SC-28(01) Cryptographic Protection

Self-assessed, not audited

We hold no certification or authorization. The status below is our own assessment, kept as OSCAL in Git; it is not an auditor's finding. "Planned" means not built.

Control statement

Implement cryptographic mechanisms to prevent unauthorized disclosure and modification of the following information at rest on [Assignment: system components or media]: [Assignment: information].

Guidance

The selection of cryptographic mechanisms is based on the need to protect the confidentiality and integrity of organizational information. The strength of mechanism is commensurate with the security category or classification of the information. Organizations have the flexibility to encrypt information on system components or media or encrypt data structures, including files, records, or fields.

Implementation

Talos node

Cryptographic protection with LUKS2, key sealed to PCR 7 with checkSecurebootStatusOnEnroll. Partial: on the lab the TPM is a software swtpm, and the crypto (Linux dm-crypt as shipped in Talos) is not a FIPS 140-validated module.

Status: partial.

Evidence:

• https://github.com/zeta-reticuli-inc/talos-multicloud/blob/main/talos/patches/tpm-encryption.yaml
• https://github.com/zeta-reticuli-inc/talos-multicloud/blob/main/ARCHITECTURE.md

All controls. Source: OSCAL component definition reti-platform and NIST SP 800-53 Rev 5 (public domain).