@@ -135,19 +135,22 @@ When evaluating the applicability of these requirements, the highest of followin
<mark>[REQ-TECH-0] assesment: Needs the documentation trick.</mark>
For low risk:
-**[REQ-TECH-0]** The product shall be shipped without unknown interfaces.
-**[REQ-TECH-0]** The product shall not connect to unknown RDPS services.
-**[REQ-TECH-1]** The product shall implement [5.2.4 State-of-the-art cryptographic libraries] in all interfaces, expect the ones that are available only in localhost.
-**[REQ-TECH-2]** When privileged information is transferred or accessed, a secure channel shall be used in transport [5.2.1 Secure channel].
***[REQ-TECH-0]** The product shall be shipped without unknown interfaces.
***[REQ-TECH-0]** The product shall not connect to unknown RDPS services.
***[REQ-TECH-1]** The product shall implement [5.2.4 State-of-the-art cryptographic libraries] in all interfaces, expect the ones that are available only in localhost.
***[REQ-TECH-2]** When privileged information is transferred or accessed, a secure channel shall be used in transport [5.2.1 Secure channel].
For medium risk:
* This document does not have medium level requirements in this category.
For high risk:
-**[REQ-TECH-6]** All system time drift corrections shall be recorded as monitoring event.
-**[REQ-TECH-7]** The product shall be designed in a way, that all cryptographic keys can be replaced with user controlled keys.
> Note: REQ-TECH-7 wording is not limited to 'user accessible and controllable' cryptographic keying, but implements the ability for the system user to achieve sovereignty.
***[REQ-TECH-6]** All system time drift corrections shall be recorded as monitoring event.
***[REQ-TECH-7]** The product shall be designed in a way, that all user accessible and controlled cryptographic keys can be replaced.
***[REQ-TECH-8]** The product shall make known the purpose and usage of keys that are not user accessible, where present.
***[REQ-TECH-9]** In the context of key management and accepting new devices to the management context:
1. The product shall support initialization of trust in a greenfield deployment, and in the connected device management;
2. The product shall support accepting managed elements into the network based on that trust;
3. The product shall support key rotation and replacement of all relevant cryptographic keys after trust has been established.
