💼 SC-13 Cryptographic Protection

• ID: /frameworks/nist-sp-800-53-r5/sc/13

Stats

not available

Description

a. Determine the [Assignment: organization-defined cryptographic uses]; and b. Implement the following types of cryptography required for each specified cryptographic use: [Assignment: organization-defined types of cryptography for each specified cryptographic use].

Similar

• Sections
  • /frameworks/aws-fsbp-v1.0.0/api-gateway/02
  • /frameworks/aws-fsbp-v1.0.0/api-gateway/05
  • /frameworks/aws-fsbp-v1.0.0/cloudfront/03
  • /frameworks/aws-fsbp-v1.0.0/cloudfront/07
  • /frameworks/aws-fsbp-v1.0.0/cloudfront/08
  • /frameworks/aws-fsbp-v1.0.0/cloudfront/10
  • /frameworks/aws-fsbp-v1.0.0/cloudtrail/02
  • /frameworks/aws-fsbp-v1.0.0/codebuild/03
  • /frameworks/aws-fsbp-v1.0.0/data-firehouse/01
  • /frameworks/aws-fsbp-v1.0.0/dms/09
  • /frameworks/aws-fsbp-v1.0.0/dms/12
  • /frameworks/aws-fsbp-v1.0.0/documentdb/01
  • /frameworks/aws-fsbp-v1.0.0/dynamodb/03
  • /frameworks/aws-fsbp-v1.0.0/dynamodb/07
  • /frameworks/aws-fsbp-v1.0.0/ec2/03
  • /frameworks/aws-fsbp-v1.0.0/ec2/07
  • /frameworks/aws-fsbp-v1.0.0/efs/01
  • /frameworks/aws-fsbp-v1.0.0/eks/03
  • /frameworks/aws-fsbp-v1.0.0/elasticache/04
  • /frameworks/aws-fsbp-v1.0.0/elasticache/05
  • /frameworks/aws-fsbp-v1.0.0/elb/01
  • /frameworks/aws-fsbp-v1.0.0/elb/02
  • /frameworks/aws-fsbp-v1.0.0/elb/03
  • /frameworks/aws-fsbp-v1.0.0/elb/08
  • /frameworks/aws-fsbp-v1.0.0/elb/17
  • /frameworks/aws-fsbp-v1.0.0/emr/04
  • /frameworks/aws-fsbp-v1.0.0/es/01
  • /frameworks/aws-fsbp-v1.0.0/es/03
  • /frameworks/aws-fsbp-v1.0.0/es/08
  • /frameworks/aws-fsbp-v1.0.0/kinesis/01
  • /frameworks/aws-fsbp-v1.0.0/msk/01
  • /frameworks/aws-fsbp-v1.0.0/neptune/01
  • /frameworks/aws-fsbp-v1.0.0/neptune/06
  • /frameworks/aws-fsbp-v1.0.0/opensearch/01
  • /frameworks/aws-fsbp-v1.0.0/opensearch/03
  • /frameworks/aws-fsbp-v1.0.0/opensearch/08
  • /frameworks/aws-fsbp-v1.0.0/rds/03
  • /frameworks/aws-fsbp-v1.0.0/rds/04
  • /frameworks/aws-fsbp-v1.0.0/rds/27
  • /frameworks/aws-fsbp-v1.0.0/redshift/02
  • /frameworks/aws-fsbp-v1.0.0/redshift/10
  • /frameworks/aws-fsbp-v1.0.0/s3/05
  • /frameworks/aws-fsbp-v1.0.0/sqs/01
• Internal
  • ID: dec-c-76385c86

Similar Sections (Take Policies From)

Section	Sub Sections	Internal Rules	Policies	Flags	Compliance
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [APIGateway.2] API Gateway REST API stages should be configured to use SSL certificates for backend authentication"		1	1		no data
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [APIGateway.5] API Gateway REST API cache data should be encrypted at rest					no data
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [CloudFront.3] CloudFront distributions should require encryption in transit		1	1		no data
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [CloudFront.7] CloudFront distributions should use custom SSL/TLS certificates		1	1		no data
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [CloudFront.8] CloudFront distributions should use SNI to serve HTTPS requests		1	1		no data
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [CloudFront.10] CloudFront distributions should not use deprecated SSL protocols between edge locations and custom origins		1	1		no data
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [CloudTrail.2] CloudTrail should have encryption at-rest enabled			1		no data
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [CodeBuild.3] CodeBuild S3 logs should be encrypted					no data
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [DataFirehose.1] Firehose delivery streams should be encrypted at rest					no data
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [DMS.9] DMS endpoints should use SSL		1	1		no data
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [DMS.12] DMS endpoints for Redis OSS should have TLS enabled					no data
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [DocumentDB.1] Amazon DocumentDB clusters should be encrypted at rest			1		no data
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [DynamoDB.3] DynamoDB Accelerator (DAX) clusters should be encrypted at rest		1	1		no data
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [DynamoDB.7] DynamoDB Accelerator clusters should be encrypted in transit					no data
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [EC2.3] Attached Amazon EBS volumes should be encrypted at-rest			3		no data
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [EC2.7] EBS default encryption should be enabled		1	1		no data
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [EFS.1] Elastic File System should be configured to encrypt file data at-rest using AWS KMS		1	2		no data
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [EKS.3] EKS clusters should use encrypted Kubernetes secrets					no data
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [ElastiCache.4] ElastiCache replication groups should be encrypted at rest			1		no data
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [ElastiCache.5] ElastiCache replication groups should be encrypted in transit			1		no data
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [ELB.1] Application Load Balancer should be configured to redirect all HTTP requests to HTTPS			1		no data
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [ELB.2] Classic Load Balancers with SSL/HTTPS listeners should use a certificate provided by AWS Certificate Manager					no data
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [ELB.3] Classic Load Balancer listeners should be configured with HTTPS or TLS termination					no data
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [ELB.8] Classic Load Balancers with SSL listeners should use a predefined security policy that has strong AWS Configuration					no data
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [ELB.17] Application and Network Load Balancers with listeners should use recommended security policies			1		no data
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [EMR.4] Amazon EMR security configurations should be encrypted in transit			1		no data
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [ES.1] Elasticsearch domains should have encryption at-rest enabled			1		no data
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [ES.3] Elasticsearch domains should encrypt data sent between nodes			1		no data
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [ES.8] Connections to Elasticsearch domains should be encrypted using the latest TLS security policy			1		no data
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [Kinesis.1] Kinesis streams should be encrypted at rest			1		no data
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [MSK.1] MSK clusters should be encrypted in transit among broker nodes			1		no data
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [Neptune.1] Neptune DB clusters should be encrypted at rest			1		no data
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [Neptune.6] Neptune DB cluster snapshots should be encrypted at rest			1		no data
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [Opensearch.1] OpenSearch domains should have encryption at rest enabled			1		no data
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [Opensearch.3] OpenSearch domains should encrypt data sent between nodes			1		no data
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [Opensearch.8] Connections to OpenSearch domains should be encrypted using the latest TLS security policy			1		no data
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [RDS.3] RDS DB instances should have encryption at-rest enabled		1	1		no data
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [RDS.4] RDS cluster snapshots and database snapshots should be encrypted at rest			1		no data
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [RDS.27] RDS DB clusters should be encrypted at rest			1		no data
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [Redshift.2] Connections to Amazon Redshift clusters should be encrypted in transit			1		no data
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [Redshift.10] Redshift clusters should be encrypted at rest			1		no data
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [S3.5] S3 general purpose buckets should require requests to use SSL		1	1		no data
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [SQS.1] Amazon SQS queues should be encrypted at rest					no data

Similar Sections (Give Policies To)

Section	Sub Sections	Internal Rules	Policies	Flags	Compliance
💼 FedRAMP High Security Controls → 💼 SC-13 Cryptographic Protection (L)(M)(H)		16	43		no data
💼 FedRAMP Low Security Controls → 💼 SC-13 Cryptographic Protection (L)(M)(H)			43		no data
💼 NIST CSF v2.0 → 💼 PR.DS-01: The confidentiality, integrity, and availability of data-at-rest are protected			196		no data
💼 NIST CSF v2.0 → 💼 PR.DS-02: The confidentiality, integrity, and availability of data-in-transit are protected			167		no data
💼 NIST CSF v2.0 → 💼 PR.DS-10: The confidentiality, integrity, and availability of data-in-use are protected			197		no data

Sub Sections

Section	Sub Sections	Internal Rules	Policies	Flags	Compliance
💼 SC-13(1) Cryptographic Protection _ FIPS-validated Cryptography					no data
💼 SC-13(2) Cryptographic Protection _ NSA-approved Cryptography					no data
💼 SC-13(3) Cryptographic Protection _ Individuals Without Formal Access Approvals					no data
💼 SC-13(4) Cryptographic Protection _ Digital Signatures					no data

Policies (32)

Policy	Logic Count	Flags	Compliance
🛡️ AWS Account EBS Volume Encryption Attribute is not enabled in all regions🟢	1	🟢 x6	no data
🛡️ AWS API Gateway REST API Stage is not configured to use an SSL certificate for authentication🟢	1	🟢 x6	no data
🛡️ AWS CloudFront Web Distribution Cache Behaviors allow unencrypted traffic🟢	1	🟢 x6	no data
🛡️ AWS CloudFront Web Distribution uses default SSL/TLS certificate🟢	1	🟢 x6	no data
🛡️ AWS CloudFront Web Distribution uses Dedicated IP for SSL🟢	1	🟢 x6	no data
🛡️ AWS CloudFront Web Distribution uses outdated SSL protocols with Custom Origins🟢	1	🟢 x6	no data
🛡️ AWS CloudTrail is not encrypted with KMS CMK🟢	1	🟢 x6	no data
🛡️ AWS DAX Cluster Server-Side Encryption is not enabled🟢	1	🟢 x6	no data
🛡️ AWS DMS Endpoint doesn't use SSL🟢	1	🟢 x6	no data
🛡️ AWS EBS Attached Volume is not encrypted🟢	1	🟢 x6	no data
🛡️ AWS EBS Attached Volume is not encrypted with KMS CMK🟢	1	🟢 x6	no data
🛡️ AWS EBS Snapshot is not encrypted🟢	1	🟢 x6	no data
🛡️ AWS EFS File System encryption is not enabled🟢	1	🟢 x6	no data
🛡️ AWS EFS File System is not encrypted with KMS CMK🟢	1	🟢 x6	no data
🛡️ AWS ElastiCache Replication Group is not encrypted at rest🟢	1	🟢 x6	no data
🛡️ AWS ElastiCache Replication Group is not encrypted in-transit🟢	1	🟢 x6	no data
🛡️ AWS ELB Application Load Balancer is not configured to redirect HTTP to HTTPS🟢	1	🟢 x6	no data
🛡️ AWS ELB Load Balancer listener is configured with an outdated security policy🟢	1	🟢 x6	no data
🛡️ AWS EMR Cluster encryption is disabled🟢⚪		🟢 x2, ⚪ x1	no data
🛡️ AWS Kinesis Stream is not encrypted at rest🟢	1	🟢 x6	no data
🛡️ AWS MSK Cluster Client-Broker Encryption is not enabled🟢	1	🟢 x6	no data
🛡️ AWS OpenSearch Domain is not encrypted at rest🟢	1	🟢 x6	no data
🛡️ AWS OpenSearch Domain is not encrypted with the latest TLS policy🟢	1	🟢 x6	no data
🛡️ AWS OpenSearch Domain Node To Node Encryption is not enabled🟢	1	🟢 x6	no data
🛡️ AWS RDS Cluster Encryption is not enabled🟢	1	🟢 x6	no data
🛡️ AWS RDS Instance Encryption is not enabled🟢	1	🟢 x6	no data
🛡️ AWS RDS Snapshot is not encrypted🟢	1	🟢 x6	no data
🛡️ AWS Redshift Cluster is not encrypted at rest🟢	1	🟢 x6	no data
🛡️ AWS Redshift Cluster is not required to use encryption in transit🟢	1	🟢 x6	no data
🛡️ AWS S3 Bucket is not encrypted with a KMS key🟢	1	🟢 x6	no data
🛡️ AWS S3 Bucket Policy is not set to deny HTTP requests🟢	1	🟢 x6	no data
🛡️ AWS SNS Topic is not encrypted with a KMS key🟢	1	🟢 x6	no data