Safety inspections and verification

The security audit shall go into the details of the system to the level that it considers to provide sufficient and relevant evidence within the scope established for the audit.

The National Cryptologic Center carries out security inspections that allow verifying the security implemented in a System and that the services and resources used comply with the minimum specified and required in the security policy (especially in all those systems that handle classified information) within the established security audit process.

The scope of the audit is determined by the scope, objective, activities to be performed, means and techniques to be applied which, together with periodicity, translate into different types of inspection in accordance with the attached table. The levels indicated are a response to compliance by the safety government (Levels 1 and 2) and to the technical audit (Levels 3, 4 and 5).

Types of Safety Inspections

	LEVEL 1	LEVEL 2	LEVEL 3*	LEVEL 4	LEVEL 5
REACH	Knowledge of the governance of the System security	Improved "global" security management	Objective recognition that the System operates within the defined security framework	Real and complete" knowledge of the criticality and risk of the System.	Real and estimated" knowledge of the criticality and risk of the System.
SCOPE	Element (product, service, device, application...) and System	Element (product, service, device, application...) and System	Element (product, service, device, application...), System and Interconnection	Element (product, service, device, application...), System and Interconnection	Element (product, service, device, application...), System and Interconnection
OBJECTIVE	Determine the services provided and System architecture	Determine the properties and safety functions of the System	Determine the level of security of a System and its degree of compliance with the security policy. Assessment of system configuration and existing vulnerabilitie	Get to know the system configuration, the area of exposure to vulnerabilities, and existing threats	Get to know the area of exposure to existing vulnerabilities and threats
ACTIVITIES	Analysis	Analysis Manual Verification	Analysis Manual Verification Automatic Verification Safety assessment	Analysis Manual Verification Automatic Verification White Box Security Test	Analysis Manual Verification Automatic Verification Black Box Intrusion Test
MEDIA AND TECHNIQUES	Review Documentation	Review Documentation Configuration Management Questionnaires (ST&E Plan) Interviews	Review Documentation Configuration Management Questionnaires (ST&E Plan) Interviews Security Tools	Vulnerability analysis and system security assessment tools and techniques	Asset identification tools and vulnerability assessment and exploitation techniques
PERIODICITY	Periodic and in accordance with the Security Policy, Accreditation Procedure and Corrective Action Plan.	Periodic and in accordance with the Security Policy, Accreditation Procedure and Corrective Action Plan.	Periodic and in accordance with the Security Policy, Accreditation Procedure and Corrective Action Plan.	Exceptionally, depending on the sensitivity of the system, or periodically if so established by the security policy.	Exceptionally, depending on the sensitivity of the system, or periodically if so established by the security policy.