Commit 6f5472a9 authored by August Bournique's avatar August Bournique
Browse files

HAS Comment 71, Issue #132 

Revised objectives in 6.2.0.4, 6.2.0.5, 6.2.0.6, and 6.2.0.7 into goal/objective language rather then description of risk. Largely followed comment on issue by Has-Ulrich above.

Links but does not resolve HAS 70 #131 and to #186, #187, #188

Resolves #132
parent bf7a2e22

EN-304-621.md

+4 −4
Original line number Diff line number Diff line
@@ -1160,7 +1160,7 @@ There are three different types of assessments used in this document. 
### 6.2.0.4 REQ-TECH-4



**Requirement:** The product shall be designed in a way that [5.2.2 Cryptographic key intialisation and rotation] is made possilbe.<br/>

**Objective:** When employees and administrators roles change, the keys need to be changed also.<br/>

**Objective:**  Ensure product that allows and encourages users to change keys when necessary for product security reasons, such as when employees and administrators roles change..<br/>

**Preparation:** None<br/>

**Activities:**
@@ -1180,7 +1180,7 @@ There are three different types of assessments used in this document. 
### 6.2.0.5 REQ-TECH-5



**Requirement:** All system components shall be synchronized to the same time.<br/>

**Objective:** When monitoring information, logs, metrics and traces, is collected, the timing of different events is relying on clock accuracy.<br/>

**Objective:** Prevent errors and innaccuracvy in logging, metrics, and traces, due to unsynchronized component clocks.<br/>

**Preparation:**



1.  Have the product initialised and available with the default configuration and required credentials.
@@ -1203,7 +1203,7 @@ There are three different types of assessments used in this document. 
#### 6.2.0.6 REQ-TECH-6



**Requirement:** All system clock drifts shall be monitored.<br/>

**Objective:** Accuracy in multiple different monitoring sources require consistent clocks.<br/>

**Objective:** Where multiple monitoring sources all operate they shall have consistent clocks where any drift or lack of synchronization shall be accurately documented and notification provided to administrator.<br/>

**Preparation:**



1.  Have the product initialised and available with the default configuration and required credentials.
@@ -1225,7 +1225,7 @@ There are three different types of assessments used in this document. 
### 6.2.0.7 REQ-TECH-7



**Requirement:** The product shall be designed in a way, that all cryptographic keys can be replaced with user controlled keys.<br/>

**Objective:** Customer need to have full control of the integrity of the data stored in the system.<br/>

**Objective:** Product shall provide users with data management capabilities and ability to verify the integrity of the stored data in the NMS. <br/>

**Preparation:** None<br/>

**Activities:**