Added 5.9 Data minimisation assessments (a4b46002) · Commits · STAN4CRA / EN 304 621 Network Management Systems

EN-304-621_revised_structure.md

+85 −6

Original line number	Diff line number	Diff line
		@@ -1405,14 +1405,19 @@ This intervention enables the administrator to transfer the seed of trust.

		## 5.9 Data minimisation

		<mark>_Proposed ESR code: DM_</mark>

		This clause addresses the requirements in the CRA [\[i.1\]](#_ref_i.1) Annex 1 Part 1 (2) (g).

		* DM_RETENTION-1 The product shall define what is logged, and how long that record is kept.
		* DM_RETENTION-2 The product shall define what metrics are gathered, and how long that record is kept.
		* DM_RETENTION-3 Metrics cadence, accuracy and storage time shall be described for the user.
		* DM_RETENTION-4 The product shall not collect data unrelated to the purpose of the product operation.
		* DM_RETENTION-1 The product shall define what is logged, and how long that record is kept by default, in group level accuracy like:
		* application debug output
		* application output labeled warning or critical
		* privilege escalations in the application operation
		* network configuration changes
		* DM_RETENTION-2 The product shall define what metrics are gathered, and how long that record is kept by describing at least, but not limited to:
		* metric name
		* metric description
		* metric cadence, if relevant for the collected metric
		* default storage time
		* DM_RETENTION-3 The product shall not collect data unrelated to the purpose of the product operation.

		## 5.10 Availability protection

		@@ -1971,6 +1976,80 @@ Verify that:

		## 6.9 Data minimisation

		### 6.9.1 DM_RETENTION-1

		Objective: Ensure that the product user understands what data is being collected.<br/>
		Preparation:

		1. Have the product initialised and available with the default configuration and required credentials;
		2. Study the technical documentation how to deploy the system.

		Activities:

		1. Cross-reference the product settings and output to the to the documentation.

		Verdict:

		1. Pass the presented categories matches the product operation
		2. and the listed retention times of the log records are fit for the expected use of the product.
		3. Fail otherwise.

		Supporting Evidence:

		* Relevant vendor or design documentation describing the applied measures;
		* Test reports showing the steps performed and results obtained;
		* Screenshots, captures, or console outputs confirming the correct execution or protection behaviour;
		* Logs, configuration files, or audit traces demonstrating the implementation of the requirement;

		### 6.9.1 DM_RETENTION-2

		Objective: Ensure that the product user understands what data is being collected.<br/>
		Preparation:

		1. Have the product initialised and available with the default configuration and required credentials;
		2. Study the technical documentation how to deploy the system.

		Activities:

		1. Cross-reference the product settings and output to the to the documentation.

		Verdict:

		1. Pass the listed information is available in the technical documentation
		2. and the collected metrics and the implemented storage matches the documentation.
		3. Fail otherwise.

		Supporting Evidence:

		* Relevant vendor or design documentation describing the applied measures;
		* Test reports showing the steps performed and results obtained;
		* Screenshots, captures, or console outputs confirming the correct execution or protection behaviour;
		* Logs, configuration files, or audit traces demonstrating the implementation of the requirement;

		### 6.9.1 DM_RETENTION-3

		Objective: Ensure that the product user understands what data is being collected.<br/>
		Preparation:

		1. Have the product initialised and available with the default configuration and required credentials;
		2. Study the technical documentation how to deploy the system.

		Activities:

		1. Study the infromation provided by DM_RETENTION-2 and DM_RETENTION-3

		Verdict:

		1. Pass the ingested data follows the requirement definition.
		2. Fail otherwise.

		Supporting Evidence:

		* Relevant vendor or design documentation describing the applied measures;
		* Test reports showing the steps performed and results obtained;
		* Screenshots, captures, or console outputs confirming the correct execution or protection behaviour;
		* Logs, configuration files, or audit traces demonstrating the implementation of the requirement;

		#### 6.14.2.3 REQ-METRICS-3

		Objective: The product provides the information on the meaning of the metrics data and about their memory and storage consumption.<br/>