Add Clause 5.13/6.13 Exploit mitigations

TODO

## 5.13 Exploit mitigation

### 5.13.1 Overview

This clause addresses the requirements in the CRA [\[i.1\]](#_ref_i.1) Annex 1 Part 1 (2) (k).

### 5.13.2 REQ-EM-01 (MI-SCFS) Exploit mitigations

#### 5.13.2.1 Requirement

1. **REQ-EM-01 (MI-SCFS)-1** Products shall incorporate built-in exploit mitigation mechanisms appropriate to the target platform and language (e.g., Address Space Layout Randomization (ASLR), Data Execution Prevention (DEP/NX), or Stack Canaries), and

2. **REQ-EM-01 (MI-SCFS)-2** any exceptions to these mitigations shall be documented as to how each exception does not create an unacceptable risk.

#### 5.13.2.2 Applicability

TODO

### 5.13.3 Additional requirements

The following requirements also address this essential cybersecurity requirement using the same applicability:

* 5.2.2 REQ-ALC-01 (MI-SSCA) Static source code analysis for memory errors

* 5.10.5 REQ-AP-04 (MI-WDOG): Watchdog and self-initiated reset

* 5.10.6 REQ-AP-05 (MI-NTFY): Watchdog and notification of host

### 5.2.15 ER-LOGG: Logging and monitoring

#### 5.2.15.1 Cybersecurity requirement

A number of tools and techniques may be used to search for exposed interfaces, including network scanners, scanning a device's mapped memory regions on the system bus, penetration testing software suites, packet sniffers, snooping on various busses, and examining source code and configuration. A search plan does not need to be able to find all possible undocumented interfaces, only those that would found by a threat actor under the conditions of the manufacturer's cybersecurity risk assessment. An element of the rationale for an interface search plan might be "This scanning suite is the most complete version used by professional vulnerability researchers."

## 6.13 Exploit mitigation

### 6.13.1 Overview

This clause addresses the requirements in the CRA [\[i.1\]](#_ref_i.1) Annex 1 Part 1 (2) (k).

### 6.13.2 REQ-EM-01 (MI-SCFS): Exploit mitigations

#### 6.13.2.1 Objective

Exploit mitigation.

#### 6.13.2.2 Preparation

Document the exploit mitigations that are technically relevant to the product.

#### 6.13.2.3 Activities

1. Inspect the compiled executable binaries to verify the presence of the required exploit mitigations.

2. Review documentation for exceptions.

#### 6.13.2.4 Verdict

PASS if **all** of the following are fulfilled:

* Binaries actively implement the appropriate exploit mitigations, and

* all exceptions are documented and justified.

Otherwise FAIL

#### 6.13.2.5 Evidence

* Output of binary analysis tools demonstrating the presence of exploit mitigations

* Documentation of exceptions

# Annex A (informative): Relationship between the present document and the requirements of EU Regulation (EU) 2024/2847 - the Cyber Resilience Act

<mark>Editor's Note: Even if informative, this Annex is mandatory in Harmonised Standards.</mark>