@@ -1216,7 +1216,7 @@ This clause addresses the requirements in the CRA [\[i.1\]](#_ref_i.1) Annex 1 P
***SU_UPDATES-5:** The product shall maintain a monotonic version counter or equivalent mechanism to prevent installation of updates with an older version.
***SU_UPDATES-6:** The product shall provide a mechanism to restore the system to the operational state after a failed update.
***SU_UPDATES-7:** The product shall provide a way for the system user to postpone or re-schedule the application update.
* This requirement applies to the subset of products within the indicated use cases that operate in an operational environment that allows for postponement or rescheduling of application updates.
* This requirement applies to the subset of products that operate in an operational environment that allows for postponement or rescheduling of application updates.
***SU_UPDATES-8:** The product shall require explicit authorization and emit an auditable event containing metadata when intentaional rollback is invoked.
* This requirement applies to products that support intentional version rollback.
***SU_UPDATES-9:** The product shall automatically recover from a failed update and resume operation if applicable or otherwise achieve a secure state.
@@ -1245,10 +1245,10 @@ These requirements apply to the product, regardless of the product's use case an
* a dedicated Identity Management module built into the product.
***AAC_AUTH-2** The product shall not allow for default credentials or keys to be used to identify subjects.
***AAC_AUTH-3** The product shall use multi‑factor authentication to authenticate system users.
***AAC_AUTH-4** The product shall limit a system user’s session validity duration via a configurable setting that shall initially be limited by a default of, at maximum, one day.
***AAC_AUTH-4** The product shall limit a system user’s session validity duration via a configurable setting that shall initially be limited to a default of, at maximum, one day.
***AAC_AUTH-5** The authorization model shall enforce separation of privileges appropriate to the use case.
***AAC_AUTH-6** The product shall subject access to privileged interfaces, control functions, and sensitive operations to strong authentication of subjects, services, or integrated components.
***AAC_AUTH-7** The product shall protect privileged interfaces with [5.7.1 State-of-the-art cryptographic libraries](#571-state-of-the-art-cryptographic-libraries).
***AAC_AUTH-6** The product shall require strong authentication of subjects, services, or integrated components to access privileged interfaces, control functions, and sensitive operations.
***AAC_AUTH-7** The product shall protect privileged interfaces with state-of-the-art cryptographic libraries as described in [annex K](#annex-k-normative-generic-cryptographic-requirements-and-assessment).
***AAC_AUTH-8** The product shall report all relevant events related to authorisation including, at minimum:
