Editorial: renumber clause 6

This clause provides assessment for the requirements in [clause 5.2](#appropriate-level-of-cybersecurity) relating to CRA [\[i.1\]](#_ref_i.1) Annex I Part 1 (1).

### 6.2.3 [REQ-SSD-01](#REQ-SSD-01) Memory access error prevention

### 6.2.2 [REQ-SSD-01](#REQ-SSD-01) Memory access error prevention

#### 6.2.3.0 Overview

#### 6.2.2.0 Overview

This requirement can be satisfied by using one of several methods identified by unique numbers. After selecting one method, carry out the corresponding numbered step within each section of this assessment. Only one method is necessary to complete the assessment.

#### 6.2.3.1 Objective

#### 6.2.2.1 Objective

Prevent unauthorized memory access.

#### 6.2.3.2 Preparation

#### 6.2.2.2 Preparation

None.

#### 6.2.3.3 Activities

#### 6.2.2.3 Activities

Carry out one of the following methods. Only one method is necessary to complete the assessment.

Method 4: Review source code to determine its language and what exceptions to memory safety exist. For each use of memory-unsafe features or code, provide documentation demonstrating that it does not constitute an unacceptable risk.

#### 6.2.3.4 Verdict

#### 6.2.2.4 Verdict

Choose the method with the same number as the method used to carry out the Activities. Only one method is necessary to complete the assessment.

Otherwise FAIL

#### 6.2.3.5 Evidence

#### 6.2.2.5 Evidence

Choose the method with the same number as the method used to carry out the Activities. Only one method is necessary to complete the assessment.

* Source code

* Documentation of unsafe memory features

#### 6.2.3.6 Guidance for “risk-based approach”

#### 6.2.2.6 Guidance for “risk-based approach”

The test scope should be selected based on a risk-based approach. This includes considering the product’s intended use and prioritizing functions and interfaces that process untrusted inputs, provide access to security-relevant assets, or execute critical operations, since memory access errors in such areas may have a greater cybersecurity impact.

### 6.2.4 [REQ-SSD-02](#REQ-SSD-02) Resilience against potentially untrusted inputs

### 6.2.3 [REQ-SSD-02](#REQ-SSD-02) Resilience against potentially untrusted inputs

#### 6.2.4.1 Objective

#### 6.2.3.1 Objective

Prevent unauthorized memory access.

#### 6.2.4.2 Preparation

#### 6.2.3.2 Preparation

Identify all sources of untrusted input to the product. For each source of untrusted input, review for fields in the format, values, or input sequences that could affect:

Identify the acceptable behaviour(s) of the product in response to the input that would protect its cybersecurity. Identify a method of sending these inputs to the product and recording the responses. Set up this testing environment.

#### 6.2.4.3 Activities

#### 6.2.3.3 Activities

For every input, send the input to the product and record its response.

#### 6.2.4.4 Verdict

#### 6.2.3.4 Verdict

PASS if **all** of the following are fulfilled:

Otherwise FAIL

#### 6.2.4.5 Evidence

#### 6.2.3.5 Evidence

* List of sources of untrusted input

* Analysis of sources of untrusted input for specified inputs

* Logs of testing inputs and recording behaviour

* Sufficient analysis of testing logs

#### 6.2.4.6 Guidance

#### 6.2.3.6 Guidance

Assessment can often be done with minimal effort using commonly available fuzzer or security testing tools. It can also be done manually.

* Dropping a packet and incrementing an error counter

* Emitting a notification when a counter rolls over

### 6.2.7 [REQ-SSD-03](#REQ-SSD-03) Applicability of Annex R

### 6.2.4 [REQ-SSD-03](#REQ-SSD-03) Applicability of Annex R

See annex R.5 for full assessment criteria.

This clause provides assessment for the requirements in [clause 5.5](#security-updates) relating to CRA [\[i.1\]](#_ref_i.1) Annex I Part 1 (2) (c).

### 6.5.3 [REQ-SU-01](#REQ-SU-01) Automatic secure update before or during first use

### 6.5.2 [REQ-SU-01](#REQ-SU-01) Automatic secure update before or during first use

#### 6.5.3.1 Objective

#### 6.5.2.1 Objective

Prevent exploitation of known exploitable vulnerabilities at first use.

#### 6.5.3.2 Preparation

#### 6.5.2.2 Preparation

Examine public or private vulnerability information sources and select a recently fixed vulnerability. Filter candidates to ensure each vulnerability specifically affects the platform, architecture, or software components used by the product. Then, prioritize those candidates based on the existence of publicly available exploit code (e.g., Proof of Concept), evidence of active exploitation in the wild, the severity of the vulnerability, and the potential impact its exploitation would have on the product.

#### 6.5.3.3 Activities

#### 6.5.2.3 Activities

Follow the instructions to install and use the product for the first time, scan the product to see if a recently fixed vulnerability has been fixed on the product, and examine the documentation for the required info

#### 6.5.3.4 Verdict

#### 6.5.2.4 Verdict

PASS if **all** of the following are fulfilled:

* the most recently fixed vulnerability is fixed, and

* the documentation includes all the required information.

#### 6.5.3.5 Evidence

#### 6.5.2.5 Evidence

* Documentation of vulnerability handling,

* Documentation of how to securely update the product

* Description of how to scan for the vulnerability

* Log of vulnerability scan results

### 6.5.4 [REQ-SU-02](#REQ-SU-02) Automatic secure update via operational environment before or during first use

### 6.5.3 [REQ-SU-02](#REQ-SU-02) Automatic secure update via operational environment before or during first use

#### 6.5.4.1 Objective

#### 6.5.3.1 Objective

Prevent exploitation of known exploitable vulnerabilities at first use.

#### 6.5.4.2 Preparation

#### 6.5.3.2 Preparation

Examine public or private vulnerability information sources and select a fixed vulnerability. Filter candidates to ensure each vulnerability specifically affect the platform, architecture, or software components used by the product. Then, prioritize those candidates based on the existence of publicly available exploit code (e.g., Proof of Concept), evidence of active exploitation in the wild, the severity of the vulnerability, and the potential impact its exploitation would have on the product.

#### 6.5.4.3 Activities

#### 6.5.3.3 Activities

Follow the instructions for the administrator to receive and install the latest release, use the product for the first time, scan the product to see if a recently fixed vulnerability has been fixed on the product, and examine the documentation for the required info

#### 6.5.4.4 Verdict

#### 6.5.3.4 Verdict

PASS if **all** of the following are fulfilled:

Otherwise FAIL

#### 6.5.4.5 Evidence

#### 6.5.3.5 Evidence

* Documentation of vulnerability handling

* Documentation of how to securely update the product

* Description of how to scan for the vulnerability

* Log of vulnerability scan results

### 6.5.5 [REQ-SU-03](#REQ-SU-03) Secure update via product

### 6.5.4 [REQ-SU-03](#REQ-SU-03) Secure update via product

#### 6.5.5.1 Objective

#### 6.5.4.1 Objective

Prevent exploitation of known vulnerabilities.

#### 6.5.5.2 Preparation

#### 6.5.4.2 Preparation

Prepare an update for each part of the product that can be updated with a different version number from the currently installed product version.

#### 6.5.5.3 Activities

#### 6.5.4.3 Activities

Check the versions of all parts of the product that can be updated, install the new update, and check the versions again.

#### 6.5.5.4 Verdict

#### 6.5.4.4 Verdict

PASS if **all** of the following are fulfilled:

Otherwise FAIL

#### 6.5.5.5 Evidence

#### 6.5.4.5 Evidence

* New update version numbers

* Log of querying the product parts’ versions

* Installing the update

* Querying the versions again

### 6.5.6 [REQ-SU-04](#REQ-SU-04) Automatic secure update via product

### 6.5.5 [REQ-SU-04](#REQ-SU-04) Automatic secure update via product

#### 6.5.6.1 Objective

#### 6.5.5.1 Objective

Prevent exploitation of known vulnerabilities.

#### 6.5.6.2 Preparation

#### 6.5.5.2 Preparation

Prepare an update for each part of the product that can be updated with a different version number from the currently installed product version.

#### 6.5.6.3 Activities

#### 6.5.5.3 Activities

Check the versions of all parts of the product that can be updated, create the conditions that allow automatic secure update to occur. Then execute the same setup for all the tests:

2. defer the update, wait the deferral period, relaunch the product, observe any update popups, install the update, record the version again

3. disabling automatic updates, record the product version

#### 6.5.6.4 Verdict

#### 6.5.5.4 Verdict

PASS if **all** of the following are fulfilled:

Otherwise FAIL

#### 6.5.6.5 Evidence

#### 6.5.5.5 Evidence

New update version numbers, and log of querying the product parts’ versions, installing the update, and querying the versions again

### 6.5.8 [REQ-SU-05](#REQ-SU-05) Secure update provided by operational environment

### 6.5.6 [REQ-SU-05](#REQ-SU-05) Secure update provided by operational environment

#### 6.5.8.1 Objective

#### 6.5.6.1 Objective

Prevent exploitation of known vulnerabilities.

#### 6.5.8.2 Preparation

#### 6.5.6.2 Preparation

None.

#### 6.5.8.3 Activities

#### 6.5.6.3 Activities

Assess the documentation provided with the product.

#### 6.5.8.4 Verdict

#### 6.5.6.4 Verdict

PASS if **all** of the following are fulfilled:

Otherwise FAIL

#### 6.5.8.5 Evidence

#### 6.5.6.5 Evidence

Documentation and analysis of completeness

### 6.5.9 [REQ-SU-06](#REQ-SU-06) Automatic secure update provided by operational environment

### 6.5.7 [REQ-SU-06](#REQ-SU-06) Automatic secure update provided by operational environment

#### 6.5.9.1 Objective

#### 6.5.7.1 Objective

Prevent exploitation of known vulnerabilities.

#### 6.5.9.2 Preparation

#### 6.5.7.2 Preparation

None.

#### 6.5.9.3 Activities

#### 6.5.7.3 Activities

Assess the documentation provided with the product

#### 6.5.9.4 Verdict

#### 6.5.7.4 Verdict

PASS if **all** of the following are fulfilled:

Otherwise FAIL

#### 6.5.9.5 Evidence

#### 6.5.7.5 Evidence

* Documentation and analysis of completeness

### 6.5.10 [REQ-SU-07](#REQ-SU-07) Updates are signed and verified before installation

### 6.5.8 [REQ-SU-07](#REQ-SU-07) Updates are signed and verified before installation

#### 6.5.10.1 Objective

#### 6.5.8.1 Objective

Prevent the installation of modified updates.

#### 6.5.10.2 Preparation

#### 6.5.8.2 Preparation

None.

#### 6.5.10.3 Activities

#### 6.5.8.3 Activities

For each part of the product that can be updated, attempt installation of:

* an update with missing signature

* an update with an invalid signature

#### 6.5.10.4 Verdict

#### 6.5.8.4 Verdict

PASS if **all** of the following are fulfilled:

Otherwise FAIL

#### 6.5.10.5 Evidence

#### 6.5.8.5 Evidence

New update version numbers, and installation log containing mention of a signature mismatch.

### 6.5.11 [REQ-SU-08](#REQ-SU-08) Only authorized software updates

### 6.5.9 [REQ-SU-08](#REQ-SU-08) Only authorized software updates

#### 6.5.11.1 Objective

#### 6.5.9.1 Objective

Secure updates.

#### 6.5.11.2 Preparation

#### 6.5.9.2 Preparation

Create an update with an invalid hash

#### 6.5.11.3 Activities

#### 6.5.9.3 Activities

Attempt to install the update

#### 6.5.11.4 Verdict

#### 6.5.9.4 Verdict

PASS if **all** of the following are fulfilled:

Otherwise FAIL

#### 6.5.11.5 Evidence

#### 6.5.9.5 Evidence

* Update and invalid hash

* Error message

* Before and after comparison of any data that would have been altered if it had been installed

### 6.5.12 [REQ-SU-09](#REQ-SU-09) Secure update has validly signed hash

### 6.5.10 [REQ-SU-09](#REQ-SU-09) Secure update has validly signed hash

#### 6.5.12.1 Objective

#### 6.5.10.1 Objective

Secure updates.

#### 6.5.12.2 Preparation

#### 6.5.10.2 Preparation

Create updates with signature signed by an untrusted key

#### 6.5.12.3 Activities

#### 6.5.10.3 Activities

For each part of the product that can be updated, attempt installation of an update signed by an untrusted key

#### 6.5.12.4 Verdict

#### 6.5.10.4 Verdict

PASS if **all** of the following are fulfilled:

Otherwise FAIL

#### 6.5.12.5 Evidence

#### 6.5.10.5 Evidence

* Updates and invalid hashes and file sizes

* Error message

* Before and after comparison of any data that would have been altered if it had been installed

### 6.5.13 [REQ-SU-10](#REQ-SU-10) Invalidated update is rejected

### 6.5.11 [REQ-SU-10](#REQ-SU-10) Invalidated update is rejected

#### 6.5.13.1 Objective

#### 6.5.11.1 Objective

Prevent “rollback attacks” by rejecting previously-valid packages that contain vulnerabilities.

#### 6.5.13.2 Preparation

#### 6.5.11.2 Preparation

Create an update image that was formerly valid but has been revoked from the repository metadata.

#### 6.5.13.3 Activities

#### 6.5.11.3 Activities

Attempt to install the revoked update

#### 6.5.13.4 Verdict

#### 6.5.11.4 Verdict

PASS if **all** of the following are fulfilled:

Otherwise FAIL

#### 6.5.13.5 Evidence

#### 6.5.11.5 Evidence

* Revoked update image

* Error message

* Before and after comparison of any data that would have been altered if it had been installed

### 6.5.14 [REQ-SU-11](#REQ-SU-11) Signing keys have strictly scoped usage

### 6.5.12 [REQ-SU-11](#REQ-SU-11) Signing keys have strictly scoped usage

#### 6.5.14.1 Objective

#### 6.5.12.1 Objective

Ensure keys are only used for their designated roles and prevent role confusion attacks.

#### 6.5.14.2 Preparation

#### 6.5.12.2 Preparation

Create Repository Metadata signed with a valid key that is intended for a different role

#### 6.5.14.3 Activities

#### 6.5.12.3 Activities

Send the incorrectly-signed Repository Metadata to the device during an update check

#### 6.5.14.4 Verdict

#### 6.5.12.4 Verdict

PASS if **all** of the following are fulfilled:

Otherwise FAIL

#### 6.5.14.5 Evidence

#### 6.5.12.5 Evidence

* Error message

* Before and after comparison showing local metadata is not changed

### 6.5.15 [REQ-SU-12](#REQ-SU-12) Signing keys have not been revoked or otherwise marked untrusted

### 6.5.13 [REQ-SU-12](#REQ-SU-12) Signing keys have not been revoked or otherwise marked untrusted

#### 6.5.15.1 Objective

#### 6.5.13.1 Objective

Ensure keys have not been revoked and are still valid, including their complete chain of trust.

#### 6.5.15.2 Preparation

#### 6.5.13.2 Preparation

Create Repository Metadata signed with a formerly valid key that has been revoked

#### 6.5.15.3 Activities

#### 6.5.13.3 Activities

Send the Repository Metadata signed with the revoked key to the device during an update check

#### 6.5.15.4 Verdict

#### 6.5.13.4 Verdict

PASS if **all** of the following are fulfilled:

Otherwise FAIL

#### 6.5.15.5 Evidence

#### 6.5.13.5 Evidence

* Error message

* Before and after comparison showing local metadata is not changed

### 6.5.16 [REQ-SU-13](#REQ-SU-13) Reject update to current or previous version

### 6.5.14 [REQ-SU-13](#REQ-SU-13) Reject update to current or previous version

#### 6.5.16.1 Objective

#### 6.5.14.1 Objective

Prevent rollback attacks by rejecting older versions of Repository Metadata.

#### 6.5.16.2 Preparation

#### 6.5.14.2 Preparation

Have the device perform an update check to obtain the latest Repository Metadata, then prepare an older version of Repository Metadata

#### 6.5.16.3 Activities

#### 6.5.14.3 Activities

Send the older version of Repository Metadata to the device during another update check

#### 6.5.16.4 Verdict

#### 6.5.14.4 Verdict

PASS if **all** of the following are fulfilled:

Otherwise FAIL

#### 6.5.16.5 Evidence

#### 6.5.14.5 Evidence

* Error message

* Before and after comparison showing update metadata is not changed

### 6.5.17 [REQ-SU-14](#REQ-SU-14) Updates not applied from expired sources

### 6.5.15 [REQ-SU-14](#REQ-SU-14) Updates not applied from expired sources

#### 6.5.17.1 Objective

#### 6.5.15.1 Objective

Prevent use of expired metadata that could enable rollback attacks.

#### 6.5.17.2 Preparation

#### 6.5.15.2 Preparation

Create expired Repository Metadata and configure the update server to provide it

#### 6.5.17.3 Activities

#### 6.5.15.3 Activities

Have the device perform an update check with the expired metadata

#### 6.5.17.4 Verdict

#### 6.5.15.4 Verdict

PASS if **all** of the following are fulfilled:

Otherwise FAIL

#### 6.5.17.5 Evidence

#### 6.5.15.5 Evidence

* Error message

* Before and after comparison showing update metadata is not changed

This clause provides assessment for the requirements in [clause 5.13](#exploit-mitigation) relating to CRA [\[i.1\]](#_ref_i.1) Annex I Part 1 (2) (k).

### 6.13.3 [REQ-EMM-01](#REQ-EMM-01) Route traffic from other sources/destination disabled by default

### 6.13.2 [REQ-EMM-01](#REQ-EMM-01) Route traffic from other sources/destination disabled by default

#### 6.13.3.1 Objective

#### 6.13.2.1 Objective

Prevent unauthorized network access to endpoints.

#### 6.13.3.2 Preparation

#### 6.13.2.2 Preparation

None.

#### 6.13.3.3 Activities

#### 6.13.2.3 Activities

Connect an endpoint and capture the traffic on all interfaces.

#### 6.13.3.4 Verdict

#### 6.13.2.4 Verdict

PASS if **all** of the following are fulfilled:

Otherwise FAIL

#### 6.13.3.5 Evidence

#### 6.13.2.5 Evidence

* Packet capture with annotations of origin of packet

### 6.13.4 [REQ-EMM-02](#REQ-EMM-02) Notify user if routing traffic from other sources/destination

### 6.13.3 [REQ-EMM-02](#REQ-EMM-02) Notify user if routing traffic from other sources/destination

#### 6.13.4.1 Objective

#### 6.13.3.1 Objective

Prevent unauthorized network access to endpoints.

#### 6.13.4.2 Preparation

#### 6.13.3.2 Preparation

None

#### 6.13.4.3 Activities

#### 6.13.3.3 Activities

1. Connect an endpoint,

2. enable the routing of external traffic through it, and

3. observe the UI and system.

#### 6.13.4.4 Verdict

#### 6.13.3.4 Verdict

PASS if **any** of the following are fulfilled:

Otherwise FAIL

#### 6.13.4.5 Evidence

#### 6.13.3.5 Evidence

* Record of UI change

### 6.13.5 [REQ-EMM-03](#REQ-EMM-03) No routing traffic from other sources/destination if not necessary for services

### 6.13.4 [REQ-EMM-03](#REQ-EMM-03) No routing traffic from other sources/destination if not necessary for services

#### 6.13.5.1 Objective

#### 6.13.4.1 Objective

Prevent unauthorized network access to endpoints.

#### 6.13.5.2 Preparation

#### 6.13.4.2 Preparation

None.

#### 6.13.5.3 Activities

#### 6.13.4.3 Activities

1. Create a list of services that can only be used if routing of external traffic is enabled, and

2. document the reason each service requires routing of external traffic to function.

#### 6.13.5.4 Verdict

#### 6.13.4.4 Verdict

PASS if **all** of the following are fulfilled:

Otherwise FAIL

#### 6.13.5.5 Evidence

#### 6.13.4.5 Evidence

* Documentation of services

### 6.14.2 [REQ-LOG-01](#REQ-LOG-01) Local event logging

#### 6.14.TK.1 Objective

#### 6.14.2.1 Objective

Monitoring and recording cybersecurity-relevant events.

#### 6.14.TK.2 Preparation

#### 6.14.2.2 Preparation

Review the technical documentation to confirm the scope of cybersecurity-relevant events implemented in the logging mechanism.

#### 6.14.TK.3 Activities

#### 6.14.2.3 Activities

For each type of cybersecurity-relevant event mentioned in 5.14.1.2:

2. collect any locally generated log messages recording the event, and

3. capture any packets being transmitted to the manufacturer.

#### 6.14.TK.4 Verdict

#### 6.14.2.4 Verdict

PASS if **all** of the following are fulfilled:

Otherwise FAIL

#### 6.14.TK.5 Evidence

#### 6.14.2.5 Evidence

* Method of triggering events

* Log messages with annotations

* Packet captures demonstrating no unauthorized transmission of logs

### 6.14.2 [REQ-LOG-02](#REQ-LOG-02) Internal event logging

### 6.14.3 [REQ-LOG-02](#REQ-LOG-02) Internal event logging

#### 6.14.2.1 Objective

#### 6.14.3.1 Objective

Monitoring and recording cybersecurity-relevant events.

#### 6.14.2.2 Preparation

#### 6.14.3.2 Preparation

Review the manufacturer’s documentation to confirm the scope of cybersecurity-relevant events implemented in the logging mechanism.

#### 6.14.2.3 Activities

#### 6.14.3.3 Activities

For each type of cybersecurity-relevant event mentioned in 5.14.1.2:

1. trigger the event on the endpoint, and

2. collect any locally generated log messages recording the event.

#### 6.14.2.4 Verdict

#### 6.14.3.4 Verdict

PASS if **all** of the following are fulfilled:

Otherwise FAIL

#### 6.14.2.5 Evidence

#### 6.14.3.5 Evidence

* Method of triggering events

* Log messages with annotations

* Packet captures demonstrating no unauthorized transmission of logs

### 6.14.3 [REQ-LOG-03](#REQ-LOG-03) Remote Logging