Update Clause 5.6/6.6 Authentication and access control to revised structure

TODO - how to express no need to update?

## 5.6 Authentication and access control

### 5.6.1 Overview

This clause addresses the requirements in the CRA [\[i.1\]](#_ref_i.1) Annex 1 Part 1 (2) (d).

### 5.6.2 REQ-AAC-01: Authentication and access control provided by operational environment

#### 5.6.2.1 Requirement

The product shall provide methods by which the operational environment may implement any necessary authentication and access control to the product.

#### 5.6.2.2 Applicability

TODO

#### 5.6.2.3 Guidance

The product may provide security functions that the operational environment may make use of to provide authentication and access control for a product that integrates this product as a component. But products in the scope of the present document are not required to provide authentication and access control independently of their operational environment.

> NOTE: The scope of this standard could be potentially be extended to cover products whose intended purpose and reasonably foreseeable use requires authentication and access control in their secure-by-default configuration. One way to do this is to copy the relevant requirements from related standards, such as those for routers or firewalls.

### 5.2.4 ER-MINI: Minimize impact on other devices and services

#### 5.2.4.1 Cybersecurity requirement

See clause 5.3 for which mitigations are necessary for which security profiles and Annex C.4 for the rationale.

### 5.2.7 ER-AUTH: Authentication and access control

>> TODO: Fill in very limited authentication cybersecurity requirements (for remote management or self-update) and reference cross-vertical authentication standards when they exist.

### 5.2.7 ER-CDST: Confidentiality of data stored on the product

#### 5.2.7.1 Cybersecurity requirement

A method of assessment might be: install one version of the firmware, read the version number from the logs of the host system, then install a different version of the firmware and read the version number from that.

## 6.6 Authentication and access control

### 6.6.1 Overview

This clause addresses the requirements in the CRA [\[i.1\]](#_ref_i.1) Annex 1 Part 1 (2) (d).

### 6.6.2 REQ-AAC-01: Authentication and access control provided by operational environment

#### 6.6.2.1 Objective

Prevent unauthorized access.

#### 6.6.2.2 Preparation

Identify methods the product provides for authorization or access control of cybersecurity-relevant product assets. Identify an operational environment that permits testing these methods. Identify product assets that require authentication or access control to protect the cybersecurity of the product. Identify any necessary configuration, inputs, or other preparation for testing authentication or access control for that asset. Set up the product in the identified operational environment.

#### 6.6.2.3 Activities

For each method and each type of product asset identified, carry out the identified testing preparations and attempt to access the product asset without the necessary authorization.

#### 6.6.2.4 Verdict

PASS if every attempt to access the product asset without the necessary authorization fails.

Otherwise FAIL

#### 6.6.2.5 Evidence

* Descriptions of types of product assets requiring authorization or access control

* Records of configuration, input, and/or preparation for each test

* Logs of access attempts and their results

### 6.2.13.4 MI-FDRP assessment

**[MI-FDRP]** Verify the product performs ordered validity checks on incoming packets and drops invalid packets before further processing.