---
sourceDocument: Australia IT Operations Management
sourceDocumentLink: https://www.servicenow.com/docs/r/australia/it-operations-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia IT Operations Management

ft:clusterId :

    - itom

bundleId :

    - itom

workflow :

    - Technology


---

# Cryptographic risk indicators

# Cryptographic risk indicators {#ariaid-title1}

Release version: Australia  
Updated December 19, 2024  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
Risk indicators highlight cryptographic assets that need attention so you can prioritize remediation and track compliance.

Cryptographic Asset Compliance evaluates assets against policies and raises a risk indicator when an asset meets a risk condition. Risk indicators are based on policies, and each indicator points to a specific
weakness, such as a weak algorithm or a missing owner. For more information, see [About Policy as Code Engine policies](https://www.servicenow.com/docs/W4nQbVeuj1SNWRJN3m5ztQ "Cryptographic Asset Compliance uses Policy as Code Engine (PaCE) policies to evaluate your cryptographic assets and flag risk."). For more information about risk detection criteria, see [Risk indicator definitions](https://www.servicenow.com/docs/zMti4twrq~~ojRjbTY73yA "Risk indicators are used to identify security vulnerabilities and compliance issues in cryptographic assets.").

## Supported risk indicators {#risk-indicators-CAC__supported-indicators}

For certificates:

* Weak algorithm: Uses a deprecated or quantum-vulnerable algorithm.
* Trusted CA risk: Issued by an untrusted or unrecognized certificate authority. For more information, see [Configure trusted certificate authorities](https://www.servicenow.com/docs/K9uRIIq3PUSAu8EupSktTw "Configure certificate authorities (CAs) that your organization trusts and activate the certificate authority trust policy so that certificates from other authorities are flagged as untrusted.").
* No owner: Has no assigned owner or responsible party.
* No environment: Is not classified by environment.
* No renewal process: Has no defined renewal workflow.

{#risk-indicators-CAC__ul_hns_w3f_1kc}

For AWS KMS keys and Azure Key Vault keys:

* Weak algorithm: Uses a weak or insufficient algorithm or key size.
* Not PQC ready: Does not use a post-quantum-safe algorithm.
* Not rotated (AWS KMS keys): Has not been rotated within the recommended period.
* Pending deletion (AWS KMS keys): Is scheduled for deletion.
* Expired (Azure Key Vault keys): Is expired or lacks a proper expiration date.
{#risk-indicators-CAC__ul_j24_z3f_1kc}

## Risk levels {#risk-indicators-CAC__risk-levels}

Each asset is assigned an overall risk level, calculated from its active indicators. The available risk levels are:

* Critical: Severe vulnerabilities requiring immediate attention.
* High: Significant weaknesses that should be addressed promptly.
* Medium: Moderate concerns that require monitoring and planning.
* Protected: Quantum-safe, or no active risk indicators.
{#risk-indicators-CAC__ul_ahc_ljf_1kc}