S/MIME
What is S/MIME?
Secure/Multipurpose Internet Mail Extensions, a standard for public key encryption and signing of email messages to ensure confidentiality, integrity, and authentication.
Terms that appear alongside s/mime
Each of these is named in at least one of the same controls as s/mime. The number is how many controls name both.
- fips 4 shared controls
- nist 4 shared controls
- tls 4 shared controls
- ipsec 3 shared controls
- post quantum cryptography 2 shared controls
- pki 2 shared controls
- audit trail 2 shared controls
- audit 2 shared controls
Frameworks that govern s/mime
What the standards actually require on s/mime
Requirements naming s/mime across 6 standards, quoted from the control text.
Versions of S/MIME earlier than S/MIME version 3.0 are not used for S/MIME connections.
ISM-0490 · Minimum S/MIME version →When faulty or redundant equipment is decommissioned, this must be done in line with the media sanitisation requirements set out in Chapter 12, Product Security.
new-zealand-information-security-manual-nzism::17.6.6.C.01 · 17.6.6.C.01 Sanitise decommissioned S/MIME equipment →Security Dimension 3 Non-Repudiation per X.805 Clause 6.3: Non-repudiation stops a person or entity from credibly denying that it carried out a given action on data, by keeping evidence of network-related actions available (for example evidence of an obligatio...
X805-Dim3-Non-Repudiation-Proof-Origin-Delivery-Sender-Receiver-Denial-Prevention · ITU-T X.805 Security Dimension 3 - Non-Repudiation + Proof of Origin + Proof of Delivery + Sender + Receiver Denial Prevention + Digital Signatures + Timestamping + Audit Logs + Forensic Evidence + Court-Admissible Records →Sections 9.1-9.2 of IRS Publication 1075 establish FTI-specific requirements that are NOT covered by NIST SP 800-53 but are specific to the IRS FTI protection regime.
IRSPub1075-Section91-92-FTI-Specific-Recordkeeping-Disclosure-Transmission-Restriction-MinSafeguards · IRS Publication 1075 Sections 9.1-9.2 + FTI-Specific Requirements + Recordkeeping + Disclosure Restrictions + Transmission Requirements + Minimum Protection Standards + Printing + Inventory + Destruction →Vulnerability information passed between reporters, vendors and coordinators should be protected while in transit, the vendor offering secure options such as email encrypted with a published key or a web form served over an encrypted connection, so that report...
iso-iec-29147-2018::5.8.2 · 5.8.2 Secure communications →ADatP-4778.1 chapter 5 (guidance, but stated as shall for those who canonicalize): before signature generation or verification each data object is converted to a canonical form;
nato-stanag-4774-confidentiality-metadata-labels-and-stanag-4778-metadata-binding::4778.1-5 · Canonicalize data before signing or verifying bindings →Questions people ask about s/mime
What is S/MIME?
Why is S/MIME important for compliance?
Which compliance frameworks address S/MIME?
Where can I learn more about S/MIME?
See how S/MIME applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.