Added section about monitoring.

### 5.3.x Logging

-   **[LOG-0]** All system components are synchronized to a same time.

-   **[LOG-1]** From the system perspective, logs and traces are stored into a write only service.

-   **[LOG-1]** From the system perspective, logs and traces are stored into a write only service or endpoint.

-   **[LOG-2]** The write only log or tracing storage is deployed outside of the system deployment context.

-   **[LOG-3]** NMS emits SIEM events from relevant changes.

-   **[LOG-4]** SIEM transfer format, field attributes and event descriptions are available as part of the technical documentation.

| [LOG-6a]    | SIEM event for anomalities in clock accuracy is included in the technical documentation. |

| [LOG-6b]    | SIEM event is emitted when clock anomalies occur.                                        |

### 5.3.x Monitoring

General:

-   **[MON-0]** Collected and stored metrics data can not be altered from the target.

-   **[MON-1]** Historical metrics data imports are handled outside of the normal flow.

-   **[MON-2]** Metric name, purpose, value interpretation are described in the technical documentation.

-   **[MON-3]** Metrics cadence, accuracy and storage time is defined in the technical documentation.

-   **[MON-4]** System does not collect metrics that are not directly used in operative purposes.

> NOTE: [MON-2], [MON-3] and [MON-4] requirements apply to all collected metrics.

Availability and uptime:

-   **[MON-5]** Relevant system and connected element metrics like CPU, memory, disk utilisation are tracked and reported.

-   **[MON-6a]** System process and service crashes and restarts are tracked and reported.

-   **[MON-6b]** Managed element process and service crashes and restarts are tracked and reported.

-   **[MON-7]** Managed elements and system nodes and provided services availabilities and statuses are tracked and reported.

-   **[MON-8a]** Relevant system database and storage health metrics like queries per second, latency and throughput are tracked and reported.

-   **[MON-8b]** Relevant managed element database and storage health metrics like queries per second, latency and throughput are tracked and reported.

-   **[MON-9]** Relevant networking metrics like throughput and protocol errros are tracked and reported.

Application monitoring:

-   **[MON-10]** GUI and API latencies are tracked and reported.

-   **[MON-11]** GUI and API error rates are tracked and reported.

Manfacturer shall implement monitoring system features as listed in the table below.

| Name                              | [COM-L-0]     | [COM-L-1]   | [COM-L-2]         |  [COM-L-3]  |

| --------------------------------- | ------------- | ----------- | ----------------- | ----------- |

| Complexity of the managed element | Limited IoT   | Home device | Enterprise router | Basestation |

| [MON-0]                           | Required      | Required    | Required          | Required    |

| [MON-1]                           | Required      | Required    | Required          | Required    |

| [MON-2]                           | Required      | Required    | Required          | Required    |

| [MON-3]                           | Required      | Required    | Required          | Required    |

| [MON-4]                           | Required      | Required    | Required          | Required    |

| [MON-5]                           | Required      | Required    | Required          | Required    |

| [MON-6a]                          | Required      | Required    | Required          | Required    |

| [MON-6b]                          | Not required  | Required    | Required          | Required    |

| [MON-7]                           | Required      | Required    | Required          | Required    |

| [MON-8a]                          | Required      | Required    | Required          | Required    |

| [MON-8b]                          | Not required  | Required    | Required          | Required    |

| [MON-9]                           | Required      | Required    | Required          | Required    |

| [MON-10]                          | Required      | Required    | Required          | Required    |

| [MON-11]                          | Required      | Required    | Required          | Required    |

| Requirement | Assesment                                                                                    |

| ----------- | -------------------------------------------------------------------------------------------- |

| [MON-0]     | The system design preventing data modification is documented in the technical documentation. |

| [MON-1]     | Historical data import leaves a trace in the logs, if existing metric value was altered.     |

| [MON-1]     | National MSAs are able to validate the system design comformity without a deployment.        |

| [MON-2]     | National MSAs are able to validate the system design comformity without a deployment.        |

| [MON-3]     | National MSAs are able to validate the system design comformity without a deployment.        |

| [MON-4]     | <mark>How to define business continuity metrics? A new chapter?</mark>                       |

| [MON-5]     | Relevant metrics are documented and presented to the user in the GUI.                        |

| [MON-6]     | Relevant metrics are documented and presented to the user in the GUI.                        |

| [MON-7]     | Relevant metrics are documented and presented to the user in the GUI.                        |

| [MON-8]     | Relevant metrics are documented and presented to the user in the GUI.                        |

| [MON-9]     | Relevant metrics are documented and presented to the user in the GUI.                        |

| [MON-10]    | Relevant metrics are documented and presented to the user in the GUI.                        |

| [MON-11]    | Relevant metrics are documented and presented to the user in the GUI.                        |

# 6 Security Profiles

## 6.1 General

> Table mapping technical security requirements from Section 5 of the present document to essential cybersecurity requirements in Annex I of the CRA. The purpose of this is to help identify missing technical security requirements.

| CRA requirement                                 | Technical security requirements(s)                                |

| ----------------------------------------------- | ------------------------------------------------- |

| ----------------------------------------------- | ----------------------------------------------------------------- |

| No known exploitable vulnerabilities            |                                                                   |

| Secure design, development, production          |                                                                   |

| Secure by default configuration                 | [5.2.4]                                                           |

| Minimize impact on other devices or services    | [5.3.x High Availability](#53x-high-availability)                 |

| Limit attack surface                            |                                                                   |

| Exploit mitigation by limiting incident impact  |                                                                   |

| Logging and monitoring mechanisms               | [5.3.x Logging](#53x-logging)                     |

| Logging and monitoring mechanisms               | [5.3.x Logging](#53x-logging) [5.3.x Monitoring](#53x-monitoring) |

| Secure deletion and data transfer               |                                                                   |

[5.2.4]: (#524-appropriate-cryptographic-libraries)