Loading EN-304-624.md +52 −4 Original line number Diff line number Diff line Loading @@ -1241,22 +1241,70 @@ The assessment criteria for each security requirements are described in a struct ## 6.8 Data minimisation ### 6.8.1 General - REFERENCE: ACC-PKI-DM-001 - OBJECTIVE: Verify that the product only maintains configuration data necessary to connect to other IT elements. - PREPARATION: - Access to the product interfaces and configuration data - Architecture documentation. - ACTIVITIES: - Review the product's stored configuration data. - Identify all configuration parameters related to external IT components connections. - Verify that no unnecessary or unrelated configuration data is stored. - Confirm that the stored data aligns with the product architecture description. - Verify that no unecessary ports are open or communication protocol implemented. - VERDICT: - SUCCESS: If the product only maintains configuration data sufficient for connecting to the relevant external IT elements. - FAIL: If unnecessary or unrelated configuration data is found. - EVIDENCE: - List of stored configuration data. - Documentation or logs showing the alignment of configuration data with PKI system requirements. - REFERENCE: REQ-PKI-DM-002 - OBJECTIVE: Verify that the product only maintains and processes user data necessary for certificate management. - PREPARATION: - Access to the product's user data storage and certificate management logs. - ACTIVITIES: - Review the user data stored and processed by the product. - Identify all user data related to certificate management (e.g., certificate requests, updates). - Verify that no unnecessary or unrelated user data is stored or processed. - Confirm that the stored and processed data is limited to what is required for certificate management. - VERDICT: - SUCCESS: If the product only maintains and processes user data necessary for certificate management. - FAIL: If unnecessary or unrelated user data is found. - EVIDENCE: - List of stored and processed user data. - Documentation or logs showing the alignment of user data with certificate management requirements. ### 6.8.2 Secret management - REFERENCE: ACC_PKI_DM_001 - OBJECTIVE: Verify the product only creates keys by means of a secure cryptographic device appropriate for this use. - OBJECTIVE: Verify the product only creates keys by means of a SCD appropriate for this use. - PREPARATION: Document the profiles of private and symmetric keys manipulated by the product, and how they are created by the product. - ACTIVITIES: Verify that all keys are created by an appropriate secure cryptographic device. - VERDICT: SUCCESS if the verification passes; else FAIL. - VERDICT: - SUCCESS: Verification passes - FAIL: Identification of keys not created by SCD or with improper algorithm or size. - EVIDENCE: a) The documentation of private and symmetric keys profiles and how these keys are created. - The documentation of private and symmetric keys profiles and how these keys are created. - REFERENCE: ACC_PKI_DM_002 Loading Loading
EN-304-624.md +52 −4 Original line number Diff line number Diff line Loading @@ -1241,22 +1241,70 @@ The assessment criteria for each security requirements are described in a struct ## 6.8 Data minimisation ### 6.8.1 General - REFERENCE: ACC-PKI-DM-001 - OBJECTIVE: Verify that the product only maintains configuration data necessary to connect to other IT elements. - PREPARATION: - Access to the product interfaces and configuration data - Architecture documentation. - ACTIVITIES: - Review the product's stored configuration data. - Identify all configuration parameters related to external IT components connections. - Verify that no unnecessary or unrelated configuration data is stored. - Confirm that the stored data aligns with the product architecture description. - Verify that no unecessary ports are open or communication protocol implemented. - VERDICT: - SUCCESS: If the product only maintains configuration data sufficient for connecting to the relevant external IT elements. - FAIL: If unnecessary or unrelated configuration data is found. - EVIDENCE: - List of stored configuration data. - Documentation or logs showing the alignment of configuration data with PKI system requirements. - REFERENCE: REQ-PKI-DM-002 - OBJECTIVE: Verify that the product only maintains and processes user data necessary for certificate management. - PREPARATION: - Access to the product's user data storage and certificate management logs. - ACTIVITIES: - Review the user data stored and processed by the product. - Identify all user data related to certificate management (e.g., certificate requests, updates). - Verify that no unnecessary or unrelated user data is stored or processed. - Confirm that the stored and processed data is limited to what is required for certificate management. - VERDICT: - SUCCESS: If the product only maintains and processes user data necessary for certificate management. - FAIL: If unnecessary or unrelated user data is found. - EVIDENCE: - List of stored and processed user data. - Documentation or logs showing the alignment of user data with certificate management requirements. ### 6.8.2 Secret management - REFERENCE: ACC_PKI_DM_001 - OBJECTIVE: Verify the product only creates keys by means of a secure cryptographic device appropriate for this use. - OBJECTIVE: Verify the product only creates keys by means of a SCD appropriate for this use. - PREPARATION: Document the profiles of private and symmetric keys manipulated by the product, and how they are created by the product. - ACTIVITIES: Verify that all keys are created by an appropriate secure cryptographic device. - VERDICT: SUCCESS if the verification passes; else FAIL. - VERDICT: - SUCCESS: Verification passes - FAIL: Identification of keys not created by SCD or with improper algorithm or size. - EVIDENCE: a) The documentation of private and symmetric keys profiles and how these keys are created. - The documentation of private and symmetric keys profiles and how these keys are created. - REFERENCE: ACC_PKI_DM_002 Loading
