Navigate

SC-23 (5)

SC-23 (5): Allowed Certificate Authorities

The information system only allows the use of [Assignment: organization-defined certificate authorities] for verification of the establishment of protected sessions.

Supplemental

Reliance on certificate authorities (CAs) for the establishment of secure sessions includes, for example, the use of Secure Socket Layer (SSL) and/or Transport Layer Security (TLS) certificates. These certificates, after verification by the respective certificate authorities, facilitate the establishment of protected sessions between web clients and web servers.

CIA Levels
Confidentiality	unknown
Integrity	low
Availability	unknown

Overlays
None

Related Controls

The controls below (if any) were marked by NIST as being related to SC-23 (5).

Control	Description
SC-13	The information system implements [Assignment: organization-defined cryptographic uses and type of cryptography required for each use] in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.

Enhancements

The controls below (if any) add on to the requirements of SC-23 (5).

Control	Description
No controls

Related CCIs

The CCIs below are tied to SC-23 (5).

CCI	Definition
CCI-002469	The organization defines the certificate authorities the information system will allow to be used on the information system.
CCI-002470	The information system only allows the use of organization-defined certificate authorities for verification of the establishment of protected sessions.