Executive baseline
Secure enterprise communication is not a single encryption feature. It emerges from an evidenced chain of governance, identity, endpoint, session, authorisation, content protection, revocation, recovery and auditability. This baseline turns that chain into testable procurement and pilot questions.
- A claim counts only with a stated protection scope, boundary and evidence.
- The safe state must survive loss, role change and disruption.
- Maximum values and negative tests matter more than averages alone.
Method and source logic
VENTEX maps NIST CSF 2.0, NIST SP 800-63B-4, NIST SP 800-61 Rev. 3, ENISA's NIS2 Technical Implementation Guidance, current BSI secure-messenger material and RFC 9420 to an operational communication workflow. The sources are not treated as equivalent certification catalogues; each informs a different part of the control model.
The twelve controls
Each control requires an objective, accountable process, observable system state, negative test and reproducible evidence artefact. A checkbox without an observable outcome does not satisfy the baseline.
- 01 Governance and protection scope
- 02 Identity binding and enrolment
- 03 Phishing-resistant authentication
- 04 Device register and trust state
- 05 Session binding, rotation and reauthentication
- 06 Roles, least privilege and critical approval
- 07 Content protection and metadata boundaries
- 08 Key lifecycle and group changes
- 09 Integrity, delivery and synchronisation
- 10 Revocation and incident response
- 11 Continuity and controlled recovery
- 12 Audit, retention and privacy
Identity is a lifecycle
Evaluation does not begin at sign-in or end after successful MFA. Enrolment, binding additional authenticators, recovery, reauthentication, prompt invalidation and traceable lifecycle events belong together. For high-risk contexts, the organisation must define the required assurance and phishing-resistant methods.
Endpoints and sessions
An authorised user on an endpoint that is no longer trusted is not a safe state. Devices must therefore be visible, individually revocable and linked to sessions, refresh state and security-relevant events. Testing ends only when old API, realtime, file and reauthentication paths are consistently rejected.
Cryptography with a stated boundary
Transport encryption, local storage and end-to-end protection answer different questions. Group communication additionally requires traceable membership and key changes. A provider must disclose which content is protected, which metadata remains visible, how new devices become authorised and what can recover after compromise.
Incident communication under pressure
NIST and ENISA treat incident response as part of ongoing risk management, not an isolated emergency activity. For communication platforms this means named alternate channels, exercised roles, visible decisions, evidence-preserving timelines, stop criteria and a controlled path back to normal operation.
Evidence pack for pilot and procurement
A defensible assessment collects more than screenshots. It includes system boundary, data flow, role model, test accounts, scenario scripts, target values, negative tests, maximum revocation latency, recovery record, deviation register and claim ledger. Untested areas remain visibly open.
- Can one device be fully revoked?
- Do group changes remain cryptographically and operationally consistent?
- Are metadata, backups and administrator access explicitly bounded?
- Is recovery exercised in practice and measured over time?
- Can security claims be traced to current artefacts?
Maturity without false precision
The baseline does not issue a universal total score. For each control, an organisation records four states: undefined, defined, technically observed and verified under disruption. A critical open path must not be hidden by strong averages elsewhere.
Next replication step
The baseline is published as an open working foundation. The next defensible step is independently supervised application to synthetic scenarios with pre-defined targets, followed by publication of method, deviations and negative results. Only then does comparable field evidence emerge.