strategy of the organization and scope of the PKI. -",R.sourcing.resource-definition,Resources are clearly defined,"Identified resources should be properly defined and specified. The specification depends on the type of the resource and can include for example the following: -- People: required skills to perform the tasks, roles, and responsibilities -- Tools: description, supported technologies -- Technologies: required functionality and performance -- Financial resources: required budget, funding sources -- Management resources: processes and procedures, inputs, outputs -- Other resources: description, specification, requirements - -Without clearly defined resources, there could be misuse of the organization’s assets or inconsistent interaction with personnel and other parties, leading to insecure and untrusted implementation of the PKI. -","Assessment -The following is a sample evidence that can be used to assess the requirement: -- Resource management process -- Documented requirements on the resources -- Categorization of resources (an example can be: people, processes, procedures, tools, technologies) -- Alignment with the scope of the use-case -- Interview personnel in various roles - -References -- ISO/IEC 20000 and related standards" -R.sourcing,Sourcing,"PKI is a complex system that requires a lot of resources to be managed and maintained. Proper sourcing of the resources is one of the key factors of a mature infrastructure that can maintain and improve trust over the time. The resources can be: -- Financial resources needed to maintain the PKI -- Computing resources like hardware, software, tools, technologies -- Human resources (personnel) -- Management resources like processes and procedures - -Sourcing is a process of defining the required resources and their specification, availability, and management. Sourcing requires monitoring and periodic review of the resources needed and alignment with the overall strategy of the organization and scope of the PKI. -",R.sourcing.resource-availability,Availability of resources,"Identified and defined resources should be available at the required capacity. The availability of the resources should be aligned with the overall strategy of the organization and scope of the PKI. The availability of the resources should be controlled to ensure that the resources are available when needed. -","Assessment -- Review of the resource management process -- Review of the capacity or demand management process -- Alignment with the strategy of the organization and scope of the PKI -- Review of the assignment of the resources to the tasks -- Utilization and performance of the services - -References -- ISO/IEC 20000 and related standards" -R.sourcing,Sourcing,"PKI is a complex system that requires a lot of resources to be managed and maintained. Proper sourcing of the resources is one of the key factors of a mature infrastructure that can maintain and improve trust over the time. The resources can be: -- Financial resources needed to maintain the PKI -- Computing resources like hardware, software, tools, technologies -- Human resources (personnel) -- Management resources like processes and procedures - -Sourcing is a process of defining the required resources and their specification, availability, and management. Sourcing requires monitoring and periodic review of the resources needed and alignment with the overall strategy of the organization and scope of the PKI. -",R.sourcing.resource-review,Resources are periodically reviewed,"Resource should be periodically reviewed to ensure the accurate use of the resources and secure operations. Frequency of the review depends on the complexity and criticality of the infrastructure. Good practice is to perform reviews at least once a year. - -Review includes the following (but not limited to) -- Analysis that the resources continue to match with the scope and capacity required to provide the services -- Review of the specifications of the resources to continue support of the PKI -- Review announcements and technology trends (for example “end of life” plans for a technology) -- Documentation of any remediation plan, updates to sourcing of the PKI, that should be approved by the management -","Assessment -- Review of changes to the PKI scope -- Review of the capacity or available resources -- Vendor announcements -- Technology trends -- Skills and knowledge of the personnel - -References -" -R.knowledge-and-training,Knowledge and training,"The purpose of this category is to ensure that the PKI personnel have the required knowledge and skills to perform their duties and responsibilities. -Education and continuous gathering of required knowledge and skills to manage the PKI is important to be aware and properly react to current trends and threats that may impact the PKI. - -Each of the personnel should be aware of the PKI policies and procedures, and should be able to perform their duties and responsibilities in accordance with the PKI policies and procedures. -",R.knowledge-and-training.training-plan,Establish training plan,"The training plan should be established and maintained to ensure that personnel have the required knowledge and skills to perform their duties and responsibilities. It should reflect the current state of the PKI implementation and be updated when the PKI implementation changes, and provide necessary information for all personnel that are involved in the PKI implementation. - -Training plan is built with PKI needs and requirements in mind and should cover: -- Training prerequisites -- Training matrix (who needs to be trained and what training should be received) -- Training schedule -- Training format and methods -- Requirements on training reports and records -- Training plan review and update - -There can be different methods of training, depending on the needs and requirements: -- Instructor-led training -- Internal or external webinars -- Coaching -- Self-paced training -- Online resources -- Shadowing or reverse-shadowing -","Assessment -- Documented training plan -- Training plan is up-to-date -- Training plan is approved and communicated to all personnel -- Training plan is integrated in organization - -References -- NIST SP 800-16 Information Technology Security Training Requirements: a Role- and Performance-Based Model -- NIST SP 800-50 Building an Information Technology Security Awareness and Training Program -- European Cybersecurity Skills Framework (ECSF)" -R.knowledge-and-training,Knowledge and training,"The purpose of this category is to ensure that the PKI personnel have the required knowledge and skills to perform their duties and responsibilities. -Education and continuous gathering of required knowledge and skills to manage the PKI is important to be aware and properly react to current trends and threats that may impact the PKI. - -Each of the personnel should be aware of the PKI policies and procedures, and should be able to perform their duties and responsibilities in accordance with the PKI policies and procedures. -",R.knowledge-and-training.personnel-training,Responsible personnel receive training,"The responsible personnel should be aware of the current policies and procedures that are related to the context of the PKI implementation. Training should be provided to personnel that are responsible for the management, operation, and administration of the PKI. - -Training is provided in accordance with the current and approved training plan. - -Methods and training content can vary, depending on personnel roles and covers: -- New hires as part of the onboarding process -- Periodic training for all personnel (the frequency of the training depends on the role and responsibilities) - -For each training, attendance should be recorded and documented, and in case the training is not completed, the reason should be documented. -In case there are requirements for score or threshold to be achieved, the results should be documented. -","Assessment -- Review training matrix -- Review documented training results -- Review training records -- Relevancy of the training content -- Training is provided in accordance with the training plan -- Training completeness - -References -- NIST SP 800-16 Information Technology Security Training Requirements: a Role- and Performance-Based Model -- NIST SP 800-50 Building an Information Technology Security Awareness and Training Program -- European Cybersecurity Skills Framework (ECSF)" -R.knowledge-and-training,Knowledge and training,"The purpose of this category is to ensure that the PKI personnel have the required knowledge and skills to perform their duties and responsibilities. -Education and continuous gathering of required knowledge and skills to manage the PKI is important to be aware and properly react to current trends and threats that may impact the PKI. - -Each of the personnel should be aware of the PKI policies and procedures, and should be able to perform their duties and responsibilities in accordance with the PKI policies and procedures. -",R.knowledge-and-training.security-awareness-training,Perform security awareness training,"Security awareness education is an ongoing activity. The security awareness program is implemented to make all personnel aware of their role in protecting the security and establishing trust by the PKI implementation. It should stay up to date to reflect latest security trends, threats, and challenges. - -Security awareness should ensure that personnel are knowledgeable about the threat landscape, their responsibility for the operation of relevant security controls, and are able to access assistance and guidance when required. - -Different methods can be applied to provide security awareness, for example: -- Posters and letters with the specific topic -- Team meetings and webinars -- Security incentives and rewards -- Training and education -","Assessment -- Examine security awareness program -- Interview personnel to verify that they are aware of their responsibilities -- Review security awareness training records -- Security awareness training is provided in accordance with the training plan -- Review content of the security awareness training - -References -- NIST SP 800-50 Building an Information Technology Security Awareness and Training Program -- PCI SSC - Best Practices for Implementing a Security Awareness Program -- Raising Awareness of Cybersecurity" -R.knowledge-and-training,Knowledge and training,"The purpose of this category is to ensure that the PKI personnel have the required knowledge and skills to perform their duties and responsibilities. -Education and continuous gathering of required knowledge and skills to manage the PKI is important to be aware and properly react to current trends and threats that may impact the PKI. - -Each of the personnel should be aware of the PKI policies and procedures, and should be able to perform their duties and responsibilities in accordance with the PKI policies and procedures. -",R.knowledge-and-training.education-plan,Establish education plan,"Proper education plan is required to stay up to date with the development of the latest technologies, security practices, and controls that have impact on the PKI and its future development. - -The education plan should establish a robust base for the personnel to gain relevant knowledge that are out of scope of the internal training plan, but should be aligned with it to ensure that the personnel are able to perform their duties and responsibilities. The education plan should cover: -- Education requirements and prerequisites -- Recommended education approach and methods -- Approach to monitor and assess the education results - -Methods to provide education can vary: -- Internal or external courses -- Incentives and rewards -- Mentoring, coaching, and shadowing -- Competitions and challenges -","Assessment -- Review education plan and its alignment with the training plan -- Interview personnel to verify their educational goals -- Validate education records - -References -- NIST SP 800-16 Information Technology Security Training Requirements: a Role- and Performance-Based Model -- NIST SP 800-50 Building an Information Technology Security Awareness and Training Program -- European Cybersecurity Skills Framework (ECSF)" -R.knowledge-and-training,Knowledge and training,"The purpose of this category is to ensure that the PKI personnel have the required knowledge and skills to perform their duties and responsibilities. -Education and continuous gathering of required knowledge and skills to manage the PKI is important to be aware and properly react to current trends and threats that may impact the PKI. - -Each of the personnel should be aware of the PKI policies and procedures, and should be able to perform their duties and responsibilities in accordance with the PKI policies and procedures. -",R.knowledge-and-training.knowledge-review,Periodically review knowledge,"The training plan should be reviewed and updated periodically to ensure that it is up-to-date and covers all aspects of the specific PKI implementation. - -Periodical review of the training plans helps to maintain required skills and knowledge for the responsible personnel. -It provides assurance that the expected controls are active and working as intended. -","Assessment -- Training plan review process -- Implementation of review process -- Validation of documentation and reviews - -References -- NIST SP 800-16 Information Technology Security Training Requirements: a Role- and Performance-Based Model -- NIST SP 800-50 Building an Information Technology Security Awareness and Training Program -- European Cybersecurity Skills Framework (ECSF)" -R.awareness,Awareness,"Providing awareness about the PKI and its purpose in the organization and outside ensures that each PKI participant understands it properly and is timely informed about any important events that may impact the participant. - -The awareness is important for all PKI participants to know how to handle exceptional situations and how to react to them. It is also important to know how to communicate and when so as to not misunderstand any issues or incidents. -",R.awareness.awareness-plan,Establish and maintain awareness plan,"Awareness plan should be established and maintained to ensure that the PKI participants are aware of all relevant events related to the PKI implementation and its purpose in the organization and outside. It should cover at lease the following information: -- How the organization discloses information to PKI participants -- Contact information -- How are changes communicated -- Who is responsible for accurate awareness -- Resolving communication issues and incidents - -Every PKI participant should receive information and relevant resource in a timely manner according to the awareness plan. -","Assessment -- Documented awareness plan -- Awareness plan is up-to-date -- Review awareness content to ensure that it is contains relevant information -- Awareness plan is approved and communicated to all PKI participants -- Awareness plan is integrated in the organization - -References -- RFC 3647 - Internet X.509 Public Key Infrastructure Certificate Policy and Certification Practices Framework -- ETSI EN 319 401 - General Policy Requirements for Trust Service Providers" -R.awareness,Awareness,"Providing awareness about the PKI and its purpose in the organization and outside ensures that each PKI participant understands it properly and is timely informed about any important events that may impact the participant. - -The awareness is important for all PKI participants to know how to handle exceptional situations and how to react to them. It is also important to know how to communicate and when so as to not misunderstand any issues or incidents. -",R.awareness.pki-disclosure,Disclose PKI information,"Information about the policies, processes, and procedures that are maintained by the PKI should be disclosed to the PKI participants. This information should be available on a timely basis and in a form that is understandable to the PKI participants. - -Organization maintaining the PKI implementation should disclose the following information on a website or other appropriate media that can be reached by the PKI participants: -- Certificate Policy -- Certification Practice Statement -- Revocation information -- Valid CA certificates -- Vulnerability reports -- Audit reports -- Contact information -- Obligations of the PKI participants -- Legal liability of the PKI participants -- Warranty information -- Disclaimer information -- Privacy and data protection information -- Other relevant information -","Assessment -- Review disclosure statement content to ensure that it is contains relevant information -- Disclosure statement is approved and communicated to all PKI participants -- Information is available to all PKI participants -- Information is up-to-date - -References -- RFC 3647 - Internet X.509 Public Key Infrastructure Certificate Policy and Certification Practices Framework -- ETSI EN 319 401 - General Policy Requirements for Trust Service Providers" -R.awareness,Awareness,"Providing awareness about the PKI and its purpose in the organization and outside ensures that each PKI participant understands it properly and is timely informed about any important events that may impact the participant. - -The awareness is important for all PKI participants to know how to handle exceptional situations and how to react to them. It is also important to know how to communicate and when so as to not misunderstand any issues or incidents. -",R.awareness.single-point-of-contact,Establish single point of contact,"The single point of contact (SPOC) provides a convenient way for any PKI participant to contact the organization and responsible personnel of the PKI implementation. The single point of contact should be available 24/7 and should be able to provide relevant information and trigger appropriate procedures if needed based on the situation. - -Contact information for the SPOC should be disclosed to all PKI participants. -The SPOC may be reached through different communication channels, such as: -- Email -- Phone -- Web site form -- Other -","Assessment -- Contact SPOC to ensure that it is available and responds in a timely manner -- Review that the SPOC communicates according to the awareness plan -- Review that the SPOC is able to provide relevant information and trigger appropriate procedures if needed based on the situation - -References -- RFC 3647 - Internet X.509 Public Key Infrastructure Certificate Policy and Certification Practices Framework -- ETSI EN 319 401 - General Policy Requirements for Trust Service Providers" -R.awareness,Awareness,"Providing awareness about the PKI and its purpose in the organization and outside ensures that each PKI participant understands it properly and is timely informed about any important events that may impact the participant. - -The awareness is important for all PKI participants to know how to handle exceptional situations and how to react to them. It is also important to know how to communicate and when so as to not misunderstand any issues or incidents. -",R.awareness.timely-communication,Timely communication of important information,"In the event of an incident with high impact to the security and established trust of the PKI implementation, the organization should communicate the information to the PKI participants in a timely manner to avoid increased escalation of the event and inform participants of further actions that may be required to execute. - -Example of events that require timely communication may be: -- Compromise of the private key -- Changes in the Certificate Policy -- Changes in the Certification Practice Statement -- Security breach -- Other events that may require immediate action by the PKI participants -","Assessment -- Documented procedures to timely inform PKI participants about high impact events -- Review that the procedures are followed -- Interview personnel to ensure that they are aware of the procedures and know how to communicate the information - -References -- RFC 3647 - Internet X.509 Public Key Infrastructure Certificate Policy and Certification Practices Framework -- ETSI EN 319 401 - General Policy Requirements for Trust Service Providers" diff --git a/release-notes/2.0.0/_index.md b/release-notes/2.0.0/_index.md index c8ef8cd..fe7cc31 100644 --- a/release-notes/2.0.0/_index.md +++ b/release-notes/2.0.0/_index.md @@ -1,14 +1,11 @@ --- date: 2026-05-20T00:00:00Z title: 2.0.0 -status: under-development weight: 10 --- # PKI Maturity Model 2.0.0 — Summary of changes -> **Under development** This version has not yet been released. Content and timing are subject to change. - This document summarises the changes from PKI Maturity Model 1.0.0 to 2.0.0. It is intended for assessors, consultants, and PKI program owners who use the model to evaluate or improve PKI programs. ## Change types @@ -61,13 +58,14 @@ This summary uses the following change-type vocabulary: ## Summary of changes to extensions -2.0.0 is the first release of the PKI Maturity Model that supports extensions. An extension is an optional overlay that adds emphasis, additional requirements, or alternative weighting for a specific risk profile or industry context. Extensions do not change the core model; they supplement it for organisations that need a more targeted view. +2.0.0 introduces the extension **framework and schema**: a defined mechanism for optional overlays that add emphasis, additional requirements, or alternative weighting for a specific risk profile or industry context. Extensions do not change the core model; they supplement it for organisations that need a more targeted view. The framework and its JSON Schema live in this repository (`extensions/extension.schema-1.0.0.json`). -### PQC Readiness Extension +The extension **catalog** — the actual published extensions — is maintained separately in the [`pkimm-extensions`](https://pkic.org/wg/pkimm/extensions/) repository and published at that site. This repository no longer ships or tracks individual extension content; consult `pkimm-extensions` for available extensions, their status, and version compatibility with the core model. -The PQC Readiness Extension is the first published extension. It overlays the Governance module categories with post-quantum cryptography readiness criteria, maturity guidance, and requirement-weight adjustments. When enabled during an assessment, it evaluates how prepared an organisation is to migrate its PKI to quantum-safe cryptography. The extension is opt-in; it has no effect on organisations that do not enable it. +## Summary of changes to integrations and tools -The extension is currently under development. The Governance criteria are complete; criteria for the Management, Operations, and Resources modules are still being developed and will land in a subsequent release. +- **Integrations moved.** The Eramba CSV converter scripts (previously under `integrations/eramba/`) have moved to the separate [`pkimm-integrations`](https://pkic.org/wg/pkimm/integrations/) repository. The in-repo `integrations/eramba/*.csv` paths are retired. +- **Excel assessment tools retired.** The Excel-based assessment tools (`tools/PKI_Maturity_Assessment_Tool_*.xlsx`, `tools/PKI_Maturity_Self_Assessment_Tool_*.xlsx`) are retired from this repository as of 2.0.0 and are superseded by the web self-assessment. They remain available at the `1.0.0`-tagged raw URLs and in the 1.0.0 website section; the `/main/`-pinned raw `tools/*.xlsx` URLs will no longer resolve. ## Notes for assessors and consultants @@ -75,5 +73,6 @@ The extension is currently under development. The Governance criteria are comple - **Reports referencing "level 2 — Basic".** Existing assessment reports completed under 1.0.0 are not invalidated. If you regenerate or reissue a report, update references from "level 2 — Basic" to "level 2 — Foundational" to align with 2.0.0 terminology. - **Existing assessments.** Categories carried over from 1.0.0 have no content changes other than the cipher-suite removals from Certificate management and Key management. Scores for those categories may need a small re-evaluation if the removed requirement materially influenced the maturity level; for most assessments the impact is minor and limited to a single requirement. - **Cryptography category.** Organisations that completed a 1.0.0 assessment should add the Cryptography category to their next assessment cycle. -- **PQC Readiness Extension.** Organisations not concerned with post-quantum migration are unaffected. The extension applies only when explicitly enabled. +- **Extensions.** Published extensions are maintained in the `pkimm-extensions` repository, not this one; they are optional and apply only when explicitly enabled. Consult that repository for available extensions and their model-version compatibility. +- **Excel tools retired.** If you have bookmarked or automated against the `/main/`-pinned raw `tools/*.xlsx` URLs, switch to the web self-assessment or the `1.0.0`-tagged URLs, as those links will no longer resolve. - **Questions and discussions.** Engage with the working group via the [PKI Maturity Model community discussion](https://github.com/orgs/pkic/discussions/categories/pki-maturity-model-pkimm). diff --git a/scripts/check_model_docs_consistency.py b/scripts/check_model_docs_consistency.py index 54dc630..f515b52 100644 --- a/scripts/check_model_docs_consistency.py +++ b/scripts/check_model_docs_consistency.py @@ -101,8 +101,7 @@ def _check_category_md_parity( def _check_level_vocabulary(repo_root: Path) -> list[ConsistencyIssue]: issues: list[ConsistencyIssue] = [] - skip_dirs = {".git", "node_modules", ".venv", "dist", "tools", - "integrations", "scripts"} + skip_dirs = {".git", "node_modules", ".venv", "dist", "scripts"} for path in repo_root.rglob("*.md"): if any(part in skip_dirs for part in path.relative_to(repo_root).parts): continue @@ -130,8 +129,7 @@ def _check_counts_in_index(model: dict, repo_root: Path) -> list[ConsistencyIssu count_pattern = re.compile( r"\b(\d+)\s+(modules?|categories?|maturity\s+levels?)\b", re.IGNORECASE ) - skip = {".git", "node_modules", ".venv", "dist", "tools", - "integrations", "scripts", "changelog"} + skip = {".git", "node_modules", ".venv", "dist", "scripts", "changelog"} for path in repo_root.rglob("_index.md"): if any(part in skip for part in path.relative_to(repo_root).parts): continue @@ -174,29 +172,9 @@ def _load_global_catalog(repo_root: Path) -> dict: return {} -def _load_extension_catalogs(repo_root: Path) -> dict[str, set[str]]: - """Read each extension YAML's inline `references` block. Returns - {extension_id: {set of catalog ids declared inline}}.""" - out: dict[str, set[str]] = {} - ext_dir = repo_root / "extensions" / "catalog" - if not ext_dir.exists(): - return out - for ext_yaml in ext_dir.rglob("*-extension.yaml"): - try: - d = yaml.safe_load(ext_yaml.read_text()) - except yaml.YAMLError: - continue - if not isinstance(d, dict): - continue - ext_id = d.get("extension", {}).get("id", ext_yaml.stem) - out[ext_id] = {r["id"] for r in d.get("references", []) if isinstance(r, dict) and "id" in r} - return out - - def _check_reference_ids(repo_root: Path, model: dict) -> list[ConsistencyIssue]: """Cross-check that every reference id cited from a requirement resolves - against either the global catalog or (for extension citations) the - extension's inline references block.""" + against the global catalog.""" issues: list[ConsistencyIssue] = [] catalog = _load_global_catalog(repo_root) global_ids = {r["id"] for r in catalog.get("references", []) if isinstance(r, dict) and "id" in r} @@ -212,31 +190,6 @@ def _check_reference_ids(repo_root: Path, model: dict) -> list[ConsistencyIssue] f"catalog id '{ref_id}' (not in data/pkimm-references.yaml).", )) - # Extension citations resolve in their own inline block OR the global catalog. - extension_locals = _load_extension_catalogs(repo_root) - ext_dir = repo_root / "extensions" / "catalog" - if ext_dir.exists(): - for ext_yaml in ext_dir.rglob("*-extension.yaml"): - try: - d = yaml.safe_load(ext_yaml.read_text()) - except yaml.YAMLError: - continue - if not isinstance(d, dict): - continue - ext_id = d.get("extension", {}).get("id", ext_yaml.stem) - local_ids = extension_locals.get(ext_id, set()) - allowed = global_ids | local_ids - for module in d.get("relevance", {}).get("modules", []): - for c in module.get("categories", []): - for ref_id in c.get("references", []) or []: - if ref_id not in allowed: - issues.append(ConsistencyIssue( - "error", - f"Extension {ext_id} category '{c.get('id')}' references " - f"unknown catalog id '{ref_id}' (not in global catalog or " - f"extension's inline references block).", - )) - # Authority warning on global catalog only. for ref in catalog.get("references", []) or []: if not isinstance(ref, dict): @@ -252,39 +205,6 @@ def _check_reference_ids(repo_root: Path, model: dict) -> list[ConsistencyIssue] return issues -def _check_extension_compatibility(repo_root: Path) -> list[ConsistencyIssue]: - issues: list[ConsistencyIssue] = [] - data_dir = repo_root / "data" - if not data_dir.exists(): - return issues - known_model_versions = set() - for yml in data_dir.glob("pkimm-model-*.yaml"): - try: - d = yaml.safe_load(yml.read_text()) - except yaml.YAMLError: - continue - if isinstance(d, dict) and "version" in d: - known_model_versions.add(d["version"]) - ext_dir = repo_root / "extensions" / "catalog" - if not ext_dir.exists(): - return issues - for ext_yaml in ext_dir.rglob("*-extension.yaml"): - try: - d = yaml.safe_load(ext_yaml.read_text()) - except yaml.YAMLError: - continue - compat = d.get("extension", {}).get("compatibility", []) - for cv in compat: - if cv not in known_model_versions: - issues.append(ConsistencyIssue( - "error", - f"Extension {ext_yaml} declares compatibility '{cv}' " - f"which is not a known model version " - f"(known: {sorted(known_model_versions)}).", - )) - return issues - - def _check_reference_shape_consistency(repo_root: Path) -> list[ConsistencyIssue]: """The reference-entry shape inlined in the catalog schema and in the extension schema must remain byte-identical (canonical JSON), since both @@ -329,7 +249,6 @@ def check_all( issues += _check_level_vocabulary(repo_root) issues += _check_counts_in_index(model, repo_root) issues += _check_reference_ids(repo_root, model) - issues += _check_extension_compatibility(repo_root) issues += _check_reference_shape_consistency(repo_root) return issues diff --git a/tools/PKI_Maturity_Assessment_Tool_v240318.xlsx b/tools/PKI_Maturity_Assessment_Tool_v240318.xlsx deleted file mode 100644 index c4d8763..0000000 Binary files a/tools/PKI_Maturity_Assessment_Tool_v240318.xlsx and /dev/null differ diff --git a/tools/PKI_Maturity_Self_Assessment_Tool_v231220.xlsx b/tools/PKI_Maturity_Self_Assessment_Tool_v231220.xlsx deleted file mode 100644 index 50ae095..0000000 Binary files a/tools/PKI_Maturity_Self_Assessment_Tool_v231220.xlsx and /dev/null differ diff --git a/tools/_index.md b/tools/_index.md deleted file mode 100644 index 560012f..0000000 --- a/tools/_index.md +++ /dev/null @@ -1,19 +0,0 @@ ---- -date: 2023-06-17T7:00:00Z -title: Tools -weight: 7 - ---- - -# Tools - -> **NOTE:** The Excel for Microsoft 365 or Excel for web is required for some of the Excel-based tools to work properly. -{.callout-info} - -The following tools are available to support the PKI maturity model: - -| Tool | Description | -|---------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| [PKI maturity assessment tool](https://raw.githubusercontent.com/pkic/pkimm/main/tools/PKI_Maturity_Assessment_Tool_v240318.xlsx) | Assessment tool based on spreadsheet, which covers all steps of the assessment process and provides guidance for users to perform the assessment. This tool automatically evaluates maturity level based on the assessment results and generates report that can be shared. | -| [PKI maturity quick self-assessment tool](https://raw.githubusercontent.com/pkic/pkimm/main/tools/PKI_Maturity_Self_Assessment_Tool_v231220.xlsx) | Quick self-assessment tool based on spreadsheet assessment questions defined in categories. This tool is intended for a quick self-assessment of the PKI maturity level and as a starting point for the full assessment. | -| [PKI maturity web self-assessment tool](self-assessment/) *(under development for 2.0.0)* | A web-based self-assessment tool designed to quickly evaluate the PKI maturity level. Equipped with reporting capabilities, it allows users to track, store, and share their self-assessment progress over time. Serving as an initial step toward a full PKI maturity evaluation, this tool helps organizations identify key areas of improvement and lay the groundwork for a more in-depth analysis. The 2.0.0 version of this tool is being updated to work with the new model; the [1.0.0 version](https://pkic.org/wg/pkimm/1.0.0/tools/self-assessment/) remains available in the meantime. | diff --git a/tools/self-assessment/_index.md b/tools/self-assessment/_index.md deleted file mode 100644 index 02bac12..0000000 --- a/tools/self-assessment/_index.md +++ /dev/null @@ -1,20 +0,0 @@ ---- -title: PKI Maturity Model Self Assessment Tool -summary: Self Assessment Tool for the PKI Maturity Model of the PKI Consortium -date: 2024-09-14T20:00:00+00:00 -fullwidth: true -build: - render: never - list: never - ---- - - - -{{< self-assessment data-url="../../data/pkimm-model-2.0.0.yaml" config-url="config.yaml" >}} diff --git a/tools/self-assessment/config.yaml b/tools/self-assessment/config.yaml deleted file mode 100644 index 3ea41fa..0000000 --- a/tools/self-assessment/config.yaml +++ /dev/null @@ -1,53 +0,0 @@ -overview: - data: | - # PKI Maturity Model (PKIMM) Self-Assessment - - This self-assessment tool is intended for a quick self-assessment of the PKI maturity level and as a starting point for the full assessment. - - You can use the tool: - - to quickly evaluate the current PKI maturity level - - share progress with your team - - identify areas for improvement - - generate a report with the results - - # What is PKI Maturity Model? - - The maturity model is based on the Capability Maturity Model Integration (CMMI) developed by Carnegie Mellon University. It should provide the following: - - Quickly understand the current level of capabilities and performance of the PKI - - Support comparison of PKI maturity with similar organizations based on size or industry (anonymized) - - Guidance on how to improve the capabilities of the current PKI - - Improve overall PKI performance - - The PKI maturity model defines 5 levels of the PKI maturity based on different indicators and associated risks. - - | **Maturity level** | **Short description** | - |--------------------|--------------------------------------------------------------------------------------------------------------| - | **Initial** | Unpredictable process with poor control and always reactive | - | **Foundational** | Process is characterized by each particular case or project and controls are often reactive | - | **Advanced** | Process is characterized by organizational standards and controls are proactive | - | **Managed** | Processes are measured and controlled, proactive approach | - | **Optimized** | Continuous improvement of the processes and procedures, proactive approach for future technology improvement | - - # Resources - - | Resource | Description | - |-------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------| - | [PKI maturity model](https://pkic.org/pkimm/model/) | Definition of the PKI maturity model and description of the maturity assessment process and procedures in order to rate the current maturity level and to track progress. | - | [Categories description](https://pkic.org/pkimm/categories/) | Description of PKI maturity model related categories and associated requirement, guidance, assessment tips, and references. | - | [PKI maturity assessment process](https://pkic.org/pkimm/assessment/) | Description of the assessment process. | - | [PKI maturity assessment tools](https://pkic.org/pkimm/tools/) | Available tools for the assessment of the PKI implementation and use case. | - | [Feedback form](https://forms.gle/7CgvuNoxaiTYbtK29) | PKI maturity model and assessment feedback form. | - | [PKI maturity model community discussion](https://github.com/orgs/pkic/discussions/categories/pki-maturity-model-pkimm) | Ideas, questions, or feedback that you want to share or discuss related to the PKI maturity model. | -email: - enabled: true - subject: "PKI Maturity Model (PKIMM) Self-Assessment" - body: | - Below you find a link to your PKI Maturity Model (PKIMM) Self-Assessment. This link allows you to continue the assessment at a later stage. You can also export the results to PDF. - - If you have any questions about the PKI Maturity Model, please reach out to our community at https://pkic.org/discussions. - - Assessment URL: - ${progressUrl} - - Kind regards, - The PKI Maturity Model Working Group of the PKI Consortium