What it asks for. This category, previously named Sensitive Data Exposure, focuses on failures related to cryptography that expose sensitive data. Examples include transmitting data in clear text, using old or weak algorithms or protocols, default or weak keys, missing certificate validation, poor randomness and storing passwords with fast or unsalted hashes.
In practice. Organisations classify data to know what needs protection, encrypt sensitive data in transit and at rest with current algorithms, manage keys properly and avoid storing sensitive data that is not needed. Passwords are stored with adaptive, salted hashing. Evidence includes cryptographic standards, TLS configuration scans, key management procedures and data classification records.
Common gaps. Internal traffic is often left unencrypted on the assumption that the network is trusted. Key management, rather than the algorithm, is frequently the weak point.