V11.1.4 restates cryptographic inventory requirement already covered by V11.1.2
Nobody has claimed this yet.
- Dominant language
- HTML
- Stars
- 3.6k
- Forks
- 831
- Avg merge
- 7h 55m
- Merged PRs (30d)
- 4
Description
Current requirements
| # | Description | Level |
|---|---|---|
| 11.1.2 | Verify that a cryptographic inventory is performed, maintained, regularly updated, and includes all cryptographic keys, algorithms, and certificates used by the application. It must also document where keys can and cannot be used in the system, and the types of data that can and cannot be protected using the keys. | 2 |
| 11.1.4 | Verify that a cryptographic inventory is maintained. This must include a documented plan that outlines the migration path to new cryptographic standards, such as post-quantum cryptography, in order to react to future threats. | 3 |
Issue
V11.1.4 opens with "Verify that a cryptographic inventory is maintained" which is a subset of what V11.1.2 already requires ("Verify that a cryptographic inventory is performed, maintained, regularly updated...").
The unique value of V11.1.4 is the migration plan element -- the documented plan for transitioning to new cryptographic standards. The inventory maintenance itself is already fully covered by V11.1.2.
Suggestion
Drop the inventory reference since it's implicit from the section context:
"Verify that there is a documented plan that outlines the migration path to new cryptographic standards, such as post-quantum cryptography, in order to react to future threats."
Background
V11.1.4 was created in PR #2972 (resolving #2912) by merging 11.8.1 and 11.8.2 into V11.1. The "cryptographic inventory is maintained" phrasing was carried over from the original 11.8.1 wording, where it made sense as a standalone requirement in V11.8. Now that the requirement lives in V11.1 alongside V11.1.2, the repetition is unnecessary.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Compare the source text for V11.1.2 and V11.1.4, using the issue's background on PR #2972 and issue #2912 for context. Remove the duplicated inventory wording from V11.1.4 while preserving its migration-plan requirement, then verify the resulting requirement matches the suggested text.
Written by the indexing model from the issue text.
Assessment
- Domain
- documentation, security
- Issue type
- Documentation
- Difficulty
- 1/5
- Estimated time
- Under an hour
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 55/100