Update Clause 5.14/6.14 Monitoring to revised structure (was 5.2.14)

* 5.10.5 REQ-AP-04 (MI-WDOG): Watchdog and self-initiated reset

* 5.10.6 REQ-AP-05 (MI-NTFY): Watchdog and notification of host

### 5.2.15 ER-LOGG: Logging and monitoring

## 5.14 Monitoring

#### 5.2.15.1 Cybersecurity requirement

### 5.14.1 Overview

The product shall record security-relevant internal events, including but not limited to changes to configuration and access or modification of data and functions. The product shall provide an opt-out mechanism.

This clause addresses the requirements in the CRA [\[i.1\]](#_ref_i.1) Annex 1 Part 1 (2) (l).

#### 5.2.15.2 MI-LOGG: Logging

### 5.14.2 REQ-MO-01 (MI-LOGG): Logging

The product shall record log messages indicating security-relevant internal events in an internal log or transmit them to the host system logging system. The log messages shall not include any confidential information such as PII, secrets, or credentials, or any information which might reasonably be expected to include such items.

#### 5.14.2.1 Requirement

  * Reference: ER-LOGG

  * Objective: Monitoring and recording security-relevant events

  * Preparation: List all types of security-relevant internal events

  * Activities: For each type of security-relevant internal event, trigger the event

  * Verdict: For each triggered event, the log contains a message indicating the event, log message does not include any information likely to be confidential => PASS, otherwise FAIL

  * Evidence: Method of triggering events, log messages with annotations

The product shall record cybersecurity-relevant internal events, including but not limited to changes to configuration and access or modification of data and functions. The product shall provide an opt-out mechanism.

Guidance: One type of event whose log message must take care to not accidentally include a secret is failed password authentication attempts. Since people often type their password into the username field, including the username field in the log message may result in including a secret in the log message.

#### 5.14.2.2 Applicability

TODO

### 5.2.16 ER-SCDL: Secure deletion

* Output of binary analysis tools demonstrating the presence of exploit mitigations

* Documentation of exceptions

## 6.14 Monitoring

### 6.14.1 Overview

This clause provides assessment for the requirements in 5.14 relating to CRA [\[i.1\]](#_ref_i.1) Annex 1 Part 1 (2) (l).

### 6.14.2 REQ-LOG-01 (MI-LOGG-1) Logging

#### 6.14.2.1 Objective

Monitoring and recording cybersecurity-relevant events.

#### 6.14.2.2 Preparation

Review the manufacturer's documentation to confirm the scope of cybersecurity-relevant internal events implemented in the logging mechanism.

#### 6.14.2.3 Activities

For each type of cybersecurity-relevant internal event (configuration modification, reset, transmission adapter state change, cryptographic material change, packet received, packet drop, etc.):

1. trigger the event on the product, and

2. check if the event was recorded internally on the product, or the product sent a notification to the host.

#### 6.14.2.4 Verdict

PASS if **any** of the following are fulfilled:

For each triggered event:

* the product recorded the event internally

* the product notified the host of the event

Otherwise FAIL

#### 6.14.2.5 Evidence

* Method of triggering events

* Logs of internal event records and/or host notifications

# Annex A (informative): Relationship between the present document and the requirements of EU Regulation (EU) 2024/2847 - the Cyber Resilience Act

<mark>Editor's Note: Even if informative, this Annex is mandatory in Harmonised Standards.</mark>