@@ -298,18 +298,7 @@ Some security functions that may be provided by the operational environment incl
## 4.5 Users
**Product users** are consumers or customers or entities like companies and institutions that operate the product in its intended and foreseeable use case. The definition can vary from single persons to nations.
**System users** are natural persons. Administrators typically access the system through an HTTPS GUI, console, or by VPN connection.
System users can include both integrators and end users (individual or group / consumer or organization), as well as users with privileged rights or professional training such as administrators. System users can be professional users or consumers and may have different levels of cybersecurity knowledge. Both professional and less experienced users may also have disabilities and may be using assistive technology to access the product.
**Machine users** are servers or any other type of computer that are identified and authenticated by communication protocols that protect the communication between the product and the machine user. Once the protected communication has been established, the machine user receives the according authorization by the product.
**Service Requesting Users** do neither have a direct interface to, nor could they interact or login via other ways to the product. SRUs are the beneficiaries of the product operation and do not participate in the configuration and control of the product. Typically, the product does not classify the traffic source. The source can be a machine used by a human user, an application workload using the network. This group also includes children and elderly.
**Subject** is later used in the identity and access management requirements when both, product users and machine users are addressed as a group.
The term subject should not be mismatched with product users or with service requesting users, because the use of subject is always clearly defined within the concrete context.
Users include both integrators and end users (individual or group / consumer or organization), as well as users with privileged rights or professional training such as administrators. System users can be professional users or consumers and may have different levels of cybersecurity knowledge. Both professional and less experienced users may also have disabilities and may be using assistive technology to access the product.
