@@ -1934,10 +1934,36 @@ Use cases, as described in clause 4.7 above, are mapped to appropriate security
# 6 Conformity Assessment
## 6.1 General
### 6.1.1 General
This clause details the assessment process for compliance with the cybersecurity requirements specified in clause 5 of the present document. Each assessment corresponds to a mitigation defined in clause 5 and specifies the activities, verdict criteria, and supporting evidence required to determine conformity.
### 6.1.2 Guidance for identifying interfaces or data processing
Some assessments require compiling a list of interfaces provided by or data processing done by the product. These are not limited to those described in accompanying product documentation, if any.
Some sources for compliling these lists may include, where available:
* documentation accompanying product
* product technical documentation
* product functions
* product interfaces
* product configuration
* product metrics
* product logs
* product binaries
* product source code
* data transmitted by the product
* data stored by the product
* network scanners
* packet sniffers
* system bus scanners
* reverse-engineering tools
* penetration testing tools
* vulnerability testing tools
* manual testing
* custom test programs
### 6.2.13.4 MI-FDRP assessment
**[MI-FDRP]** Verify the product performs ordered validity checks on incoming packets and drops invalid packets before further processing.
