@@ -712,6 +712,85 @@ _Description of mitigation implementing the requirement in "shall" format._
This section is a list of technical requirements necessary to satisfy the CRA essential requirements. Each technical requirement can be satisfied by one or more potential mitigations. Each mitigation may or may not be appropriate for an individual use case. The following section will define which mitigations will be required, depending on risk factors and/or a use case. See Annex C for more information.
### 5.2.1 TR-NKEV: No known exploitable vulnerabilities at first use
#### 5.2.1.1 Requirement
Recognizing that there may be vulnerabilities discovered between the time that a product is placed on the market and the time of that product's first use, and that the product should be free from known vulnerabilities both when first made available and when first used by a consumer, the product shall be able to be updated at the time of first use to address all known exploited vulnerabilities which were discovered after the product's placement on the market and before that first use.
#### 5.2.1.2 MI-KEVD: Documentation for secure update before or during first use
The product shall be accompanied by documentation describing how the product may be securely updated, including how to update the product prior to, or as part of, first use.
* Applicability: Product expected use is long enough to require updates
* Reference: TR-NKEV
* Objective: Prevent exploitation of known exploited vulnerabilities at first use
* Preparation: Examine public or private vulnerability information sources and select a recently fixed vulnerability (preferably the most recently fixed)
* Activities: On a new product, carry out the initial secure update, scan the product to see if a recently fixed vulnerability has been fixed on the product, and examine the documentation for the required info
* Verdict: The secure update completes successfully, the most recently fixed vulnerability is fixed, and the documentation includes all the required information => PASS, otherwise FAIL
* Evidence: Documentation of vulnerability handling, documentation of how to securely update the product, the report for the selected vulnerability, description of how to scan for the vulnerability, log of vulnerability scan results
#### 5.2.1.3 MI-KEVA: Automatic secure update before or during first use
The product shall implement automatic secure update by default before or during first use.
* Applicability: Product expected use is long enough to require updates
* Reference: TR-NKEV
* Objective: Prevent exploitation of known exploited vulnerabilities at first use
* Preparation: Examine public or private vulnerability information sources and select a recently fixed vulnerability (preferably the most recently fixed)
* Activities: Follow the instructions to install and use the product for the first time, scan the product to see if a recently fixed vulnerability has been fixed on the product, and examine the documentation for the required info
* Verdict: The secure update completes successfully, the most recently fixed vulnerability is fixed, and the documentation includes all the required information => PASS, otherwise FAIL
* Evidence: Documentation of vulnerability handling, documentation of how to securely update the product, the report for the selected vulnerability, description of how to scan for the vulnerability, log of vulnerability scan results
#### 5.2.1.4 MI-KEVM: Documentation of mitigation of known exploitable vulnerabilities
The product's development and release process shall include a process to document known exploitable vulnerabilities in the product and their fixes or mitigations. The documentation for this process shall be compliant with the process described in <aref="_ref_3">[3] prEN 40000-1-3: "Cybersecurity requirements for products with digital elements – Vulnerability Handling". The product shall be compliant with this requirement if it:
1. has no known exploitable vulnerabilities
1. has known exploitable vulnerabilities whose age is consistent with the specification of how long vulnerabilities may go unfixed after public disclosure, as described in the vulnerability handling procedure for the product
1. for each detected vulnerability, has documentation of how the risk has been mitigated
* Reference: TR-NKEV
* Objective: Prevent exploitation of known exploited vulnerabilities at first use
* Preparation: Compile a list of known exploitable vulnerabilities in the product and its components
* Activities: Compare the generated list of known exploitable vulnerabilities with the documentation of the known exploitable vulnerabilities that have been fixed or mitigated in the product
* Verdict: No vulnerabilities found, or all reported vulnerabilities satisfy either the age or documentation requirement => PASS, otherwise FAIL
* Evidence: Documented vulnerability handling policy, list of vulnerabilities, documentation of mitigations or age of vulnerability, correlation of list of vulnerabilities with documentation of mitigations or age of vulnerability
#### 5.2.1.5 MI-KEVT: Testing for known exploitable vulnerabilities
The product shall be tested for all known exploitable vulnerabilities to demonstrate that each has been mitigated. The product shall be compliant with this requirement if it:
1. has no known exploitable vulnerabilities
1. has known exploitable vulnerabilities whose age is consistent with the specification of how long vulnerabilities may go unfixed after public disclosure, as described in the vulnerability handling procedure for the product
1. for each tested vulnerability, the test result shows that the vulnerability has been mitigated
* Reference: TR-NKEV
* Objective: Prevent exploitation of known exploited vulnerabilities at first use
* Preparation: Compile a list of known exploitable vulnerabilities in the product and its components, compile a list of known exploitable vulnerabilities that will be tested, collect tests for each one
* Activities: On a new product, carry out a secure update, run the tests, and compare the results with the generated list of known exploitable vulnerabilities
* Verdict: No vulnerabilities found, or all reported vulnerabilities satisfy either the age or mitigation requirement => PASS, otherwise FAIL
* Evidence: Documented vulnerability handling policy, list of vulnerabilities, test results for each vulnerability or documentation of age of vulnerability, correlation of list of vulnerabilities with test results or documentation of age of vulnerability
#### 5.2.1.6 MI-SCAN: No easily scannable known exploitable vulnerabilities
If automatable and freely-usable vulnerability scanners are available for the product, then the product shall satisfy the following with respect to the three (or fewer, if fewer than three are available) most comprehensive of such scanners:
1. has no vulnerabilities discovered by scans
1. has discoverable exploitable vulnerabilities whose age is consistent with the specification of how long vulnerabilities may go unfixed after public disclosure, as described in the vulnerability handling procedure for the product
1. for each detected vulnerability, has publicly available documentation explaining how the risk has been mitigated
* Reference: TR-NKEV
* Objective: Prevent exploitation of known vulnerabilities at first use
* Preparation: Select a set of tools meeting the requirements
* Activities: On a new product, carry out a secure update, run the tools on the product, and examine the documentation for any reported vulnerabilities
* Verdict: No vulnerabilities found, or all reported vulnerabilities satisfy either the age or documentation requirement => PASS, otherwise FAIL
* Evidence: Documented vulnerability handling policy, list of vulnerability scanners selected, reports from each scanner, correlation of reports of discovered vulnerabilities with documentation of mitigations
#### 5.2.1.7 Mapping of mitigations to risk factors and security profiles
See Section 5.3 for which mitigations are necessary for which security profiles and Annex C.4 for the rationale.
### 5.2.X **TR-MISO**: Prevent local unauthorized access of memory-addressable security-relevant data
#### 5.2.X.x Requirement
@@ -1539,49 +1618,6 @@ The product shall protect the availability of essential and core network service
| LR, IoT-1 | none |
| all others | AVNT |
### 5.2.X **TR-NKEV**: No known exploited vulnerabilities at first use
#### 5.2.X.x Requirement
Recognizing that there may be vulnerabilities discovered between the time that a product is placed on the market and the time of that product's first use, and that the product should be free from known vulnerabilities both when first made available and when first used by a consumer, the manufacturer shall ensure that the product can be updated at the time of first use to address all known exploited vulnerabilities which were discovered after the product's placement on the market and before that first use.
#### 5.2.X.x **MI-KEVD**: No known exploited vulnerabilities after secure update
The product shall be accompanied by documentation describing how the product may be securely updated, including how to update the product prior to, or as part of, first use.
* Reference: TR-NKEV
* Objective: Prevent exploitation of known exploited vulnerabilities
* Preparation: Examine public or private vulnerability information sources and select a recently fixed vulnerability (preferably the most recently fixed)
* Activities: On a new product, carry out the initial secure update, scan the product to see if a recently fixed vulnerability has been fixed on the product, and examine the documentation for the required info
* Verdict: If the secure update completes successfully, the most recently fixed vulnerability is fixed, and the documentation includes all the required information => PASS, otherwise FAIL
* Evidence: Documentation of vulnerability handling, documentation of how to securely update the product, the report for the selected vulnerability, description of how to scan for the vulnerability, log of vulnerability scan results
#### 5.2.X.x **MI-SCAN**: No easily scannable exploitable vulnerabilities
If automatable and freely-usable vulnerability scanners are available for the product, then the product shall satisfy the following with respect to the three (or fewer, if fewer than three are avilable) most comprehensive of such scanners.
1. have no vulnerabilities discovered by scans
1. have discoverable vulnerabilities whose age is consistent with the manufacturer's documentation of how long vulnerabilities may go unfixed after public disclosure
1. for each detected vulnerability, have publicly available documentation explaining how the risk has been mitigated
* Reference: TR-NKEV
* Objective: Prevent exploitation of known vulnerabilities
* Preparation: Select up to three vulnerability scanners meeting the requirements
* Activities: On a new product, carry out a secure update, run the selected scanners on the product, and examine the documentation for any reported vulnerabilities
* Verdict: No vulnerabilities found, or all reported vulnerabilities satisfy either the age or documentation requirement => PASS, otherwise FAIL
* Evidence: Documented vulnerability handling policy, list of vulnerability scanners selected, reports from each scanner, correlation of reports of discovered vulnerabilities with documentation of mitigations
