@@ -1141,24 +1141,21 @@ The following requirements address this essential cybersecurity requirement:
* REQ-AP-05 (MI-NTFY): Watchdog and notification of host
* REQ-MON-01 (MI-LOGG): Logging
### 5.2.15 ER-LOGG: Logging and monitoring
## 5.14 Monitoring
#### 5.2.15.1 Cybersecurity requirement
### 5.14.1 Overview
The product shall record security-relevant internal events, including but not limited to changes to configuration and access or modification of data and functions. The product shall provide an opt-out mechanism.
This clause addresses the requirements in the CRA [\[i.1\]](#_ref_i.1) Annex 1 Part 1 (2) (l).
#### 5.2.15.2 MI-LOGG: Logging
### 5.14.2 REQ-MON-01 (MI-LOGG): Logging
The product shall record log messages indicating security-relevant internal events in an internal log or transmit them to the host system logging system. The log messages shall not include any confidential information such as PII, secrets, or credentials, or any information which might reasonably be expected to include such items.
#### 5.14.2.1 Requirement
* Reference: ER-LOGG
* Objective: Monitoring and recording security-relevant events
* Preparation: List all types of security-relevant internal events
* Activities: For each type of security-relevant internal event, trigger the event
* Verdict: For each triggered event, the log contains a message indicating the event, log message does not include any information likely to be confidential => PASS, otherwise FAIL
* Evidence: Method of triggering events, log messages with annotations
The product shall record cybersecurity-relevant internal events, including but not limited to changes to configuration and access or modification of data and functions. The product shall provide an opt-out mechanism.
Guidance: One type of event whose log message must take care to not accidentally include a secret is failed password authentication attempts. Since people often type their password into the username field, including the username field in the log message may result in including a secret in the log message.
#### 5.14.2.2 Applicability
TODO
### 5.2.16 ER-SCDL: Secure deletion
@@ -2265,6 +2262,61 @@ This clause addresses the requirements in the CRA [\[i.1\]](#_ref_i.1) Annex 1 P
No additional assessment is necessary for the requirements in this clause, as the included requirements are assessed in other clauses of the present document.
## 6.14 Monitoring
### 6.14.1 Overview
This clause provides assessment for the requirements in 5.14 relating to CRA [\[i.1\]](#_ref_i.1) Annex 1 Part 1 (2) (l).
### 6.14.2 REQ-LOG-01 (MI-LOGG-1) Logging
#### 6.14.2.1 Objective
Monitoring and recording cybersecurity-relevant events.
#### 6.14.2.2 Preparation
Identify cybersecurity-relevant events that should be recorded on the product or communicated to the operational environment. Identify methods to trigger each event.
#### 6.14.2.3 Activities
For each type of cybersecurity-relevant internal event
1. trigger the event on the product, and
2. check if the event was recorded internally on the product, or the product sent a notification to the host, or the event was recorded in some other manner.
#### 6.14.2.4 Verdict
PASS if **any** of the following are fulfilled:
For each triggered event:
* the product recorded the event internally, or
* the product notified the host of the event, or
* the event was recorded in some other manner.
Otherwise FAIL
#### 6.14.2.5 Evidence
* List of identified events
* Method of triggering events
* Logs of triggering events
* Logs of internal event records and/or host notifications
#### 6.14.2.6 Guidance
Examples of cybersecurity-relevant events:
* configuration changes
* state changes
* data transmitted
* packet counters
* invalid packets
* dropped packets
* resource exhaustion
* cryptographic material changes
# Annex A (informative): Relationship between the present document and the CRA
<mark>Editor's Note: Even if informative, this Annex is mandatory in Harmonised Standards.</mark>
