Audit — SC-8 — Transmission Confidentiality and Integrity

Examine Review the data-in-transit policy/SSP to confirm which communications must be protected and the approved protocols and cipher suites (e.g., TLS 1.2+), covering both confidentiality and integrity of transmitted information.

Test Run a TLS/SSL scanner (e.g., testssl.sh or nmap ssl-enum-ciphers) against externally and internally facing services to confirm strong TLS is enforced and that SSLv3/TLS 1.0/1.1 and weak ciphers (RC4, export, NULL) are disabled.

Test Confirm cleartext protocols (HTTP, Telnet, FTP, unencrypted SMTP/LDAP) are disabled or redirected to encrypted equivalents and that HSTS or equivalent transport enforcement is in place.

Examine Inspect the server certificate inventory to confirm certificates are unexpired, issued by a trusted CA, use approved key sizes/algorithms, and are tracked for renewal.

Interview Ask administrators how integrity of transmitted data is assured (e.g., TLS integrity/AEAD, message authentication) and how transmission-encryption failures or downgrades are monitored and alerted.

Examine Verify that internal service-to-service, replication, and administrative/management traffic (not only external-facing traffic) is encrypted in transit per policy (CIS Control 3.10).