Commit 0fa2b465 authored by August Bournique's avatar August Bournique Committed by Santeri Toikka
Browse files

Changed 5.3.5 logging requirements to be individual sentences. Included... 

Changed 5.3.5 logging requirements to be individual sentences. Included Hans-Ulrich Buchmueller's phrasing for the first three ("log" to "log data of events").

Reviewed other requirements and none seem to share the prior format of 5.3.5.  This raises questions: 1) Should all requirements be broken into similar granular lists of sub requirements - 1 per each task 2) Should a review for this issue (lack of full sentences/reqs with multiple steps) be conducted on other verticals.

Resolves HAS 57 ISSUE #118
parent ff40a49a

EN-304-621.md

+15 −14
Original line number Diff line number Diff line
@@ -861,20 +861,21 @@ When evaluating the applicability of these requirements, the highest of followin 


For low risk:



- **[REQ-LOG-0a]:** The log file of events shall be protected from unauthorised access, modification,

- **[REQ-LOG-0b]:** and is confidentiality protected.

- **[REQ-LOG-1a]:** The product shall generate auditable events for: successful and failed authentication attempts,

- **[REQ-LOG-1b]:** session establishment attempts with source details,

- **[REQ-LOG-1c]:** session termination events with reason,

- **[REQ-LOG-1d]:** session validation checks like number of concurrent sessions,

- **[REQ-LOG-1e]:** and privilege escalation.

- **[REQ-LOG-2a]:** The product shall log boot or initialisation events: timestamped boot stage progression,

- **[REQ-LOG-2b]:** component verification and initialisation actions,

- **[REQ-LOG-2c]:** and recovery mode activations if in use.

- **[REQ-LOG-3a]:** The product shall log: update availability,

- **[REQ-LOG-3b]:** start and finish of the update download,

- **[REQ-LOG-3c]:** events described by [5.3.4 Secure updates],

- **[REQ-LOG-3d]:** and installation successes and failures.

- **[REQ-LOG-0a]:** The log file of events shall be protected from unauthorised access.

- **[REQ-LOG-0b]:** The log data of events shall be protected from modification including their deletion.

- **[REQ-LOG-0b]:** The log data of events shall be confidentiality protected.

- **[REQ-LOG-1a]:** The product shall generate auditable events for successful and failed authentication attempts.

- **[REQ-LOG-1b]:** The product shall generate auditable events for session establishment attempts with source details.

- **[REQ-LOG-1c]:** The product shall generate auditable events for session termination events with reason.

- **[REQ-LOG-1d]:** The product shall generate auditable events for session validation checks like number of concurrent sessions.

- **[REQ-LOG-1e]:** The product shall generate auditable events for and privilege escalation.

- **[REQ-LOG-2a]:** The product shall log boot or initialisation events including timestamped boot stage progression.

- **[REQ-LOG-2b]:** The product shall log boot or initialisation events including component verification and initialisation actions.

- **[REQ-LOG-2c]:** The product shall log boot or initialisation events including recovery mode activations if in use.

- **[REQ-LOG-3a]:** The product shall log update availability.

- **[REQ-LOG-3b]:** The product shall log start and finish of the update download.

- **[REQ-LOG-3c]:** The product shall log events described by [5.3.4 Secure updates].

- **[REQ-LOG-3d]:** The product shall log installation successes and failures.



For medium risk: