@@ -1468,6 +1468,41 @@ The product shall detect corruption of the data transmitted by the product.
See Section 5.3 for which mitigations are necessary for which security profiles and Annex C.4 for the rationale.
#### 5.2.X.x Requirement
The product shall minimize the data processed.
#### 5.2.X.x **MI-DJST**: Document and justify processed data
All sources of data processed by the product in its secure-by-default configuration shall be documented. All sources of data processed shall have a documented rationale for why its processing is necessary for the functioning of the product in its secure-by-default configuration.
* Reference: TR-DMIN
* Objective: Minimize data processed
* Preparation: List all potential sources of data for the product. For each source of data, identify a method to detect whether the product is processing data from that source.
* Activities: Using the list of sources of data, and the method to detect whether the product is processing data from that source, list all sources of data processed. Compare to the documented list.
* Verdict: All sources of processed data are documented, including rationale => PASS, otherwise => FAIL
* Evidence: List of sources of data, documentation of each source of data, list of sources of data processed, connection between each discovered source of processed data to its documentation
#### 5.2.X.x Mapping of mitigations to risk factors and security profiles
| Risk factors | Requires mitigations |
|---------------------|----------------------|
| RT-High | none |
| SNDS < 1 & SNDT < 1 | none |
| all others | DJST |
| Security Profile | Requires mitigations |
|------------------|----------------------|
| FIXME | none |
| any | DJST |
> FIXME: When full use case risk factor and tolerances are available, update above table.
@@ -1629,41 +1664,6 @@ The product shall provide a method by which an authorized user can securely tran
### 5.2.X **TR-DMIN**:
#### 5.2.X.x Requirement
The product shall minimize the data processed.
#### 5.2.X.x **MI-DJST**: Document and justify processed data
All sources of data processed by the product in its secure-by-default configuration shall be documented. All sources of data processed shall have a documented rationale for why its processing is necessary for the functioning of the product in its secure-by-default configuration.
* Reference: TR-DMIN
* Objective: Minimize data processed
* Preparation: List all potential sources of data for the product. For each source of data, identify a method to detect whether the product is processing data from that source.
* Activities: Using the list of sources of data, and the method to detect whether the product is processing data from that source, list all sources of data processed. Compare to the documented list.
* Verdict: All sources of processed data are documented, including rationale => PASS, otherwise => FAIL
* Evidence: List of sources of data, documentation of each source of data, list of sources of data processed, connection between each discovered source of processed data to its documentation
#### 5.2.X.x Mapping of mitigations to risk factors and security profiles
| Risk factors | Requires mitigations |
|---------------------|----------------------|
| RT-High | none |
| SNDS < 1 & SNDT < 1 | none |
| all others | DJST |
| Security Profile | Requires mitigations |
|------------------|----------------------|
| FIXME | none |
| any | DJST |
> FIXME: When full use case risk factor and tolerances are available, update above table.
