Delete REQ-SSD-05 (MI-IMSL) (26474e23) · Commits · STAN4CRA / EN 304 620 Virtual Private Networks Part 1

EN-304-620.md

+7 −8

Original line number	Diff line number	Diff line
		@@ -834,7 +834,7 @@ Requirements that mitigate this threat: REQ-SSD, REQ-EMM, REQ-LOG
		Mitigations for Likelihood:

		* Medium to Low: REQ-SSD-02 (MI-SSCA), REQ-SSD-06 (MI-SCFS)
		* High to Low: REQ-SSD-02 (MI-SSCA), (REQ-SSD-03 (MI-FZ95) or REQ-SSD-04 (MI-BTIN) or REQ-SSD-05 (MI-IMSL)), REQ-SSD-06 (MI-SCFS), REQ-EMM-02 (MI-NUTI-1), REQ-INT-05 (MI-NUTI-2)
		* High to Low: REQ-SSD-02 (MI-SSCA), (REQ-SSD-03 (MI-FZ95) or REQ-SSD-04 (MI-BTIN)), REQ-SSD-06 (MI-SCFS), REQ-EMM-02 (MI-NUTI-1), REQ-INT-05 (MI-NUTI-2)

		Mitigations for Impact:

		@@ -1388,7 +1388,7 @@ Table { seq tab }: Mapping of risks to requirements
		## D.3 _UC-3_ Journalist, activist, legal professionals

		* REQ-SSD-02 (MI-SSCA)
		* REQ-SSD-03 (MI-FZ95) or REQ-SSD-04 (MI-BTIN) or REQ-SSD-05 (MI-IMSL)
		* REQ-SSD-03 (MI-FZ95) or REQ-SSD-04 (MI-BTIN)
		* REQ-SSD-06 (MI-SCFS)
		* REQ-KEV-02 (MI-KEVT)
		* REQ-SBD-02 (MI-CONF-5)
		@@ -1397,7 +1397,7 @@ Table { seq tab }: Mapping of risks to requirements
		## D.4 _UC-4_ Small enterprise, small not-for-profit organization

		* REQ-SSD-02 (MI-SSCA)
		* REQ-SSD-03 (MI-FZ95) or REQ-SSD-04 (MI-BTIN) or REQ-SSD-05 (MI-IMSL)
		* REQ-SSD-03 (MI-FZ95) or REQ-SSD-04 (MI-BTIN)
		* REQ-SSD-06 (MI-SCFS)
		* REQ-KEV-02 (MI-KEVT)
		* REQ-SBD-02 (MI-CONF-5)
		@@ -1406,7 +1406,7 @@ Table { seq tab }: Mapping of risks to requirements
		## D.5 _UC-5_ Large enterprise

		* REQ-SSD-02 (MI-SSCA)
		* REQ-SSD-03 (MI-FZ95) or REQ-SSD-04 (MI-BTIN) or REQ-SSD-05 (MI-IMSL)
		* REQ-SSD-03 (MI-FZ95) or REQ-SSD-04 (MI-BTIN)
		* REQ-SSD-06 (MI-SCFS)
		* REQ-KEV-02 (MI-KEVT)
		* REQ-SBD-02 (MI-CONF-5)
		@@ -1415,14 +1415,14 @@ Table { seq tab }: Mapping of risks to requirements
		## D.6 _UC-6_ Enterprise with independent VPN infrastructure

		* REQ-SSD-02 (MI-SSCA)
		* REQ-SSD-03 (MI-FZ95) or REQ-SSD-04 (MI-BTIN) or REQ-SSD-05 (MI-IMSL)
		* REQ-SSD-03 (MI-FZ95) or REQ-SSD-04 (MI-BTIN)
		* REQ-SSD-06 (MI-SCFS)
		* REQ-KEV-02 (MI-KEVT)

		## D.7 _UC-7_ Mesh Network

		* REQ-SSD-02 (MI-SSCA)
		* REQ-SSD-03 (MI-FZ95) or REQ-SSD-04 (MI-BTIN) or REQ-SSD-05 (MI-IMSL)
		* REQ-SSD-03 (MI-FZ95) or REQ-SSD-04 (MI-BTIN)
		* REQ-SSD-06 (MI-SCFS)
		* REQ-KEV-02 (MI-KEVT)
		* REQ-SBD-02 (MI-CONF-5)
		@@ -1435,7 +1435,6 @@ Table { seq tab }: Mapping of risks to requirements
		\| REQ-SSD-02 (MI-SSCA) \| x \| x \| x \| x \| x \| x \| x \|
		\| REQ-SSD-03 (MI-FZ95) \| \| \| x¹ \| x¹ \| x¹ \| x¹ \| x¹ \|
		\| REQ-SSD-04 (MI-BTIN) \| \| \| x¹ \| x¹ \| x¹ \| x¹ \| x¹ \|
		\| REQ-SSD-05 (MI-IMSL) \| \| \| x¹ \| x¹ \| x¹ \| x¹ \| x¹ \|
		\| REQ-SSD-06 (MI-SCFS) \| x \| x \| x \| x \| x \| x \| x \|
		\| REQ-KEV-02 (MI-KEVT) \| x \| x \| x \| x \| x \| x \| x \|
		\| REQ-SSD-07 \| x \| x \| x \| x \| x \| \| x \|
		@@ -1507,7 +1506,7 @@ Table { seq tab }: Mapping of risks to requirements
		\| REQ-DRT-04 (MI-SDRF) \| \| \| x \| x \| x \| x \| x \|
		\| REQ-DRT-05 (MI-SDTR) \| \| x \| \| x \| x \| x \| \|

		¹ REQ-SSD-03 (MI-FZ95) or REQ-SSD-04 (MI-BTIN) or REQ-SSD-05 (MI-IMSL) apply
		¹ REQ-SSD-03 (MI-FZ95) or REQ-SSD-04 (MI-BTIN) apply
		² REQ-SU-02 (MI-KEVD) or REQ-SU-03 (MI-KEVA) apply
		³ REQ-SU-05 (MI-SUVP) or REQ-SU-06 (MI-SUAP) or REQ-SU-08 (MI-SUOE) or REQ-SU-09 (MI-SUAO) apply
		⁴ REQ-SU-06 (MI-SUAP) or REQ-SU-09 (MI-SUAO) apply

clauses/5.Requirements.md

+15 −31

Original line number	Diff line number	Diff line
		@@ -18,9 +18,11 @@ This clause addresses the requirements in the CRA [\[i.1\]](#_ref_i.1) Annex 1 P

		In alignment with the Cyber Resilience Act Annex I Part I (1), this section addresses overarching risks and mitigations regarding the secure design and development of the product that are not specifically treated by other categorical essential requirements (such as confidentiality, access control, or security updates). The requirements herein ensure the final product itself embodies security by design.

		#### 5.2.1.2 Secure software design and development (MI-SSCA, MI-FZ95, MI-BTIN, MI-IMSL)
		#### 5.2.1.2 Secure software design and development (MI-SSCA, MI-FZ95, MI-BTIN)

		Use cases (as described in [clause 4.6](#use-cases) and [annex B](#annex-b-informative-security-analysis)) determine which of these controls should be utilized to mitigate threats around secure software design and development. In particular, across all use cases only one—at most—of the following three is called for when applied to a single product: REQ-SSD-03 (MI-FZ95), REQ-SSD-04 (MI-BTIN), REQ-SSD-05 (MI-IMSL). See B.TK for more information.
		Use cases (as described in [clause 4.6](#use-cases) and [annex B](#annex-b-informative-security-analysis)) determine which of these controls should be utilized to mitigate threats around secure software design and development. In particular, across all use cases only one—at most—of the following two is called for when applied to a single product: REQ-SSD-03 (MI-FZ95) or REQ-SSD-04 (MI-BTIN). See B.TK for more information.

		[//]: # (TODO link B.TK above)

		#### 5.2.1.3 Compilation mitigation mechanisms (MI-SCFS)

		@@ -65,11 +67,11 @@ In addition to memory safety, compiled software is a potential target based on p

		* UC-1: not required
		* UC-2: not required
		* UC-3: REQ-SSD-03 (MI-FZ95) or REQ-SSD-04 (MI-BTIN) or REQ-SSD-05 (MI-IMSL) apply
		* UC-4: REQ-SSD-03 (MI-FZ95) or REQ-SSD-04 (MI-BTIN) or REQ-SSD-05 (MI-IMSL) apply
		* UC-5: REQ-SSD-03 (MI-FZ95) or REQ-SSD-04 (MI-BTIN) or REQ-SSD-05 (MI-IMSL) apply
		* UC-6: REQ-SSD-03 (MI-FZ95) or REQ-SSD-04 (MI-BTIN) or REQ-SSD-05 (MI-IMSL) apply
		* UC-7: REQ-SSD-03 (MI-FZ95) or REQ-SSD-04 (MI-BTIN) or REQ-SSD-05 (MI-IMSL) apply
		* UC-3: REQ-SSD-03 (MI-FZ95) or REQ-SSD-04 (MI-BTIN) apply
		* UC-4: REQ-SSD-03 (MI-FZ95) or REQ-SSD-04 (MI-BTIN) apply
		* UC-5: REQ-SSD-03 (MI-FZ95) or REQ-SSD-04 (MI-BTIN) apply
		* UC-6: REQ-SSD-03 (MI-FZ95) or REQ-SSD-04 (MI-BTIN) apply
		* UC-7: REQ-SSD-03 (MI-FZ95) or REQ-SSD-04 (MI-BTIN) apply

		### 5.2.4 REQ-SSD-04 (MI-BTIN) Boundary testing of inputs that may cause memory errors

		@@ -81,28 +83,11 @@ The product's technical documentation shall record any memory errors along with

		* UC-1: not required
		* UC-2: not required
		* UC-3: REQ-SSD-04 (MI-BTIN) or REQ-SSD-03 (MI-FZ95) or REQ-SSD-05 (MI-IMSL) apply
		* UC-4: REQ-SSD-04 (MI-BTIN) or REQ-SSD-03 (MI-FZ95) or REQ-SSD-05 (MI-IMSL) apply
		* UC-5: REQ-SSD-04 (MI-BTIN) or REQ-SSD-03 (MI-FZ95) or REQ-SSD-05 (MI-IMSL) apply
		* UC-6: REQ-SSD-04 (MI-BTIN) or REQ-SSD-03 (MI-FZ95) or REQ-SSD-05 (MI-IMSL) apply
		* UC-7: REQ-SSD-04 (MI-BTIN) or REQ-SSD-03 (MI-FZ95) or REQ-SSD-05 (MI-IMSL) apply

		### 5.2.5 REQ-SSD-05 (MI-IMSL) Implement in a memory-safe language

		#### 5.2.5.1 Requirement

		1. REQ-SSD-05 (MI-IMSL)-1 The product shall employ implementation practices, tooling, or language features that mitigate memory corruption vulnerabilities, and
		2. REQ-SSD-05 (MI-IMSL)-2 any use of unsafe memory features in the product’s own code has corresponding evidence of both necessity and the specific mitigations applied to reduce residual risk.

		#### 5.2.5.2 Applicability

		* UC-1: not required
		* UC-2: not required
		* UC-3: REQ-SSD-05 (MI-IMSL) or REQ-SSD-03 (MI-FZ95) or REQ-SSD-04 (MI-BTIN) apply
		* UC-4: REQ-SSD-05 (MI-IMSL) or REQ-SSD-03 (MI-FZ95) or REQ-SSD-04 (MI-BTIN) apply
		* UC-5: REQ-SSD-05 (MI-IMSL) or REQ-SSD-03 (MI-FZ95) or REQ-SSD-04 (MI-BTIN) apply
		* UC-6: REQ-SSD-05 (MI-IMSL) or REQ-SSD-03 (MI-FZ95) or REQ-SSD-04 (MI-BTIN) apply
		* UC-7: REQ-SSD-05 (MI-IMSL) or REQ-SSD-03 (MI-FZ95) or REQ-SSD-04 (MI-BTIN) apply
		* UC-3: REQ-SSD-04 (MI-BTIN) or REQ-SSD-03 (MI-FZ95) apply
		* UC-4: REQ-SSD-04 (MI-BTIN) or REQ-SSD-03 (MI-FZ95) apply
		* UC-5: REQ-SSD-04 (MI-BTIN) or REQ-SSD-03 (MI-FZ95) apply
		* UC-6: REQ-SSD-04 (MI-BTIN) or REQ-SSD-03 (MI-FZ95) apply
		* UC-7: REQ-SSD-04 (MI-BTIN) or REQ-SSD-03 (MI-FZ95) apply

		### 5.2.6 REQ-SSD-06 (MI-SCFS) Secure compilation flags

		@@ -154,11 +139,10 @@ This requirement does not apply to UC-6 because by definition that use case does
		\| REQ-SSD-02 (MI-SSCA) \| x \| x \| x \| x \| x \| x \| x \|
		\| REQ-SSD-03 (MI-FZ95) \| \| \| x¹ \| x¹ \| x¹ \| x¹ \| x¹ \|
		\| REQ-SSD-04 (MI-BTIN) \| \| \| x¹ \| x¹ \| x¹ \| x¹ \| x¹ \|
		\| REQ-SSD-05 (MI-IMSL) \| \| \| x¹ \| x¹ \| x¹ \| x¹ \| x¹ \|
		\| REQ-SSD-06 (MI-SCFS) \| x \| x \| x \| x \| x \| x \| x \|
		\| REQ-SSD-07 \| x \| x \| x \| x \| x \| \| x \|

		¹ REQ-SSD-03 (MI-FZ95) or REQ-SSD-04 (MI-BTIN) or REQ-SSD-05 (MI-IMSL) apply
		¹ REQ-SSD-03 (MI-FZ95) or REQ-SSD-04 (MI-BTIN) apply

		## 5.3 No known exploitable vulnerabilities

clauses/6.Assessment-Criteria.md

+0 −28

Original line number	Diff line number	Diff line
		@@ -165,34 +165,6 @@ Otherwise FAIL
		* Memory error report
		* Documentation of any memory errors

		### 6.2.5 REQ-SSD-05 (MI-IMSL) Implement in a memory-safe language

		#### 6.2.5.1 Objective

		Prevent unauthorized memory access.

		#### 6.2.5.2 Preparation

		None.

		#### 6.2.5.3 Activities

		Review source code to determine its language and what exceptions to memory safety exist

		#### 6.2.5.4 Verdict

		PASS if all of the following are fulfilled:

		* The product employs implementation practices, tooling, or language features that mitigate memory corruption vulnerabilities, and
		* each instance of unsafe memory features in the product’s own code or in dependencies has corresponding documentation demonstrating evidence of necessity, and that the applied mitigations reduce the residual cybersecurity risk to an acceptable level.

		Otherwise FAIL

		#### 6.2.5.5 Evidence

		* Source code
		* Documentation of unsafe memory features

		### 6.2.6 REQ-SSD-06 (MI-SCFS): Secure compilation flags

		#### 6.2.6.1 Objective