@@ -1319,278 +1319,6 @@ This requirement applies to products with the capability for the user to write d
TODO
## 5.3 Security Profiles
This clause lists all the mitigations necessary to meet cybersecurity requirements for each security profile.
### 5.3.1 Introduction
Security profiles in the context of this document are an intermediary tool that connects specific cybersecurity technical requirement and thier associated mitigations with product use cases.
Each security profile below applies to one or more use case and includes a list of technical requirements and mitigations that are necessary to secure the products described by the use case.
It is worth noting that neither security profiles or use cases constitute exhuastive lists and that they do not include mitigations intended to provide guidance on due diligence for components or product functions performed by non-RDPS remote services.
To apply a security profile to a specific product the manufacturer shall implement the technical requirements and mitigations it containes per clause 5.2 of this document and need not implement technical requirements or mitigations unlisted in the security profile.
For some security profiles products are given the option to apply one or more from a list of related technical requirments and mitigations based on the functions, implementation, security constraints, and what is most secure and practicable for the specific product.
This option is noted by the use of "or" between technical requirements and mitigations listed in the security profile, or in cases where there are technical requirements with multiple mitigations, this is noted by the same alphabetic abbreviation followed by a "-\*" to indicate that any for the mitigations may be utilized to satisfy the technical requirement.
Security profiles are abbreviated with a set of letters and numbers denoting their general characteristics.
This abbreviation begins with "SP" to indicate that the abbreviation describes a security profile and is followed by another two letters indicating if the profile is for a wired interface ("WD"), wireless interface ("WL"), or virtual interface ("VI").
Finally, the abbreviation includes a number to indicate it with greater specificity, with higher numbers generally indicating security profiles of greater complexity.
Use cases, as described in clause 4.7 above, are mapped to appropriate security profile by reference to the table in Annex C.5.2
@@ -2802,7 +2530,7 @@ For the purposes of the list of threats, the product includes:
### B.4.2 Security analysis methodology
Risk factor levels for each security profile are determined by reading the descriptions for each risk factor level and choosing the one that most accurately represents the highest risk for the intended purpose and reasonably foreseeable use and misuse of the product, as specified by the manufacturer.
Risk factor levels for each use case are determined by reading the descriptions for each risk factor level and choosing the one that most accurately represents the highest risk for the intended purpose and reasonably foreseeable use and misuse of the product, as specified by the manufacturer.
For each threat, a formula based on the risk factor levels is used to calculate the Likelihood and Impact of the threat, on a scale of Low, Medium, and High.
@@ -3102,43 +2830,9 @@ Mitigations for Likelihood:
* High to Low: AUTH
### B.5.2 Mapping of use cases to risk factors and security profiles
#### B.5.2.1 Wired network interface use cases
| Use case | PHY | SFT | NET | COM | ADM | LIS | SYS | SDS | SDT | FUN | INT | Sec Pro |
