@@ -1287,7 +1287,7 @@ These requirements apply to the product, regardless of the product's use case an
* a dedicated Identity Management module built into the product.
***AAC_AUTH-2** The product shall not implement a design where default credentials or keys are used to identify subjects.
***AAC_AUTH-3** The product shall use multi‑factor authentication to authenticate system users.
***AAC_AUTH-4**Product shall limit a natural user's authorisation validity of a session via a configurable setting that shall be initially limited by factory default of one day.
***AAC_AUTH-4**The product shall limit a system user's authorisation validity of a session via a configurable setting that shall be initially limited by the factory default of one day.
***AAC_AUTH-5** The authorisation model shall enforce separation of privileges appropriate to the intended and reasonably foreseeable use of the product.
***AAC_AUTH-6** All access to privileged interfaces, control functions, and sensitive operations shall be subject to strong authentication of subjects, services, or integrated components.
***AAC_AUTH-7** Privileged interfaces shall be protected with [5.7.1 State-of-the-art cryptographic libraries](#571-state-of-the-art-cryptographic-libraries).
