| Trustmark Definition Name | Version |
|---|---|
|
Defines conformance and assessment criteria for verifying that an organization prohibits the use of sanitization-resistant media in organizational information systems.
|
1.0 |
|
Defines conformance and assessment criteria for verifying that an organization prohibits the use of portable storage devices in organizational information systems when such devices have no identifiable owner.
|
1.0 |
|
Defines conformance and assessment criteria for verifying that an information system implements organization-defined security safeguards to protect its memory from unauthorized code execution.
|
1.0 |
|
Specifies requirements in accordance with the DHS CISA Secure-by-Design Pledge, published by the U.S. Dept of Homeland Security (DHS) Cybersecurity and Infrastructure Agency (CISA). Requires an organization to develop and implement an organizational memory-safety roadmap to transition all of its product and service offerings to memory-safe languages.
|
1.0 |
|
Addresses the requirement for the methods used to publicize PKI certificate revocation to be described in the organization's approved Certificate Practices Statement (CPS)
|
1.0 |
|
Addresses the requirement for an organization's methods to publicize PKI certificate revocation to meet or exceed the requirements for CRL issuance stated in the corresponding certificate policy.
|
1.0 |
|
Addresses the requirement for an organization's methods to publicize PKI certificate revocation to meet or exceed the requirements for CRL latency stated in the corresponding certificate policy.
|
1.0 |
|
Addresses the requirement for an organization's methods for publicizing revoked PKI certificates to provide authentication services commensurate with the assurance level of the certificates being verified.
|
1.0 |
|
Addresses the requirement for an organization's methods for publicizing revoked PKI certificates to provide integrity services commensurate with the assurance level of the certificates being verified.
|
1.0 |
|
Specifies requirements in accordance with the DHS CISA Secure-by-Design Pledge, published by the U.S. Dept of Homeland Security (DHS) Cybersecurity and Infrastructure Agency (CISA). Requires an organization to enable multi-factor authentication (MFA) by default for all users and administrators upon first registration, across all of its product and service offerings.
|
1.0 |
|
Specifies requirements in accordance with the DHS CISA Secure-by-Design Pledge, published by the U.S. Dept of Homeland Security (DHS) Cybersecurity and Infrastructure Agency (CISA). Requires an organization to implement user prompts or reminders to encourage adoption of multi-factor authentication (MFA), e.g., through seat belt chimes, banners, interstitials, etc., across all of its product and service offerings.
|
1.0 |
|
Defines privacy requirements for the collection of sensitive information to be limited to information that is relevant to the purposes of collection.
|
1.0 |
|
Defines privacy requirements related to mechanisms used to destroy sensitive information.
|
1.0 |
|
Defines privacy requirements related to limitations on disclosure of sensitive information.
|
1.0 |
|
Defines privacy requirements related to the documentation of requested user information.
|
1.0 |
|
Defines privacy requirements for organizations to collect sensitive information by fair means.
|
1.0 |
|
Defines privacy requirements for organizations to transmit only those attributes required by the federal profile.
|
1.0 |
|
Defines privacy requirements for organizations to collect sensitive information by lawful means.
|
1.0 |
|
Defines privacy requirements related to limits on the collection of individuals' sensitive information.
|
1.0 |
|
Defines privacy requirements evaluate new activities and technologies that might impact personal privacy.
|
1.0 |
|
Defines privacy requirements related to mechanisms used to reduce the retention of sensitive information.
|
1.0 |
|
Defines privacy requirements for organizations to transmit only those attributes requested by relying parties.
|
1.0 |
|
Defines privacy requirements for documentation to distinguish between information needed to conduct authentication and any other information requested by a relying party.
|
1.0 |
|
Defines privacy requirements related to the deletion of sensitive information after calculation for statistical purposes.
|
1.0 |
|
Defines privacy requirements related limiting the collection of sensitive information.
|
1.0 |
