TLS · appears in CAIQ, SIG, ISO 27001, SOC 2
Is the public web endpoint protected by a valid TLS certificate from a trusted CA?
A valid current TLS certificate is the baseline for data in transit. Expiry, weak chain, or hostname mismatch break HTTPS and fail PCI 4.2.1 / SOC 2 CC6.1.
How to answer this
Whichever verdict your domain earns, this is the wording to put in the response box. Reviewers mark an answer down for vagueness more often than for a "No", so say which state you are in and what evidences it.
- Yes
- The public web endpoint serves a valid, trusted TLS certificate
- Partial
- The certificate is presented but with warnings (chain, expiry, or hostname)
- No
- The public web endpoint has TLS certificate problems
Controls this evidences
| Framework | Control | Why it maps |
|---|---|---|
| SOC 2 | CC6.1 | TLS certificate validity is a precondition for encrypted transport. |
| ISO 27001 | A.8.24 | Network controls — encrypted transport. |
| NIST 800-53 | SC-8(1) | — |
Domain Posture is not an audit and does not replace an auditor. See methodology v1 for how each verdict is reached.
When a "Yes" stops being true
Certificate expired, entered the expiry alert window, chain broke, or hostname mismatch appeared.
That is the whole problem with answering a questionnaire from a screenshot: the answer was true the day you took it. A signed evidence pack is dated, and a schedule re-checks it so you find out before your reviewer does.