Unverified Commit e269617a authored Apr 03, 2026 by Aki Braun

Updates document to (mostly) align with the current version of the skeleton

I have left several clause titles incorrectly numbered so that we may continue to have a shared source of truth with the HAS comments.

parent a5713312

EN-304-620.md

+218 −106

File changed.

Preview size limit exceeded, changes collapsed.

clauses/5.Requirements.md

+1 −1

Original line number	Diff line number	Diff line
		@@ -901,7 +901,7 @@ The remote data processing solutions of the VPN manufacturer shall technically e

		#### 5.2.15.5 MI LOGG 3: No data persistence or storage enabled on exit nodes

		The remote data processing solutions (e.g., exit nodes) of the VPN manufacturer shall utilize an ephemeral infrastructure architecture to technically prevent the persistent storage of user data, traffic metadata, or system logs at the hardware and operating system level. Servers shall operate exclusively using volatile memory (e.g., RAM disks or NVRAM) for temporary processing and system logs, without writing to non-volatile disk-based storage. To satisfy cybersecurity monitoring requirements, any non-PII cybersecurity-relevant events shall be logged in volatile memory or securely transmitted to a remote logging system in accordance with MI-LOGG-2
		The remote data processing solutions (e.g., exit nodes) of the VPN manufacturer shall utilize an ephemeral infrastructure architecture to technically prevent the persistent storage of user data, traffic metadata, or system logs at the hardware and operating system level. Servers shall operate exclusively using volatile memory (e.g., RAM disks or NVRAM) for temporary processing and system logs, without writing to non-volatile disk-based storage. To satisfy cybersecurity monitoring requirements, any non-Personal Data cybersecurity-relevant events shall be logged in volatile memory or securely transmitted to a remote logging system in accordance with MI-LOGG-2

		* Reference: TR-LOGG, TR-DMIN
		* Objective: Minimization of data compromise due to equipment compromise, Confidentiality of data