Added HA requirements

Each requirement has at least one concrete example that satisfies the requirements of the CRA.

Later [Section 5.3 Risk Mitigations](#53-risk-mitigations) combines these general requirements to [Section 4.5 Risk Factors](#45-risk-factors). The Risk Mitigations can include additional topic specific requirements.

General requirements:

Technical requirements:

-   **[REQ-TECH-0]** An network management system shall implement appropriate cryptographic libraries to allow the protection to the requirements of the forseeable use.

-   **[REQ-TECH-1]** The product is shipped without undocumented interfaces.

-   **[REQ-UPDATES-1]** Verify integrity of the upddate before installation (hash checks).

-   **[REQ-UPDATES-2]** Use secure channels for update delivery (e.g., TLS).

### 5.3.x High Availability

Unwanted traffic in the interfaces can cause a denial of service from the managed elements.

### 5.3.x Logging

<mark>AMS: Luka and Bruno are working on this. Skip for now.</mark>

| [REQ-LOG-3]           | Not required  | Required    |

| [REQ-LOG-4]           | Not required  | Required    |

### 5.3.x Monitoring

Reasoning for monitoring requirements is often justified by data integrity protection. Faults can not be detected, if an attacker can hide it's existense.

| Name                              | [COM-L-0]     | [COM-L-1]   | [COM-L-2]         |  [COM-L-3]  |

| --------------------------------- | ------------- | ----------- | ----------------- | ----------- |

| Complexity of the managed element | Limited IoT   | Home device | Enterprise router | Basestation |

| [REQ-MON-0] test                  | Required      | Required    | Required          | Required    |

| [REQ-MON-1] test                  | Required      | Required    | Required          | Required    |

| [REQ-MON-2] test                  | Required      | Required    | Required          | Required    |

| [REQ-MON-3] test                  | Required      | Required    | Required          | Required    |

| [REQ-MON-4] test                  | Required      | Required    | Required          | Required    |

| [REQ-MON-5] test                  | Required      | Required    | Required          | Required    |

| [REQ-MON-6a] test                 | Required      | Required    | Required          | Required    |

| [REQ-MON-6b] test                 | Not required  | Required    | Required          | Required    |

| [REQ-MON-7] test                  | Required      | Required    | Required          | Required    |

| [REQ-MON-8a] test                 | Required      | Required    | Required          | Required    |

| [REQ-MON-8b] test                 | Not required  | Required    | Required          | Required    |

| [REQ-MON-9] test                  | Required      | Required    | Required          | Required    |

| [REQ-MON-10] test                 | Required      | Required    | Required          | Required    |

| [REQ-MON-11] test                 | Required      | Required    | Required          | Required    |

[REQ-MON-0]: (#63x0-req-mon-0)

[REQ-MON-1]: (#63x1-req-mon-1)

[REQ-MON-2]: (#63x2-req-mon-2)

[REQ-MON-3]: (#63x3-req-mon-3)

[REQ-MON-4]: (#63x4-req-mon-4)

[REQ-MON-5]: (#63x5-req-mon-5)

[REQ-MON-6a]: (#63x6-req-mon-6)

[REQ-MON-6b]: (#63x6-req-mon-6)

[REQ-MON-7]: (#63x7-req-mon-7)

[REQ-MON-8a]: (#63x8-req-mon-8)

[REQ-MON-8b]: (#63x8-req-mon-8)

[REQ-MON-9]: (#63x9-req-mon-9)

[REQ-MON-10]: (#63x10-req-mon-10)

[REQ-MON-11]: (#63x11-req-mon-11)

| [REQ-MON-0 test]                  | Required      | Required    | Required          | Required    |

| [REQ-MON-1 test]                  | Required      | Required    | Required          | Required    |

| [REQ-MON-2 test]                  | Required      | Required    | Required          | Required    |

| [REQ-MON-3 test]                  | Required      | Required    | Required          | Required    |

| [REQ-MON-4 test]                  | Required      | Required    | Required          | Required    |

| [REQ-MON-5 test]                  | Required      | Required    | Required          | Required    |

| [REQ-MON-6a test]                 | Required      | Required    | Required          | Required    |

| [REQ-MON-6b test]                 | Not required  | Required    | Required          | Required    |

| [REQ-MON-7 test]                  | Required      | Required    | Required          | Required    |

| [REQ-MON-8a test]                 | Required      | Required    | Required          | Required    |

| [REQ-MON-8b test]                 | Not required  | Required    | Required          | Required    |

| [REQ-MON-9 test]                  | Required      | Required    | Required          | Required    |

| [REQ-MON-10 test]                 | Required      | Required    | Required          | Required    |

| [REQ-MON-11 test]                 | Required      | Required    | Required          | Required    |

[REQ-MON-0 test]: #63x0-req-mon-0

[REQ-MON-1 test]: #63x1-req-mon-1

[REQ-MON-2 test]: #63x2-req-mon-2

[REQ-MON-3 test]: #63x3-req-mon-3

[REQ-MON-4 test]: #63x4-req-mon-4

[REQ-MON-5 test]: #63x5-req-mon-5

[REQ-MON-6a test]: #63x6-req-mon-6

[REQ-MON-6b test]: #63x6-req-mon-6

[REQ-MON-7 test]: #63x7-req-mon-7

[REQ-MON-8a test]: #63x8-req-mon-8

[REQ-MON-8b test]: #63x8-req-mon-8

[REQ-MON-9 test]: #63x9-req-mon-9

[REQ-MON-10 test]: #63x10-req-mon-10

[REQ-MON-11 test]: #63x11-req-mon-11

Matching tests for these requirements are listed in [6.3.x Monitoring tests](#63x-monitoring-tests).

### 5.3.x High Availability

High availability starts from the running process.

In a modern cluster runtime environment used in large system deployments, the process rarely can control the loss of underlying resources.

Administrative actions can shutdown the node without preseeding announcement unexpectedly.

It is up to the software design to tolerate these interruptions.

Modern design is often distributed, but depending on the implementation and runtime context, a singular process can also provide the targetted service availability if implemented correctly.

The high availability d

-   **[REQ-HA-0]** Expected availability is defined for each relevant system component.

-   **[REQ-HA-1]** System tolerates loss of resources.

-   **[REQ-HA-2]** Disaster recovery plan is available.

-   **[REQ-HA-3]** System updates and changes are included in the availability definition.

-   <mark>How to include protections against DDoS or similar?</mark>

    -   Unwanted traffic in the interfaces can cause a denial of service from the managed elements.

| Name       | ACC-L-0    | ACC-L-1                | ACC-L-2            | ACC-L-3         |

| ---------- | ---------- | ---------------------- | ------------------ | --------------- |

| Network    | Air gapped | Single public endoint  | Multiple endpoints | Everything else |

| [REQ-HA-0] | Required   | Required               | Required           | Required        |

| [REQ-HA-1] | Required   | Required               | Required           | Required        |

| [REQ-HA-2] | Required   | Required               | Required           | Required        |

| [REQ-HA-3] | Required   | Required               | Required           | Required        |

| Name                              | SRU-L-0      | SRU-L-1                     | SRU-L-2  |

| --------------------------------- | ------------ | --------------------------- | -------- |

| Affected Service Requesting Users | Household    | Medium or large enterprise  | CSP      |

| [REQ-HA-0]                        | Required     | Required                    | Required |

| [REQ-HA-1]                        | Not required | Required                    | Required |

| [REQ-HA-2]                        | Not required | Required                    | Required |

| [REQ-HA-3]                        | Not required | Required                    | Required |

| Name                  | [EXP-L-0]      | [EXP-L-1]   |

| --------------------- | -------------- | ----------- |

| Entity classification | Undefined      | NIS2 entity |

| [REQ-HA-0]            | Not required   | Required    |

| [REQ-HA-1]            | Not required   | Required    |

| [REQ-HA-2]            | Not required   | Required    |

| [REQ-HA-3]            | Not required   | Required    |

# 6 Conformity assesments and tests

> This section should not add requirements that are not already specified in 5. Requirements Specifications.

> 1. **Assignment of Verdict**: Defines the pass/fail criteria. The assessment is considered successful if the requirement’s protection goals are demonstrably met; it fails if unauthorized access, modification, or bypass is possible, or if required security capabilities are unsupported. (treshold)

> 1. **Supporting Evidence**: Lists the artefacts to be collected and documented, such as logs, configuration files, screenshots, vendor documentation, and test results. Evidence ensures traceability and allows independent review. (test or assesment output)

## 6.1 General requirements assesments

## 6.2 Technical security requirement tests and assesments

### 6.2.5 REQ-TECH-5

**Objective**: All system components are synchronized to the same time.<br/>

**Preparation**: <br/>

**Activities**: <br/>

**Verdict**: <br/>

**Supporting Evidence**: <br/>

### 6.2.6 REQ-TECH-6

**Objective**: All system clocks, including the managed elements, are being tracked.<br/>

**Preparation**: <br/>

**Activities**: <br/>

**Verdict**: <br/>

**Supporting Evidence**: <br/>

**Objective**: System clock deviation is available as a metric.<br/>

**Preparation**:

**Activities**: <br/>

**Verdict**: <br/>

**Supporting Evidence**: <br/>

## 6.3 Risk mitigations tests

### 6.3.x Logging tests

| Requirement  | Objective                                                                                |

| ------------ | ---------------------------------------------------------------------------------------- |

| [REQ-LOG-0]  | All system clocks are synchronized to a NTP server or similar.                           |

| [REQ-LOG-1]  | From the running process, it is impossible to overwrite the stored log output.           |

| [REQ-LOG-2]  | Technical documentation specifies how to integrate into an external logging system.      |

| [REQ-LOG-3]  | Detailed information of all emitted events is available.                                 |

| [REQ-LOG-4]  | National MSAs are able to validate the system design comformity without a deployment.    |

| [REQ-LOG-5a] | All system clocks, including the managed elements, are being tracked.                    |

| [REQ-LOG-5b] | System clock deviation is available as a metric.                                         |

| [REQ-LOG-6a] | SIEM event for anomalities in clock accuracy is included in the technical documentation. |

| [REQ-LOG-6b] | SIEM event is emitted when clock anomalies occur.                                        |

| Logging and monitoring mechanisms               | [5.3.x Logging](#53x-logging) [5.3.x Monitoring](#53x-monitoring) |

| Secure deletion and data transfer               |                                                                   |

[5.2.4]: (#524-appropriate-cryptographic-libraries)

[5.3.1]: (#531-mitigations-for-user-identity-integrity)

[5.3.2]: (#532-mitigations-for-ingested-data-integrity-and-confidentiality)

[5.3.3]: (#533-mitigations-for-managed-device-configuration-integrity-and-confidentiality)

[5.2.4]: #524-appropriate-cryptographic-libraries

[5.3.1]: #531-mitigations-for-user-identity-integrity

[5.3.2]: #532-mitigations-for-ingested-data-integrity-and-confidentiality

[5.3.3]: #533-mitigations-for-managed-device-configuration-integrity-and-confidentiality

# Annex B (informative): Relationship between the present document and any related ETSI standards (if any)

-   [Huawei's vulns](https://www.huawei.com/en/psirt/all-bulletins/)

-   Samsung: no publicly available vulnerability database.

[CVE-2025-6763]: (https://www.cve.org/CVERecord?id=CVE-2025-6763)

[CVE-2024-5245]: (https://nvd.nist.gov/vuln/detail/CVE-2024-5245)

[CVE-2024-5245 PoC]: (https://github.com/Abdurahmon3236/CVE-2024-5246)

[more in cybersecurity news]: (https://cybersecuritynews.com/cisa-warns-planet-technology-network-products/)

[CVE-2025-24937]: (https://www.nokia.com/about-us/security-and-privacy/product-security-advisory/cve-2025-24937/)

[CVE-2024-25010]: (https://www.ericsson.com/en/about-us/security/psirt/cve-2024-25010)

[CVE-2022-48469]: (https://www.huawei.com/en/psirt/security-advisories/2023/huawei-sa-thvihr-7015cbae-en)

[CVE-2025-27212]: (https://cybersecuritynews.com/ubiquiti-unifi-devices-vulnerability/)

[CVE-2025-6763]: https://www.cve.org/CVERecord?id=CVE-2025-6763

[CVE-2024-5245]: https://nvd.nist.gov/vuln/detail/CVE-2024-5245

[CVE-2024-5245 PoC]: https://github.com/Abdurahmon3236/CVE-2024-5246

[more in cybersecurity news]: https://cybersecuritynews.com/cisa-warns-planet-technology-network-products/

[CVE-2025-24937]: https://www.nokia.com/about-us/security-and-privacy/product-security-advisory/cve-2025-24937/

[CVE-2024-25010]: https://www.ericsson.com/en/about-us/security/psirt/cve-2024-25010

[CVE-2022-48469]: https://www.huawei.com/en/psirt/security-advisories/2023/huawei-sa-thvihr-7015cbae-en

[CVE-2025-27212]: https://cybersecuritynews.com/ubiquiti-unifi-devices-vulnerability/

## C 2.3 Estimate Risks (Risk factors)