Contributions
Implementation examples
Every example is tied to a specific control and, ideally, to the individual assessment objectives it claims to satisfy. Verdicts and reasoning are attached to each one.
3 examples referencing Secrets vault
- IA.L2-3.5.10[a] [b]
Salted hashes at rest, no cleartext protocols on the wire, and a CI check against logging secrets
AO coverage. Addresses both Cryptographically-protected Passwords objectives — storage and transit — for the directories, applications, and network devices in scope. Storage. The directory stores…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - IA.L2-3.5.8[a] [b]
24 remembered generations, one-day minimum age, and random vault secrets for shared accounts
AO coverage. Addresses both Password Reuse objectives: the number of generations is specified, and reuse is prevented across them. Specified generations. 24 for domain and IdP accounts, matching the…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - IA.L2-3.5.7[a] [b] [c]
Passphrase floor with a program-name banned list; character-change only where the DC sees it
AO coverage. Claims [a] (complexity requirements defined), [b] (change-of-character requirements defined), and [c] (complexity enforced when new passwords are created). Objective [d]…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet