Whitespace, mostly

For each cybersecurity requirements defined in [clause 5](#5-technical-requirements-for-the-products), the following clauses specify assessment criteria to determine if the technical requirement is met.

<mark>Editor's note: Please ensure that there is an easy, clear and unambiguous mapping of the requirements in [clause 5](#5-technical-requirements-for-the-products) to the relevant assessment criteria in clause 6.</mark>

The assessment criteria for each security requirements are described in a structured manner, as follows:

- **Assessment reference:** Refers to the identifier of the concerned technical requirement.

<mark>Editor's Note: Precisely reference individual tools or include an unambiguous characterization by way of tool capabilities to ensure consistent tool application. For instance, "state-of-the-art vulnerability scanner" shall instead be replaced with "vulnerability scanner that covers all CVEs, supports credentialed and non-credentialed scans, ..."</mark>

<mark>Editor's Note: The standard shall not discourage the use of paid security products to comply with requirements by mandating specific free tools where other options are equally suitable. In such cases, the free tools can be listed informatively, but the general capabilities required of the tool should be listed normatively.</mark>

  - Required information/documentation for the assessment: Specify all information that is necessary to perform the assessment.

  - Reference any vendor-provided setup guides, configuration instructions, or operational manuals, as well as any relevant standards or technical notes, that define how the product shall be configured or operated for the assessment.