Modifications to the use of 'appropriate to the use case' from the meeting

  2. enforcing mandatory credential creation during the initial setup of a new system user or a managed element.

* **AAC_AUTH-4** The product shall use multi‑factor authentication to authenticate system users.

* **AAC_AUTH-5** The product shall limit a system user’s session validity duration via a configurable setting that shall initially be limited to a default of, at maximum, one day.

* **AAC_AUTH-6** The authorization model shall enforce separation of privileges appropriate to the use case.

* **AAC_AUTH-6** The authorization model shall enforce separation of privileges in a way that minimizes subjects access grants to protected functions within the system.

* **AAC_AUTH-7** The product shall require strong authentication of subjects, services, or integrated components to access privileged interfaces, control functions, and sensitive operations.

* **AAC_AUTH-8** The product shall protect privileged interfaces with state-of-the-art cryptographic libraries as described in [annex K](#annex-k-normative-generic-cryptographic-requirements-and-assessment).

* **AAC_AUTH-9** The product shall report all relevant events related to authorisation including, at minimum:

  8. policy version or rule identifier

  9. and validity interval.

* **AAC_AUTH-12** The product shall prevent the execution of any privileged action when the authorisation decision is absent, expired, inconsistent with current policy or context, or cannot be recorded as an auditable event, except where the action aims to enable or restore auditability of the product.

* **AAC_MACHINE-13** The product shall provide authentication for machine users such as certificates or tokens with a lifetime that is appropriate to the use case.

* **AAC_MACHINE-13** The product shall provide authentication for machine users such as certificates or tokens where a expiration is not undefined or over a year in the future.

* **AAC_MACHINE-14** The product shall minimize access for the machine user to privileged interfaces like APIs.

> NOTE: **AAC_AUTH-2** applicability exclusion for UC-1-HOME is a nessesary tradeof when RF-ADMIN is high.

  1. secrets

  2. confidential configuration data

  3. metrics that can expose confidential data

* **CON_INGEST-3** The product shall provide measures appropriate to product use to protect the integrity and, where required, the confidentiality of data relevant to monitoring, control, or security functions that is transferred over connections not controlled by the product.

* **CON_CRYPTO-4** To prevent rollback or downgrade the product shall:

  1. enforce a monotonic cipher suite policy configuration (or equivalent mechanism);

* Screenshots, captures, or console outputs confirming the correct execution or protection behaviour;

* Logs, configuration files, or audit traces demonstrating the implementation of the requirement.

### 6.7.3 CON_INGEST-3

**Objective:** Relevant data types are integrity, and where needed, also confidentiality protected when those are transmitted over connections not controlled by the product.

**Preparation:**

1. Extending the assessment defined in [6.7.1 CON_INGEST-1](#671-con_ingest-1)

**Activities:**

1. Study the access methods, where the connection to query the data is initiated outside of the product;

2. Initiate such a query targeting relevant data.

3. Investigate the system response.

**Verdict:**

1. Pass, if the data in transit follows Annex K guidance with the default configuration

2. and the response is reasonably protecting the data in rest.

3. Fail otherwise.

**Supporting Evidence:**

* Relevant vendor or design documentation describing the applied measures;

* Test reports showing the steps performed and results obtained;

* Screenshots, captures, or console outputs confirming the correct execution or protection behaviour;

* Logs, configuration files, or audit traces demonstrating the implementation of the requirement.

### 6.7.4 CON_CRYPTO-4

**Objective:** Attackers cannot version-rollback, downgrade or shorten key length of the actually deployed cipher suite.