@@ -1158,7 +1158,7 @@ The product shall not collect Personal Data unless the collection is necessary f
#### 5.9.3.1 Requirement
The VPN shall not send or store Personal Data outside of the endpoint related to its use, except for the minimum data strictly necessary in relation to the intended purpose of the product, such as for the confidentiality and availability of the service provision (e.g.,unique identifiers, IP addresses meant to ensure the security of the service) user authentication, access control (e.g., endpoint identification, IDP/OIDC integration) and subscription management. No Personal Data shall be collected as part of the core VPN tunnelling and routing functionality.
The VPN shall not send or store Personal Data related to its use outside of the endpoint, except for the minimum data strictly necessary in relation to the intended purpose of the product, such as for the confidentiality and availability of the service provision (e.g.unique identifiers, IP addresses meant to ensure the security of the service) user authentication, access control (e.g., endpoint identification, IDP/OIDC integration) and subscription management. No Personal Data shall be collected as part of the core VPN tunnelling and routing functionality.
#### 5.9.3.2 Applicability
@@ -1495,52 +1495,69 @@ The VPN client shall not require routing of traffic from sources/destinations ot
### 5.14.1 Overview
#### 5.14.1.1 CRA requirement
This clause addresses the requirements in the CRA [\[i.1\]](#_ref_i.1) Annex 1 Part 1 (2) (l).
The minium scope of cybersecurity-relevant events logged by the VPN client may include, but not limited to:
#### 5.14.1.2 Minimum scope
The minimum scope of cybersecurity-relevant events logged by the VPN client may include, but are not limited to:
* successful and failed authentication attempts,
* establishment, termination, or unexpected drops of the VPN connection,
* modifications to the VPN client's configuration or security settings,
* changes applied by the VPN client to the host system's network configuration technically relevant for the VPN service provision, or
* software update successes or failures.
Products are expected to exclude from logs any confidential information such as Personal Data, network traffic content, connection metadata (e.g., destination IPs, DNS queries), secrets, or credentials. Logs are to be retained locally on the endpoint; to comply with data minimization requirements, logs are not to be transmitted to the product’s remote data processing solutions by default. Transmission of local logs to remote data processing solutions (e.g., for technical support or troubleshooting) is unacceptable without explicit, informed user authorization (e.g. explicit opt-in).
#### 5.14.1.3 Monitoring restrictions
### 5.14.2 REQ-LOG-02 (MI-LOGG-1) Logging
Products with the capability to transmit logs to remote data processing solutions are expected to exclude from cybersecurity-relevant logs confidential information such as network traffic content, connection metadata (e.g., destination IPs, DNS queries), secrets, or credentials. Cybersecurity-relevant logs are to be retained locally on the endpoint; to comply with data minimization requirements, cybersecurity-relevant logs are not to be transmitted to the product’s remote data processing solutions by default. Transmission of cybersecurity-relevant local logs to remote data processing solutions (e.g., for technical support or troubleshooting) is unacceptable without explicit, informed user authorization (e.g. explicit opt-in).
#### 5.14.2.1 Requirement
> NOTE: For the purpose of the present clause, "cybersecurity-relevant logs" refers to security related information logged locally on the VPN client.
The product shall record log messages indicating specific cybersecurity-relevant internal events in an internal log in accordance with the requirement to monitor access or modification of data, services, or functions.
> NOTE: Certain cybersecurity-relevant events might still be transferred to the VPN manufactorer without explicit authorization from the user, if the event transmissions are required to fullfill the intended purpose of the product.
#### 5.14.2.2 Applicability
> NOTE: If not absolutely necessary, free text inputs should be omitted from log entries. Not only does this protect against log injection attacks, but also against accidentially logging sensitive data the user mistakenly entered.
### 5.14.TK REQ-LOG-TK (MI-LOGG-1) Local event logging
#### 5.14.TK.1 Requirement
1.**REQ-LOG-TK (MI-LOGG-1)-1** The product shall record log messages indicating specific cybersecurity-relevant events (as described in 5.14.1.2) in an internal log, and
2.**REQ-LOG-TK (MI-LOGG-1)-2** those log messages shall not include any of the information described in 5.14.1.3, and
3.**REQ-LOG-TK (MI-LOGG-1)-3** those log messages shall not be transmitted to the manufacturer without explicit user authorization unless required to fulfill the intended purpose of the product.
The minium scope of cybersecurity-relevant events logged by the VPN client may include, but not limited to:
#### 5.14.2.1 Requirement
* successful and failed authentication attempts,
* establishment, termination, or unexpected drops of the VPN connection,
* modifications to the VPN client's configuration or security settings,
* changes applied by the VPN client to the host system's network configuration technically relevant for the VPN service provision, or
* software update successes or failures.
1.**REQ-LOG-02 (MI-LOGG-1)-1** The product shall record log messages indicating specific cybersecurity-relevant events (as described in 5.14.1.2) in an internal log, and
2.**REQ-LOG-02 (MI-LOGG-1)-2** those log messages shall not include any confidential information such as secrets, or credentials.
The log messages shall not include any confidential information such as Personal Data, network traffic content, connection metadata (e.g., destination IPs, DNS queries), secrets, or credentials. These logs shall be retained locally on the endpoint. To comply with data minimization requirements, the VPN client shall not transmit these logs to the product’s remote data processing solutions by default. Transmission of local logs to the RDPS (e.g., for technical support or troubleshooting) shall require explicit, informed user authorization (e.g. explicit opt-in).
#### 5.14.2.2 Applicability
* UC-1: not required
* UC-2: not required
* UC-3: not required
* UC-4: not required
* UC-5: not required
* UC-6: required
* UC-7: not required
### 5.14.3 REQ-LOG-03 (MI-LOGG-2) Remote Logging
### 5.14.3 REQ-LOG-03 (MI-LOGG-2) Remote Logging to RDPS
#### 5.14.3.1 Requirement
1.**REQ-LOG-03 (MI-LOGG-2)-1** The product shall transfer log messages indicating cybersecurity-relevant internal events to a remote logging server, and
2.**REQ-LOG-03 (MI-LOGG-2)-2** the log messages shall not include any confidential information such as Personal Data, secrets, or credentials, or any information which might reasonably be expected to include such items.
1.**REQ-LOG-03 (MI-LOGG-2)-1** The product shall transfer log messages indicating cybersecurity-relevant events to a remote logging server, and
2.**REQ-LOG-03 (MI-LOGG-2)-2** the log messages shall not include any confidential information such as secrets, or credentials.
#### 5.14.3.2 Applicability
@@ -1579,7 +1596,8 @@ Logging output is expected to take care to not accidentally include a secret as
This clause provides assessment for the requirements in 5.14 relating to CRA [\[i.1\]](#_ref_i.1) Annex 1 Part 1 (2) (l).
### 6.14.2 REQ-LOG-02 (MI-LOGG-1) Logging
### 6.14.2 REQ-LOG-TK (MI-LOGG-1) Local event logging
#### 6.14.TK.1 Objective
Monitoring and recording cybersecurity-relevant events.
#### 6.14.TK.2 Preparation
Review the technical documentation to confirm the scope of cybersecurity-relevant events implemented in the logging mechanism.
#### 6.14.TK.3 Activities
For each type of cybersecurity-relevant event mentioned in 5.14.1.2:
1. trigger the event on the endpoint, and
2. collect any locally generated log messages recording the event, and
3. capture any packets being transmitted to the manufacturer.
#### 6.14.TK.4 Verdict
PASS if **all** of the following are fulfilled:
* at least one log message correlates to a cybersecurity-relevant event as listed in 5.14.1.2, and
* for each triggered event:
* the collected log message reflects the cybersecurity-relevant event,
* the log message indicating the event does not include any secrets, credentials, network traffic content or connection metadata as defined in 5.14.1.3, and
* the log message indicating the event is not transmitted to the manufacturer without explicit user authorization, or the technical documentation provides a clear justification as to how such a transmission is required to fulfill the intended purpose of the product.
Otherwise FAIL
#### 6.14.TK.5 Evidence
* Method of triggering events
* Log messages with annotations
* Packet captures demonstrating no unauthorized transmission of logs
