@@ -1811,7 +1811,7 @@ For each cybersecurity requirements defined in clause 5, the following clauses s
**Verdict:**
1. Pass, all tests pass without issues
2. and keys before held in the product are replaced with provided ones from the managed element
2. and they keys are changed to the new ones in a way that survives interruptions.
3. Fail otherwise.
**Supporting Evidence:**
@@ -1831,7 +1831,7 @@ For each cybersecurity requirements defined in clause 5, the following clauses s
**Verdict:**
1. Pass, if the customer has an ability to change user controllable cryptographic keys in the system except the ones that are reasonably made immutable.
1. Pass, if the system user has an ability to change user controllable cryptographic keys in the system except the ones that are reasonably made immutable.
2. Fail otherwise.
**Supporting Evidence:**
@@ -1840,19 +1840,20 @@ For each cybersecurity requirements defined in clause 5, the following clauses s
#### 6.2.1.4 CYB_GENERAL-6
**Objective:** To understand and to be able to take control over the keys used in confidentiality and integrity protection.
**Objective:** To understand and to distinguish user accessible and manufacturer keys.
**Preparation:** None
**Activities:**
1. Study the technical documentation.
2. Cross reference to the architectural description of how the encryption is used in different parts of the system.
2. Cross reference to the architectural description whether user accessible and manufacturer keys are declared.
**Verdict:**
1. Pass, if technical documentation matches the product installation.
2. Fail otherwise.
1. Pass, if the technical documentation matches with the user accessible keys in the product installation
2. and the reasoning used to justify the used non-accessible keys is reasonable in the context of the product's foreseeable and intended use.
