Editorial updates to the numbering

  8. policy version or rule identifier

  9. and validity interval.

* **AAC_AUTH-12** The product shall prevent the execution of any privileged action when the authorisation decision is absent, expired, inconsistent with current policy or context, or cannot be recorded as an auditable event, except where the action aims to enable or restore auditability of the product.

* **AAC_MACHINE-13** The product shall provide authentication for machine users such as certificates or tokens where a expiration is not undefined or over a year in the future.

* **AAC_MACHINE-13** The product shall provide authentication for machine users such as certificates or tokens where a expiration is not undefined or, by default, over a year in the future.

* **AAC_MACHINE-14** The product shall minimize access for the machine user to privileged interfaces like APIs.

> NOTE: **AAC_AUTH-2** applicability exclusion for UC-1-HOME is a nessesary tradeof when RF-ADMIN is high.

  2. confidential configuration data

  3. metrics that can expose confidential data

* **CON_CRYPTO-4** To prevent rollback or downgrade the product shall:

* **CON_CRYPTO-3** To prevent rollback or downgrade the product shall:

  1. enforce a monotonic cipher suite policy configuration (or equivalent mechanism);

  2. preven the re-enabling of deprecated algorithms or the disabling of security checks via  a rollback operation without having an explicit logged administrative override in place.

> NOTE: More details for **CON_CRYPTO-4** in ETSI EN 304 642 [i.17]

> NOTE: More details for **CON_CRYPTO-3** in ETSI EN 304 642 [i.17]

* **CON_CHANNEL-5** The product shall ensure that the secure channel uses cryptographic functions and configuration according to the Annex K.

* **CON_CHANNEL-6** Endpoints within the product shall cryptographically verify all other endpoints in a secure channel using mutual authentication.

* **CON_CHANNEL-4** The product shall ensure that the secure channel uses cryptographic functions and configuration according to the Annex K.

* **CON_CHANNEL-5** Endpoints within the product shall cryptographically verify all other endpoints in a secure channel using mutual authentication.

## 5.8 Integrity protection

* **MON_METRICS-15** The product shall dispatch an event noting the import of previously recorded metric data if that data will overwrite existing data.

* **MON_METRICS-16** The product shall record metrics name, purpose, and value interpretation shall in a manner accessible to the product user.

> NOTE: **MON_METRICS-3** leaves open how the information is conveyed to the product user. It could be a dedicated portal within the product or machine readable output having the same information.

> NOTE: **MON_METRICS-16** leaves open how the information is conveyed to the product user. It could be a dedicated portal within the product or machine readable output having the same information.

* **MON_METRICS-17** The product shall collect, track, and store metrics on, at minimum:

  1. availability and status changes, like process and service crashes and restarts

* Screenshots, captures, or console outputs confirming the correct execution or protection behaviour;

* Logs, configuration files, or audit traces demonstrating the implementation of the requirement.

### 6.7.4 CON_CRYPTO-4

### 6.7.3 CON_CRYPTO-3

**Objective:** Attackers cannot version-rollback, downgrade or shorten key length of the actually deployed cipher suite.

* Logs, configuration files, or audit traces demonstrating the implementation of the requirement.

### 6.7.5 CON_CHANNEL-5

### 6.7.4 CON_CHANNEL-4

**Objective:** The implementation and operation follows the Agreed Cryptographic Mechanisms specification and the Annex K.

1. References to documentation sections.

### 6.7.6 CON_CHANNEL-6

### 6.7.5 CON_CHANNEL-5

**Objective:** All communicating entities are mutually authenticated with cryptographic means.