@@ -605,7 +605,7 @@ Example: A listed managed element in the NMS can be enriched with traffic meta d
The following are non-technical requirements, that shall be implemented by all products with digital elements evaluated with the present document.
-**[REQ-GEN-0]:** The product shall have technical documentation with what [Risk factors](#45-risk-factors) the product with digital elements shall be evaluated.
-**[REQ-GEN-0]:** The product shall have technical documentation with what [Risk factors](#45-risk-factors) the product shall be evaluated.
-**[REQ-GEN-1]:** The product shall have technical documentation a detailed enough systems architecture design description, that enables national bodies like MSA to evaluate and test the product design.
-**[REQ-GEN-2]:** The product dependencies to Operating System essential security capabilities are documented.
@@ -649,19 +649,18 @@ Later [Section 5.3 Risk Mitigations](#53-risk-mitigations) combines these genera
When evaluating the applicability of these requirements, the highest of following risk factors define the category to follow: [SRU], [Segment], [NIS2]
For low risk:
-**[REQ-TECH-0]** A network management system shall implement [5.2.4 State-of-the-art cryptographic libraries] to allow the protection to the requirements of the foreseeable use.
-**[REQ-TECH-1]** The product shall be shipped without undocumented interfaces.
-**[REQ-TECH-2]** A secure channel shall be used in transport [5.2.1 Secure channel definition].
-**[REQ-TECH-3]** [5.2.4 State-of-the-art cryptographic libraries] shall be used in the secure channel.
-**[REQ-TECH-4]** All endpoints in a secure channel shall cryptographically verify others.
-**[REQ-TECH-0]** The product shall be shipped without undocumented interfaces.
-**[REQ-TECH-1]** A network management system shall implement [5.2.4 State-of-the-art cryptographic libraries] to allow the protection of the requirements of the foreseeable use.
-**[REQ-TECH-2]** When privileged information is transferred or accessed, a secure channel shall be used in transport [5.2.1 Secure channel definition].
-**[REQ-TECH-3]** All endpoints in a secure channel shall cryptographically verify others.
For medium risk:
-**[REQ-TECH-5]** The product shall be designed in a way that [5.2.2 Cryptographic key intialisation and rotation] is made possilbe.
-**[REQ-TECH-6]** All system components shall be synchronised to the same time.
-**[REQ-TECH-4]** The product shall be designed in a way that [5.2.2 Cryptographic key intialisation and rotation] is made possilbe.
-**[REQ-TECH-5]** All system components shall be synchronised to the same time.
For high risk:
-**[REQ-TECH-7]** All system clock drifts shall be monitored.
-**[REQ-TECH-8]** The product shall be designed in a way, that all cryptographic keys can be replaced with user controlled keys.
-**[REQ-TECH-6]** All system clock drifts shall be monitored.
-**[REQ-TECH-7]** The product shall be designed in a way, that all cryptographic keys can be replaced with user controlled keys.
The listed requirement shall be implemented, if the risk of the given factor is defined as follows.
When multiple factors define a different level, the lowest level shall be selected.
@@ -942,42 +941,45 @@ There are three different types of assessments used in this document.
## 6.1 General requirements assessments
### 6.1.0.0 REQ-GENERAL-0
**Requirement REQ-GEN-0:** The product shall have technical documentation with what [Risk factors](#45-risk-factors) the product with digital elements shall be evaluated.<br/>
**Objective:** Prevent exploitation of known exploited vulnerabilities<br/>
**Preparation:**
1. Examine public or private vulnerability information sources and select a recently fixed vulnerability (preferably the most recently fixed).
### 6.1.0.0 REQ-GEN-0
**Requirement:** The product shall have technical documentation with what [Risk factors](#45-risk-factors) the product shall be evaluated.
**Objective:** Manufacturer declares the targeted market what is considered to be foreseeable use of the product.<br/>
**Preparation:** None<br/>
**Activities:**
1.On a new product, carry out the initial secure update, scan the product to see if a recently fixed vulnerability has been fixed on the product, and examine the documentation for the required info.
1.Study the technical documentation.
**Verdict:**
1. Pass if the secure update completes successfully
1. and the most recently fixed vulnerability is fixed
1. and the documentation includes all the required information
1. and the instructions are noting the custom requirements of the application, if any.
1. Fail otherwise.
1. Pass if all risk factors are included
2. and the reasoning why a given level was selected is presented.
3. Fail otherwise.
**Supporting Evidence:**
1. References to to documentation sections.
1. Documentation of vulnerability handling
1. Documentation of how to securely update the product
1. The report for the selected vulnerability
1. Description of how to scan for the vulnerability
1. Log of vulnerability scan results
### 6.1.0.1 REQ-GEN-1
**Requirement:** The product shall have technical documentation a detailed enough systems architecture design description, that enables national bodies like MSA to evaluate and test the product design.
**Objective:** MSA and other related parties can examine the product without installing it into a test or production environment.<br/>
**Preparation:** None<br/>
**Activities:**
1. Study the technical documentation.
### 6.1.0.1 REQ-GENERAL-2
**Verdict:**
1. Pass documentation has a detailed enough systems architecture design description.
2. Fail otherwise.
**Supporting Evidence:**
1. References to to documentation sections.
-**[REQ-GEN-1]:** The product shall have technical documentation a detailed enough systems architecture design description, that enables national bodies like MSA to evaluate and test the product design.
### 6.1.0.2 REQ-GENERAL-2
### 6.1.0.2 REQ-GEN-2
**Objective:** The product dependencies to Operating System essential security capabilities are documented.<br/>
**Requirement:** The product dependencies to Operating System essential security capabilities are documented.
**Objective:** Dependencies to OS capabilities are documented and understood.<br/>
**Preparation:** None<br/>
**Activities:**
@@ -1073,8 +1075,94 @@ There are three different types of assessments used in this document.
## 6.2 Technical cybersecurity requirement tests and assessments
### 6.2.0.1 REQ-TECH-0
**Requirement:** The product shall be shipped without undocumented interfaces.<br/>
**Objective:** How the product communicates is understood and documented.<br/>
**Preparation:**
1. Have the product initialised and available with the default configuration and required credentials.
**Activities:**
1. Study the technical documentation.
1. Study the listed documented communication endpoints.
1. List all the interfaces the product is listening.
1. Cross-reference the open interfaces to the documentation.
**Verdict:**<br/>
**Supporting Evidence:**<br/>
### 6.2.0.0 REQ-TECH-1
**Requirement:** An network management system shall implement [5.2.4 State-of-the-art cryptographic libraries] to allow the protection of the requirements of the forseeable use.<br/>
**Objective:** The product follows changes in the Agreed Cryptographic Mechanisms specification and shows how the product does that.<br/>
**Preparation:**
1. Have the product initialised and available with the default configuration and required credentials.
**Activities:**
1. Study the technical documentation.
2. Identify the patterns from architectural documentation where encryption is required.
3. Study the implementation from the product or from the technical documentation.
**Verdict:**
1. Pass if the documentation describes with enough details how and where the encryption is used,
2. and handling of PII and privileged information is identified and protected with [5.2.4 State-of-the-art cryptographic libraries].
3. Fail otherwise.
**Supporting Evidence:**
1. References to to documentation sections.
### 6.2.0.2 REQ-TECH-2
**Requirement:** When privileged information is transferred or accessed, a secure channel shall be used in transport [5.2.1 Secure channel definition].<br/>
**Objective:**<br/>
**Preparation:**
1. Have the product initialised and available with the default configuration and required credentials.
**Activities:**
1. Study the technical documentation.
2. Identify the structures where administrative, PII or otherwise privileged information is transferred.
3. Study the implementation from the product and from the technical documentation.
**Verdict:**
1. Pass, if the flow of privileged information is identifiable from the documentation,
2. and testing the implementation of interfaces matches the documentation.
3. Fail otherwise.
**Supporting Evidence:**
1. Listing of tested interfaces and the protocol replies that show what encryption is used.
### 6.2.0.3 REQ-TECH-3
**Requirement:** All endpoints in a secure channel shall cryptographically verify others.<br/>
**Objective:**<br/>
**Preparation:**
**Activities:**<br/>
**Verdict:**<br/>
**Supporting Evidence:**<br/>
### 6.2.0.4 REQ-TECH-4
**Requirement:** The product shall be designed in a way that [5.2.2 Cryptographic key intialisation and rotation] is made possilbe.<br/>
**Objective:**<br/>
**Preparation:**
**Activities:**<br/>
**Verdict:**<br/>
**Supporting Evidence:**<br/>
### 6.2.0.5 REQ-TECH-5
**Requirement:** All system components shall be synchronized to the same time.<br/>
**Objective:** All system components are synchronized to the same time.<br/>
**Preparation:**<br/>
**Activities:**<br/>
@@ -1083,13 +1171,16 @@ There are three different types of assessments used in this document.
#### 6.2.0.6 REQ-TECH-6
**Objective:** All system clocks, including the managed elements, are being tracked.<br/>
**Requirement:** All system clock drifts shall be monitored.<br/>
**Objective:** Accuracy in multiple different monitoring sources require consistent clocks.<br/>
**Preparation:**<br/>
**Activities:**<br/>
**Verdict:**<br/>
**Supporting Evidence:**<br/>
**Objective:** System clock deviation is available as a metric.<br/>
### 6.2.0.7 REQ-TECH-7
**Requirement:** The product shall be designed in a way, that all cryptographic keys can be replaced with user controlled keys.<br/>
