Scope
- Questions
- 7 in the full check
- Stored
- Nothing
- Uses
- Clause 1, the two named functions and the evidence list
- Date
- The estimate, labelled
Is ISO/IEC 11770-8 your problem?
Clause 1 applies where a cryptographic key is derived from a human-memorised password. Answer seven questions and the reading names your scope, the gaps your answers expose and the dates that follow. An untouched form returns scope incomplete.
How the reading is decided
The engine is a rule, not a model. It reads your answers against the scope in clause 1, the two functions named in the public introduction, and the evidence list in the register. The same answers always produce the same reading. The table below is the regression set the build tests; each row cites the part of the record that justifies it.
The two named functions are Argon2i and PBKDF2. A profile that ticks Argon2id, scrypt, bcrypt or a proprietary function returns in scope with a gap: the public introduction names two functions, and the other is a decision to record, not a synonym.
| Profile | Reading | Basis |
|---|---|---|
| Derives a key from a password, uses Argon2i or PBKDF2, salt and parameters evidenced | In scope, hold and watch | Clause 1; clauses 6 and 7 |
| Derives a key, uses PBKDF2, no written parameter record | In scope, gaps to close | Clause 7; Annex D |
| Derives a key, uses Argon2id and records it as Argon2i | In scope, gaps to close | Clause 6 (Argon2i named, not Argon2id) |
| Derives a key, function not identified | In scope, gaps to close | Clause 5; the public introduction |
| Derives a key, salt reused across devices | In scope, gaps to close | Clause 3.5, salt |
| Derives a key, inventory only covers the backup product | In scope, gaps to close | Clause 1; clause 5 |
| Unsure whether a password produces a key | Likely in scope, confirm | Clause 1 |
| No password-derived key; login hashing only | Out of scope on your answers | Clause 1 |
| No answers at all | Scope incomplete | The check refuses to pass an untouched form |
| Password-derived key protects a backup only | In scope, gaps to close if parameters are missing | Clause 1; Annex D |
| Four functions in use across three products | In scope, gaps to close until each is recorded | Clauses 6 and 7; clause 5 |
| Argon2i on a phone, no benchmark on the weakest device | In scope, gaps to close | Annex D guidance; clause 5 |
| PBKDF2 with a library default count | In scope, gaps to close | Clause 7; Annex D |
| Key derived once and never re-derived after a device swap | In scope, gaps to close | Clause 5, use decision |
| Salt treated as a secret pepper and lost in a restore | In scope, gaps to close | Clause 3.5 |
| No ISMS but a complete parameter record | In scope, hold and watch, with a SHOULD on evidence location | No ISMS requirement in the part |
| Supplier questionnaires answered from memory | In scope, gaps to close | Clause 5; the kit answer pack |
| A proprietary KDF with a design note | In scope, gaps to close | The public introduction names two functions |
| Keys derived from machine-generated device secrets, not passwords | Out of scope on the password test | Clause 1 |
| A password manager wrapping a vault key | In scope, gaps to close | Clause 1; clauses 6 and 7 |
| An encrypted backup with a passphrase and a printed recovery key | In scope, gaps to close | Clause 1; clause 5 |
| Argon2i with parameters copied from a vendor blog | In scope, gaps to close | Annex D guidance |
| A key derived from a password and then used as an HMAC key | In scope, gaps to close | Clause 1, key used by another algorithm |
| Unsure which of five products derive keys | Likely in scope, confirm | Clause 1; clause 5 |
What the check does not do
- It does not read your code, your configuration or your cloud account. It reads your answers.
- It does not call an answer compliant, certified or audit-ready. The phrases are scope readings.
- It does not treat an unknown as a pass. Unknown inputs return scope incomplete or likely in scope.
- It does not create a deadline. The date is an estimate for planning.
If the answer is "in scope"
The register is the next read. Each of the 11 units carries its public status, the requirement where the public record proves one, our reading where it does not, the evidence a reviewer will ask for and a test you can run. The kit turns those rows into a dated plan you can hand to an owner.