@@ -18,7 +18,7 @@ This clause addresses the requirements in the CRA [\[i.1\]](#_ref_i.1) Annex 1 P
In alignment with the Cyber Resilience Act Annex I Part I (1), this section addresses overarching risks and mitigations regarding the secure design and development of the product that are not specifically treated by other categorical essential requirements (such as confidentiality, access control, or security updates). The requirements herein ensure the final product itself embodies security by design.
#### 5.2.1.2 Secure software design and development (MI-SSCA, MI-FZ95, MI-BTIN)
#### 5.2.1.2 Secure software design and development (MI-FZ95, MI-BTIN)
Use cases (as described in [clause 4.6](#use-cases) and [annex B](#annex-b-informative-security-analysis)) determine which of these controls should be utilized to mitigate threats around secure software design and development. In particular, across all use cases only one—at most—of the following two is called for when applied to a single product: REQ-SSD-03 (MI-FZ95) or REQ-SSD-04 (MI-BTIN). See B.TK for more information.
@@ -28,12 +28,12 @@ Use cases (as described in [clause 4.6](#use-cases) and [annex B](#annex-b-inf
In addition to memory safety, compiled software is a potential target based on platform and language. Products hardened against these known attack vectors reduce risk to end users.
1.**REQ-SSD-02 (MI-SSCA)-1**All cybersecurity-relevant parts of the product shall be checked for known code patterns that produce _common memory errors_, and
2.**REQ-SSD-02 (MI-SSCA)-2**any identified memory errors or suppression of warnings shall be documented with a rationale for how it does not constitute an unacceptable risk.
1.**REQ-SSD-03 (MI-FZ95)-1**The product shall prevent or mitigate _common memory errors_, and
2.**REQ-SSD-03 (MI-FZ95)-2**the product technical documentation shall record all memory errors detected with a rationale for how each error does not constitute an unacceptable risk.
> NOTE: Examples of _common memory errors_ include, but may not be limited to:
>
@@ -46,23 +46,6 @@ In addition to memory safety, compiled software is a potential target based on p
1.**REQ-SSD-03 (MI-FZ95)-1** The product shall prevent or mitigate _common memory errors_, and
2.**REQ-SSD-03 (MI-FZ95)-2** the product technical documentation shall record all memory errors detected with a rationale for how each error does not constitute an unacceptable risk.
#### 5.2.3.2 Applicability
* UC-1: not required
@@ -136,7 +119,6 @@ This requirement does not apply to UC-6 because by definition that use case does
@@ -12,36 +12,6 @@ For each cybersecurity requirements defined in [clause 5](#technical-requiremen
This clause provides assessment for the requirements in [clause 5.2](#appropriate-level-of-cybersecurity) relating to CRA [\[i.1\]](#_ref_i.1) Annex I Part 1 (1).
Determine the appropriate static source code analysis tool and the manner of running it to verify the absence of the listed errors.
#### 6.2.2.3 Activities
* Review the source code for the product by running the selected source code analysis tool.
* Review the documentation for any warnings or suppression of warnings.
#### 6.2.2.4 Verdict
PASS if **any** of the following are fulfilled:
* The output of the source code analysis tool confirms the absence of the listed memory errors, or
* the method of running the tool is consistent with rationale and all warnings or suppression of warnings have documentation demonstrating that each one does not present an unacceptable cybersecurity risk.
Otherwise FAIL
#### 6.2.2.5 Evidence
* The source code for the product
* The output of the source code analysis tool
* Documentation for any warnings or suppression of warnings
