Crypto Algorithm Audit

Identifies deprecated/weak cryptographic algorithms (MD5, SHA-1, DES, RC4, Blowfish).


Short name	Crypto Audit
Region	Internal
Country or scope	Internal
Sector	General
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers Crypto Audit

Scan requirements: 4, all decided by a scan.
Controls: the scan requirements below, plus 8 controls from Safeguard's control catalog for Crypto Audit.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 25: 3 written for Crypto Audit and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 4 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`CRYPTO-AUDIT-1` Cryptographic Library Identification	Identify all cryptographic libraries in the supply chain	Scan
`CRYPTO-AUDIT-2` Weak Algorithm Detection	Detect weak hash algorithms in component hashes	Scan
`CRYPTO-AUDIT-3` Strong Algorithm Verification	Verify use of strong cryptographic algorithms	Scan
`CRYPTO-AUDIT-4` Crypto Library Versioning	Cryptographic libraries require version info for CVE assessment	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`CRYPTO-01`	Deprecated Algorithm Detection: MD5
`CRYPTO-02`	Deprecated Algorithm Detection: SHA-1
`CRYPTO-03`	Deprecated Algorithm Detection: DES / 3DES
`CRYPTO-04`	Deprecated Algorithm Detection: RC4 / Blowfish
`CRYPTO-05`	Key Length Minima Enforcement
`CRYPTO-06`	Algorithm Transition Plan
`CRYPTO-07`	Post-Quantum Readiness Assessment
`CRYPTO-08`	Random Number Generator Quality

Policy templates

Written for Crypto Audit:

Cryptographic Algorithm Lifecycle Policy
Post-Quantum Cryptography Readiness Policy
Cryptographic Implementation and Code Review Policy

And 22 from the standard set, adapted to Crypto Audit.