Editorial: clause numbering, whitespace

The present document is part 1 of a multi-part deliverable covering Cyber Security (CYBER); Essential cybersecurity requirements for products with digital elements with the function of virtual private networks (VPN)

Part 1: VPNs for secure remote access to private networks

Part 1: VPNs for private connection to public networks

Part 2: VPNs for private connection to public networks

Part 2: VPNs for secure remote access to private networks

## Transposition table

The security of a VPN product is dependent on a chain of trust that spans across multiple components in its operational environment. Consequently, the VPN product delegates certain risks to other components while offering security functionalities that mitigate risks for those same components.

### 4.5.3 Security Functionalities Offered to Integrated Components

### 4.5.2 Security Functionalities Offered to Integrated Components

The VPN product offers the following security functionalities to other components in its operational environment:

- **Secure Data Transport** - The primary function of a VPN is to create a secure, encrypted tunnel over an untrusted network. This functionality protects all network traffic originating from the client device or network from eavesdropping and other network-based attacks.

### 4.5.2 Security functions required from the environment

### 4.5.3 Security functions required from the environment

The following risks are delegated by the VPN product to other components within its operational environment:

  * seeking secure connections primarily to SaaS products

  * requires managed service for configuration and maintenance

## 4.7.1 Mapping of use cases to risk factors

### 4.7.2 Mapping of use cases to risk factors

|      | Use case                    | CFG | AUT | DAT | FUN | ADM |

|------|-----------------------------|-----|-----|-----|-----|-----|

## C.1 Risk acceptance + risk management methodology

TODO

## C.2 Risk Assessment

### C.2.1 ID Asset