IFG, LLC · Step Zero℠
Coverage Declaration
Cryptographic inventory, The Read. Declaration of examination scope, method, window and residual.
- Client
- Example Regional Bank (fictional)
- Estate segment
- Cardholder data environment and directly connected systems
- Examination window
- 2026-07-06 00:00 UTC to 2026-07-24 23:59 UTC
- Inventory artifact
- CBOM, CycloneDX 1.7, serial urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79
- Examiner
- IFG, LLC
1. Scope limitation
This declaration describes an examination, not the estate. Statements below that an asset is present or absent apply only to the surfaces listed, by the methods listed, within the window above. Surfaces marked Not Sampleable were not examined, and no inference about their contents should be drawn from this document or the accompanying inventory.
2. Surfaces and outcomes
| Surface | Method | State | Note |
|---|---|---|---|
| External TLS endpoints | Network observation | Observed present | RSA-2048 and ECDSA P-256 certificates; no hybrid post-quantum key exchange offered |
| Internal service mesh (mTLS) | Configuration review and observation | Observed present | Private CA, ECDSA P-256 leaf certificates |
| Payment application source | Static analysis | Observed present | AES-256-GCM, SHA-256; one SHA-1 use in a legacy signature check |
| SSH host keys, retired subnet | Network observation | Observed absent | Subnet reached; no SSH listeners |
| Ephemeral workload certificates | — | Not sampleable | Issued and expired between observations in this window |
| Vendor-managed HSM partitions | — | Not sampleable | Outside the access grant |
3. Residual register
- Catalog
Third-party appliances with no published cryptographic configuration. Firmware images for two card-terminal models were not supplied.
- Detection
Static analysis does not resolve cryptographic calls made through reflection or runtime-loaded providers.
- Temporal
Assets whose whole lifetime fell between observations, including short-lived batch-job credentials.
4. Independence
IFG, LLC holds no remediation product and receives no remediation revenue from the client or any vendor named in the inventory. The residual register is declared by the examiner and was not edited by the client.
This is a fictional example prepared to show the format of a coverage declaration. It does not describe any real organization, estate or engagement. To print or save as PDF, use your browser's print command.