2 ms·

See section 4.18, control SC-13.

• tptacek 3y ago
  Yes, I'm familiar. I don't believe that means everything you use that happens to involve cryptography has to comply with that control.
  • Spooky23 3y ago
    At the time we looked at it for a client, in an audit, certain aspects would be at the discretion of the auditor. They are typically pragmatic about this stuff. That said my original statement was too broad. It’s not an “enterprise” issue, more use case dependent in regulated scenarios.