@@ -838,8 +838,8 @@ The operative context is described in more datail in the section [4.8 Operationa
-**[REQ-AUTH-4]:** The authorisation model shall enforce separation of privileges appropriate to the intended and reasonably foreseeable use of the product.
-**[REQ-AUTH-4]:** The authorisation model shall enforce separation of privileges appropriate to the intended and reasonably foreseeable use of the product.
-**[REQ-AUTH-5]:** The product technical documentation shall describe the authorization model implemented by the product.
-**[REQ-AUTH-5]:** The product technical documentation shall describe the authorization model implemented by the product.
-**[REQ-AUTH-6]:** The product shall implement and document authorization controls in the technical documentation and in the user documentation, like RBAC or APAC, suitable for privileged interfaces and sensitive operations.
-**[REQ-AUTH-6]:** The product shall implement and document authorization controls in the technical documentation and in the user documentation, like RBAC or APAC, suitable for privileged interfaces and sensitive operations.
-**[REQ-AUTH-7]:** All access to administrative interfaces, control functions, and sensitive operations shall be subject to strong [Note: Define?] authentication of users, services, or integrated components.
-**[REQ-AUTH-7]:** All access to administrative interfaces, control functions, and sensitive operations shall be subject to strong authentication of users, services, or integrated components.
-**[REQ-AUTH-8]:** Privileged interfaces [NOTE: Needs definition?] shall be protected with [5.2.4 State-of-the-art cryptographic libraries].
-**[REQ-AUTH-8]:** Privileged interfaces shall be protected with [5.2.4 State-of-the-art cryptographic libraries].
-**[REQ-AUTH-9]:** The product shall report all relevant events related to authorisation including, but not limited to, successful and unsuccessful use of identity, object access, policy change, privileged function use, data access and deletions, data changes and permission changes.
-**[REQ-AUTH-9]:** The product shall report all relevant events related to authorisation including, but not limited to, successful and unsuccessful use of identity, object access, policy change, privileged function use, data access and deletions, data changes and permission changes.
-**[REQ-AUTH-10]:** The product shall record the source of the identity in authoritative event monitoring data.
-**[REQ-AUTH-10]:** The product shall record the source of the identity in authoritative event monitoring data.
