# TOE Security Requirements

This section provides functional and assurance requirements that must be
satisfied by a Protection Profile-compliant TOE. These requirements
consist of functional components from Part 2 of the Common Criteria and
an Evaluation Assurance Level (EAL) containing assurance components from
Part 3 of the Common Criteria.

## TOE Security Functional Requirements

The functional security requirements for this Protection Profile,
summarized in the following table 5-1, consist of components from Part 2
of the Common Criteria.

The statement of the TOE security requirements must include a minimum
strength of function level for the TOE security functions. The minimum
strength of function level for this Protection Profile is SOF-medium.

### Security Functional Components

  -----------------------------------------------------------------------
  **Component**           **Component Name**
  ----------------------- -----------------------------------------------
  FAU_ARP.1               Security Alarms

  FAU_GEN.1               Audit Data Generation

  FAU_SAA.1               Potential Violation Analysis

  FAU_SAR.1               Audit Review

  FAU_SAR.2               Restricted Audit Review

  FAU_STG.2               Guarantees Of Audit Data Availability

  FAU_STG.3               Action In Case Of Possible Audit Data Loss

  FAU_STG.4               Prevention Of Audit Data Loss

  FAU_CKM.1               Cryptographic Key Generation

  FAU_CKM.2               Cryptographic Key Distribution

  FAU_CKM.4               Cryptographic Key Destruction

  FCS_COP.1               Cryptographic Operation

  FDP_ACC.2               Complete Access Control

  FDP_ACF.1               Security Attribute Based Access Control

  FDP_DAU.1               Basic Data Authentication

  FDP_ETC.2               Export Of User Data With Security Attributes

  FDP_IFC.2               Complete Information Flow Control

  FDP_IFF.1               Simple Security Attributes

  FDP_ITC.2               Import Of User Data With Security Attributes

  FDP_ROL.1               Basic Rollback

  FDP_SDI.2               Stored Data Integrity Monitoring And Action

  FIA_AFL.1               Authentication Failure Handling

  FIA_ATD.1               User Attribute Definition

  FIA_SOS.1               Verification Of Secrets

  FIA_UAU.2               User Authentication Before Any Action

  FIA_UAU.4               Single-use Authentication Mechanisms

  FIA_UAU.5               Multiple Authentication Mechanisms

  FIA_UAU.7               Protected Authentication Feedback

  FIA_UID.2               User Identification Before Any Action

  FIA_USB.1               User-subject Binding

  FMT_MOF.1               Management Of Security Functions Behavior

  FMT_MSA.1               Management of Security Attributes

  FMT_MSA.3               Static Attribute Initialization

  FMT_MTD.1               Management Of TSF Data

  FMT_MTD.2               Management Of Limits On TSF Data

  FMT_MTD.3               Secure TSF Data

  FMT_REV.1               Revocation

  FMT_SMF.1               Specification Of Management Functions

  FMT_SMR.1               Security Roles

  FPT_AMT.1               Abstract Machine Testing

  FPT_FLS.1               Failure With Preservation Of Secure State

  FPT_ITI.1               Inter-TSF Detection Of Modification

  FPT_PHP.2               Notification Of Physical Attack

  FPT_RCV.3               Automated Recovery Without Undue Loss

  FPT_RPL.1               Replay Detection

  FPT_RVM.1               Non-bypassability Of The TSP

  FPT_SEP.1               TSF Domain Separation

  FPT_STM.1               Time Stamps

  FPT_TST.1               TSF Testing

  FRU_PRS.2               Full Priority Of Service

  FRU_RSA.1               Maximum Quotas

  FTA_TAB.1               Default TOE Access Banners

  FTA_TAH.1               TOE Access History

  FTA_TSE.1               TOE Session Establishment

  FTP_TRP.1               Trusted Path
  -----------------------------------------------------------------------

Table 5-1 Security Functional Components

### Security Audit (FAU) Requirements

#### Security Audit Automatic Response (FAU_ARP.1)

FAU_ARP.1.1

The TSF shall take \[an action of generating a real time security alarm
that can be displayed on an HMI and will be placed as an event in an
audit log\] upon detection of a potential security violation.

#### Audit Data Generation (FAU_GEN.1)

FAU_GEN1.1

The TSF shall be able to generate an audit record of the following
auditable events:

(a) Start-up and shutdown of the audit functions; and

(b) All auditable events for the \[*basic*\] level of audit;

(c) \[assignment: *other specifically defined auditable events*\].

Application Note: The components that have auditable events at the basic
level are listed in Table 5-3.

FAU_GEN.1.2

The TSF shall record within each audit record at least the following
information:

(a) Date and time of the event, type of event, subject identity, and the
    outcome (success or failure) of the event; and

(b) For each audit event type, based on the auditable event definitions
    of the functional components included in the Protection Profile /
    Security Target, \[the bold refinement text in column two of Table
    5-2\].

(c) **Refinement: an indicator that the audit event is a security
    event.**

Application Note: The refinement requires the ST to designate events as
security events to help monitoring products and services extract
security events from the audit logs. A ST may have further define the
security events into categories such as denial of service,
authentication failure, or protocol violation.

+----------------+-----------------------------------------------------+
| **Component**  | **Auditable Events**                                |
+================+=====================================================+
| FAU_ARP.1      | Actions taken due to imminent security violations   |
+----------------+-----------------------------------------------------+
| FAU_SAA.1      | Enabling and disabling of any of the analysis       |
|                | mechanisms                                          |
+----------------+-----------------------------------------------------+
| FAU_SAR.1      | Reading of information from the audit records       |
+----------------+-----------------------------------------------------+
| FAU_SAR.2      | Unsuccessful attempts to read information from the  |
|                | audit records                                       |
+----------------+-----------------------------------------------------+
| FAU_SAR.3      | The parameters used for the viewing                 |
+----------------+-----------------------------------------------------+
| FAU_STG.3      | Actions taken due to exceeding of a threshold       |
+----------------+-----------------------------------------------------+
| FAU_STG.4      | Actions taken due to the audit storage failure      |
+----------------+-----------------------------------------------------+
| FCS_CKM.1      | Success and failure of the activity                 |
| FCS_CKM.2      |                                                     |
| FCS_CKM.4      | The object attribute(s) and object value(s)         |
|                | excluding any sensitive information (e.g. secret or |
|                | private keys)                                       |
+----------------+-----------------------------------------------------+
| FCS_COP.1      | Success and failure, and the type of cryptographic  |
|                | operation.                                          |
|                |                                                     |
|                | Any applicable cryptographic mode(s) of operation,  |
|                | subject attributes and object attributes            |
+----------------+-----------------------------------------------------+
| FDP_ACF.1      | All requests to perform an operation on an object   |
|                | covered by the SFP                                  |
+----------------+-----------------------------------------------------+
| FDP_DAU.1      | Successful and unsuccessful generation of validity  |
|                | evidence                                            |
+----------------+-----------------------------------------------------+
| FDP_ETC.2      | All attempts to export information                  |
+----------------+-----------------------------------------------------+
| FDP_IFF.1      | All decisions on requests for information flow      |
+----------------+-----------------------------------------------------+
| FDP_ITC.2      | All attempts to import user data, including any     |
|                | security attributes                                 |
+----------------+-----------------------------------------------------+
| FDP_ROL.1      | All attempts to perform rollback operations         |
+----------------+-----------------------------------------------------+
| FDP_SDI.2      | All attempts to check the integrity of user data,   |
|                | including an indication of the results of the       |
|                | check, if performed                                 |
+----------------+-----------------------------------------------------+
| FIA_AFL.1      | The reaching of the threshold for the unsuccessful  |
|                | authentication attempts and the actions taken and   |
|                | the subsequent, if appropriate, restoration to the  |
|                | normal state                                        |
+----------------+-----------------------------------------------------+
| FIA_SOS.1      | Rejection or acceptance by the TSF of any tested    |
|                | secret                                              |
+----------------+-----------------------------------------------------+
| FIA_UAU.2      | All use of the authentication mechanism             |
+----------------+-----------------------------------------------------+
| FIA_UAU.4      | Attempts to reuse authentication data               |
+----------------+-----------------------------------------------------+
| FIA_UAU.5      | The result of each activated mechanism together     |
|                | with the final decision                             |
+----------------+-----------------------------------------------------+
| FIA_UID.2      | All use of the user identification mechanism,       |
|                | including the user identity provided                |
+----------------+-----------------------------------------------------+
| FIA_USB.1      | Success and failure of binding of user security     |
|                | attributes to a subject (e.g. success and failure   |
|                | to create a subject)                                |
+----------------+-----------------------------------------------------+
| FMT_MOF.1      | All modifications in the behavior of the functions  |
|                | in the TSF                                          |
+----------------+-----------------------------------------------------+
| FMT_MSA.1      | All modifications of the values of security         |
|                | attributes                                          |
+----------------+-----------------------------------------------------+
| FMT_MSA.3      | Modifications of the default setting of restrictive |
|                | rules                                               |
|                |                                                     |
|                | All modifications of the initial values of security |
|                | attributes                                          |
+----------------+-----------------------------------------------------+
| FMT_MTD.1      | All modifications to the values of the of the TSF   |
|                | data                                                |
+----------------+-----------------------------------------------------+
| FMT_MTD.2      | All modifications to the limits on TSF data         |
|                |                                                     |
|                | All modifications in the actions to be taken in     |
|                | case of violation of the limits                     |
+----------------+-----------------------------------------------------+
| FMT_MTD.3      | All rejected values of TSF data                     |
+----------------+-----------------------------------------------------+
| FMT_REV.1      | All attempts to revoke security attributes          |
+----------------+-----------------------------------------------------+
| FMT_SMF.1      | Use of the management functions                     |
+----------------+-----------------------------------------------------+
| FMT_SMR.1      | Modifications to the group of users that are part   |
|                | of a role                                           |
+----------------+-----------------------------------------------------+
| FPT_AMT.1      | Execution of the tests of the underlying machine    |
|                | and the results of the tests                        |
+----------------+-----------------------------------------------------+
| FPT_FLS.1      | Failure of the TSF                                  |
+----------------+-----------------------------------------------------+
| FPT_ITI.1      | The action taken upon detection of modification of  |
|                | transmitted TSF data                                |
+----------------+-----------------------------------------------------+
| FPT_PHP.2      | Detection of intrusion                              |
+----------------+-----------------------------------------------------+
| FPT_RCV.3      | The fact that a failure or service discontinuity    |
|                | occurred and the type of failure or service         |
|                | discontinuity                                       |
|                |                                                     |
|                | The resumption of the regular operation             |
+----------------+-----------------------------------------------------+
| FPT_RPL.1      | Detected replay attacks                             |
+----------------+-----------------------------------------------------+
| FPT_STM.1      | Changes to the time                                 |
+----------------+-----------------------------------------------------+
| FPT_TST.1      | Execution of the TSF self tests and the results of  |
|                | the tests                                           |
+----------------+-----------------------------------------------------+
| FRU_PRS.2      | All attempted uses of the allocation function which |
|                | involves the priority of the service functions      |
+----------------+-----------------------------------------------------+
| FRU_RSA.1      | All attempted uses of the resource allocation       |
|                | functions for resources that are under control of   |
|                | the TSF                                             |
+----------------+-----------------------------------------------------+
| FTA_TSE.1      | All attempts at establishment of a user session     |
+----------------+-----------------------------------------------------+
| FTA_TRP.1      | All attempted uses of the trusted path functions    |
|                |                                                     |
|                | Identification of the user associated with all      |
|                | trusted path invocations, if available              |
+----------------+-----------------------------------------------------+

Table 5-2 Auditable Events

#### User Identity Association (FAU_GEN.2)

FAU_GEN.2.1

The TSF shall be able to associate each auditable event with the
identity of the user that caused the event.

#### Potential Violation Analysis (FAU_SAA.1)

FAU_SAA.1.1

The TSF shall be able to apply a set of rules in monitoring the audited
events and based upon these rules indicate a potential violation of the
TSP.

FAU_SAA.1.2

The TSF shall enforce the following rules for monitoring audited events:

(a) Accumulation or combination of \[failed login attempts or
    communication integrity failures from a subject\] known to indicate
    a potential security violation;

```{=html}
<!-- -->
```
(d) \[assignment: *any other rules*\].

#### Audit Review (FAU_SAR.1)

FAU_SAR.1.1

The TSF shall provide \[authorized users in an administrator role\] with
the capability to read \[all audit information\] from the audit records.

FAU_SAR.1.2

The TSF shall provide the audit records in a manner suitable for the
user to interpret the information.

#### Restricted Audit Review (FAU_SAR.2)

FAU_SAR.2.1

The TSF shall prohibit all users read access to the audit records,
except those users that have been granted explicit read-access.

#### Guarantees Of Audit Data Availability (FAU_STG.2)

FAU_STG.2.1

The TSF shall protect the stored audit records from unauthorized
deletion.

FAU_STG.2.2

The TSF shall be able to \[*prevent*\] unauthorized modifications to the
stored audit records in the audit trail.

FAU_STG.2.3

The TSF shall ensure that \[1 hour\] audit records will be maintained
when the following conditions occur: \[[*audit storage exhaustion,
failure, and attack*\]]{.underline}.

#### Prevention of audit data loss (FAU_STG.3)

FAU_STG.3.1

The TSF shall take \[an action to log an alarm in the audit log and
\[assignment: *other actions to be taken in case of possible audit
storage failure*\]\] if the audit trail exceeds \[80% of storage
capacity\].

#### Prevention Of Audit Data Loss (FAU_STG.4)

FAU_STG.4.1

The TSF shall \[*overwrite the oldest stored audit records*\] and
\[write an alarm to the audit log\] if the audit trail is full.

### Cryptographic Support (FCS) Requirements

#### Cryptographic Key Generation (FCS_CKM.1)

FCS_CKM.1.1

The TSF shall generate cryptographic keys in accordance with a specified
cryptographic key generation algorithm \[from the list of approved
algorithms in Appendix C\] and specified cryptographic key sizes \[of at
least 128 bits for symmetric/private key cryptographic algorithms and
1024 bits for asymmetric/public key algorithms\] that meet the following
standards: \[standards in Appendix C\].

#### Cryptographic Key Distribution (FCS_CKM.2)

FCS_CKM.2.1

The TSF shall distribute cryptographic keys in accordance with a
specified cryptographic key distribution method \[assignment:
*cryptographic key distribution method*\] that meet the following
standards: \[assignment: *list of standards*\].

Application Note: The method of key distribution is not specified in the
Protection Profile, but it must be specified in the Security Target.

#### Cryptographic Key Destruction (FCS_CKM.4)

FCS_CKM.4.1

The TSF shall destroy cryptographic keys in accordance with a specified
key destruction method \[zeroization\] that meets the following: \[FIPS
140-2 Level 2 for Subscriber/Level 3 for Registration and Certification
Authorities\].

Application Note: Zeroization shall destroy unencrypted private keys by
altering and deleting memory and storage containing the keys.

#### Cryptographic Operation (FCS_COP.1)

FCS_COP.1.1

The TSF shall perform \[digital signatures, message authentication,
encryption, and key exchange or negotiation\] with a specified
cryptographic algorithm \[from a list of approved algorithms in Appendix
C\] and cryptographic key sizes \[of at least 128 bits for
symmetric/private key cryptographic algorithms and 1024 bits for
asymmetric/public key algorithms\] that meet the following standards:
\[standards listed in Appendix C\].

### User Data Protection (FDP) Requirements

#### Complete Access Control (FDP_ACC.2)

FDP_ACC.2.1

The TSF shall enforce the \[P.Access_Control SFP\] on: \[all subjects
representing a user in the Administrator, Operator, and Display roles,
all objects, and \[assignment: *list of subjects and objects covered by
the SFP*\]\] and all operations among subjects and objects covered by
the SFP.

FDP_ACC.2.2

The TSF shall ensure that all operations between any subject in the TSC
and any object within the TSC are covered by an access control SFP.

#### Security Attribute Based Access Control (FDP_ACF.1)

FDP_ACF.1.1

The TSF shall enforce the \[P.Access_Control SFP\] to objects based on
\[role, location, time of day / day of week, and \[assignment: *list of
subjects and objects controlled under the indicated SFP, and for each,
the SFP-relevant security attributes, or named groups of SFP-relevant
security attributes*\].

FDP_ACF.1.2

The TSF shall enforce the following rules to determine if an operation
among controlled subjects and controlled objects is allowed:
\[assignment: *rules governing access among controlled subjects and
controlled objects using controlled operations on controlled objects*\].

FDP_ACF.1.3

The TSF shall explicitly authorize access of subjects to objects based
on the following additional rules: \[assignment: *rules governing access
among controlled subjects and controlled objects using controlled
operations on controlled objects*\].

FDP_ACF.1.4

The TSF shall explicitly deny access of subjects to objects based on the
\[assignment: *rules, based on security attributes, that explicitly deny
access of subjects to objects*\].

#### Basic Data Authentication (FDP_DAU.1)

FDP_DAU.1.1

The TSF shall provide a capability to generate evidence that can be used
as a guarantee of the validity of \[

(a) audit logs

```{=html}
<!-- -->
```
(e) process data

(f) configuration data

(g) user data

(h) \[assignment: *list of objects or information types*\].

FDP_DAU.1.2

The TSF shall provide the \[subjects corresponding to users in an
Administrator role and \[*assignment: list of subjects*\]\] with the
ability to verify evidence of the validity of the indicated information.

#### Export Of User Data With Security Attributes (FDP_ETC.2)

FDP_ETC.2.1

The TSF shall enforce the \[P.Authentic SFP\] when exporting user data,
controlled under the SFP, outside of the TSC.

FDP_ETC.2.2

The TSF shall export the user data with the user data's associated
security attributes.

FDP_ETC.2.3

The TSF shall ensure that the security attributes, when exported outside
the TSC, are unambiguously associated with the exported user data.

FDP_ETC.2.4

The TSF shall enforce the following rules when user data is exported
from the TSC: \[security attributes shall be included that will allow a
recipient to verify the data came from the user and has not been
modified in transit and \[assignment: *additional exportation control
rules*\]\].

#### Complete Information Flow Control (FDP_IFC.2)

FDP_IFC.2.1

The TSF shall enforce the \[P.Authentic SFP\] on \[all subjects and
information within a TOE\] and all operations that cause that
information to flow to and from subjects covered by the SFP.

FDP_IFC.2.2

The TSF shall ensure that all operations that cause any information in
the TSC to flow to and from any subject in the TSC are covered by an
information flow control SFP.

#### Simple Security Attributes (FDP_IFF.1)

FDP_IFF.1.1

The TSF shall enforce the \[[P.Authentic SFP\]]{.underline} based on the
following types of subject and information security attributes:

a.  \[list of subjects:

-   source subject identifier

-   user role related to source subject identifier

-   \[assignment: list of subjects and information controlled under the
    indicated SFP\]

-   \[assignment: list of security attributes for each subject or
    information\].

FDP_IFF.1.2

The TSF shall permit an information flow between a controlled subject
and controlled information via a controlled operation if the following
rules hold: \[assignment: *for each operation, the security
attribute-based relationship that must hold between subject and
information security attributes*\].

FDP_IFF.1.3

The TSF shall enforce the following: \[assignment: *additional
information flow control SFP rules*\].

FDP_IFF.1.4

The TSF shall provide the following: \[assignment: *list of additional
SFP capabilities*\].

FDP_IFF.1.5

The TSF shall explicitly authorize an information flow based on the
following rules: \[assignment: *rules, based on security attributes,
that explicitly authorize information flows*\].

FDP_IFF.1.6

The TSF shall explicitly deny an information flow based on the following
rules: \[assignment: *rules, based on security attributes, that
explicitly deny information flows*\].

#### Import Of User Data With Security Attributes (FDP_ITC.2)

FDP_ITC.2.1

The TSF shall enforce the \[P.Authentic SFP\] when importing user data,
controlled under the SFP, from outside of the TSC.

FDP_ITC.2.2

The TSF shall use the security attributes associated with the imported
user data.

FDP_ITC.2.3

The TSF shall ensure that the protocol used provides for the unambiguous
association between the security attributes and the user data received.

FDP_ITC.2.4

The TSF shall ensure that interpretation of the security attributes of
the imported user data is as intended by the source of the user data.

FDP_ITC.2.5

The TSF shall enforce the following rules when importing user data
controlled under the SFP from outside the TSC: \[assignment: *additional
importation control rules*\].

#### Basic Rollback (FDP_ROL.1)

FDP_ROL.1.1

The TSF shall enforce \[P.Authentic SFP\] to permit the rollback of the
\[TOE configuration, TOE management, and \[assignment: list of
operations\]\].

FDP_ROL.1.2

The TSF shall permit operations to be roled back within \[the last five
management or configuration changes\].

#### Stored Data Integrity Monitoring And Action (FDP_SDI.2)

FDP_SDI.2.1

The TSF shall monitor user and object data stored within the TSC for
\[corruption or deletion of data\] on all objects based on the following
attributes: \[assignment: user data attributes\].

FDP_SDI.2.2

Upon detection of a data integrity error, the TSF shall \[write a log
entry to a log and \[assignment: *action to be taken*\]\].

### Identification And Authentication (FIA) Requirements

#### Authentication Failure Handling (FIA_AFL.1)

FIA_AFL.1.1

The TSF shall detect when \[*an administrator configurable positive
integer within* \[three (3) to twenty (20)\]\] unsuccessful
authentication attempts occur related to \[a user in the last three (3)
to sixty (60) minutes, with the time threshold set by an
administrator\].

FIA_AFL.1.2

When the defined number of unsuccessful authentication attempts has been
met or surpassed, the TSF shall \[generate a security event in the audit
log\].

#### User Attribute Definition (FIA_ATD.1)

FIA_ATD.1.1

The TSF shall maintain the following list of security attributes
belonging to individual users:\[

(i) unique userID

(j) data required to verify authentication credentials

(k) user roles

(l) time and date when user account is disabled

(m) time and day of the week the user is allowed to login to the TSF

(n) \[assignment: *list of security attributes*\]\].

#### TSF Verification Of Secrets (FIA_SOS.1)

FIA_SOS.1.1

The TSF shall provide a mechanism to verify that secrets meet: \[

(a) a two-factor authentication requirement for users in an
    Administrator role

```{=html}
<!-- -->
```
(o) a password that is at least eight characters long and contains at
    least one letter, one number and one non-alphanumeric character for
    users in an Operator or Display role\]

Application note: Two-factor authentication includes two of the
following three authentication factors: something you know (such as a
password or PIN), something you have (such as a token or smart card),
and something you are (such as a fingerprint or hand geometry).

#### User Authentication Before Any Action (FIA_UAU.2)

FIA_UAU.2.1

The TSF shall require each user to be successfully authenticated before
allowing any other TSF-mediated actions on behalf of that user.

#### Single-use Authentication Mechanisms (FIA_UAU.4)

FIA_UAU.4.1

The TSF shall prevent reuse of authentication data related to \[at least
one of the factors in the two-factor authentication required for users
in an Administrator role\].

#### Multiple Authentication Mechanisms (FIA_UAU.5)

FIA_UAU.5.1

**Refinement:** The TSF shall provide \[assignment: list of multiple
authentication mechanisms\] to support user authentication **for users
in an Administrator role**.

FIA_UAU.5.2

Refinement: The TSF shall authenticate any user's, in an Administrator
role, claimed identity according to \[assignment: rules describing how
the multiple authentication mechanisms provide authentication\].

Application Note: No assignments were made in FIA_UAU.6 because the
Protection Profile does not have any requirements on what type of
two-factor access control is used. The vendor will complete this data in
their Security Target to reflect the two-factor system they have
implemented.

#### Protected Authentication Feedback (FIA_UAU.7)

FIA_UAU.7.1

The TSF shall provide only \[an indication the authentication is in
progress, succeeded or failed\] to the user while the authentication is
in progress.

#### User Identification Before Any Action (FIA_UID.2)

FIA_UID.2.1

The TSF shall require each user to identify itself before allowing any
other TSF-mediated actions on behalf of that user.

#### User-subject Binding (FIA_USB.1)

FIA_USB.1.1

The TSF shall associate the following user security attributes with
subjects acting on behalf of that user: \[user identifier, user role and
\[assignment: *list of user security attributes*\].

FIA_USB.1.2

The TSF shall enforce the following rules on the initial association of
user security attributes with subjects acting on the behalf of users:
\[assignment: *rules for the initial association of attributes*\].

FIA_USB.1.3

The TSF shall enforce the following rules governing changes to the user
security attributes associated with subjects acting on the behalf of
users: \[changes will not take affect until the user logs out and logs
in again and \[assignment: *rules for the changing of attributes*\].

### Security Management (FMT) Requirements

#### Management Of Security Functions Behavior (FMT_MOF.1)

FMT_MOF.1.1

The TSF shall restrict the ability to \[*determine the behavior of,
disable, enable, or modify the behavior of*\] the functions:\[

(a) Authentication functions

```{=html}
<!-- -->
```
(p) Authorization functions

(q) Auditing functions

(r) Data integrity functions

(s) Non-repudiation functions

(t) \[assignment: *list of functions*\]\]

to \[the Administrator role\].

#### Management Of Security Attributes (FMT_MSA.1)

FMT_MSA.1.1

The TSF shall enforce the \[P.Access_Control SFP\] to restrict the
ability to \[*change_default, modify, or delete*\] the security
attributes \[that are restricted to the Administrator role in Table
5-1\] to \[the Administrator role\].

#### Static Attribute Initialization (FMT_MSA.3)

FMT_MSA.3.1

The TSF shall enforce the \[P.Access_Control SFP\] to provide
*[restrictive]{.underline}* default values for security attributes that
are used to enforce the SFP.

FMT_MSA.3.2

The TSF shall allow \[the Administrator role\] to specify alternative
initial values to override the default values when an object or
information is created.

#### Management Of TSF Data (FMT_MTD.1)

FMT_MTD.1.1

The TSF shall restrict the ability to \[*change_default, modify, delete,
and clear*\] the \[audit records specified in FAU_GEN.1, TSF
configuration, database configuration and \[assignment: *list of TSF
data*\]\] to \[the Administrator role\].

#### Management Of Limits On TSF Data (FMT_MTD.2)

FMT_MTD.2.1

The TSF shall restrict the specification of the limits for \[audit
trails specified in FAU_GEN.1 and \[assignment: *list of TSF data*\]\]
to \[the Administrator role\].

FMT_MTD.2.2

The TSF shall take the following actions, if the TSF data are at, or
exceed, the indicated limits: \[overwrite the oldest stored audit record
and enter the event in the audit log\].

#### Secure TSF Data (FMT_MTD.3)

FMT_MTD.3.1

The TSF shall ensure that only secure values are accepted for TSF data.

#### Revocation (FMT_REV.1)

FMT_REV.1.1

The TSF shall restrict the ability to revoke security attributes
associated with the \[*users, subjects, and objects*\] within the TSC to
\[the Administrator role\].

FMT_REV.1.2

The TSF shall enforce the rules \[within two (2) minutes of the
revocation and \[assignment: *specification of revocation rules*\]\].

#### Specification of Management Functions

FMT_SMF.1

The TSF shall be capable of performing the following security management
functions: \[management functions in table 5.3 and \[assignment: *list
of security management functions to be provided by the TSF*\]\].

+----------------+-----------------------------------------------------+
| **Component**  | **Management Functions**                            |
+================+=====================================================+
| FAU_ARP.1      | The management (addition, removal, or modification) |
|                | of actions                                          |
+----------------+-----------------------------------------------------+
| FAU_SAA.1      | Maintenance of the rules by (adding, modifying,     |
|                | deletion) of rules from the set of rules            |
+----------------+-----------------------------------------------------+
| FAU_SAR.1      | Maintenance (deletion, modification, addition) of   |
|                | the group of users with read access right to the    |
|                | audit records                                       |
+----------------+-----------------------------------------------------+
| FAU_SAR.3      | The parameters used for the viewing                 |
+----------------+-----------------------------------------------------+
| FAU_STG.2      | Maintenance of the parameters that control the      |
|                | audit storage capability                            |
+----------------+-----------------------------------------------------+
| FAU_STG.3      | Maintenance of the threshold                        |
|                |                                                     |
|                | Maintenance (deletion, modification, addition) of   |
|                | actions to be taken in case of imminent audit       |
|                | storage failure.                                    |
+----------------+-----------------------------------------------------+
| FAU_STG.4      | Maintenance (deletion, modification, addition) of   |
|                | actions to be taken in case of audit storage        |
|                | failure                                             |
+----------------+-----------------------------------------------------+
| FCS_CKM.1      | The management of changes to cryptographic key      |
| FCS_CKM.2      | attributes. Examples of key attributes include      |
| FCS_CKM.4      | user, key type, validity period, and use (e.g.      |
|                | digital signature, key encryption, key agreement,   |
|                | data encryption).                                   |
+----------------+-----------------------------------------------------+
| FDP_ACF.1      | Managing the attributes used to make explicit       |
|                | access or denial based decisions                    |
+----------------+-----------------------------------------------------+
| FDP_DAU.1      | The assignment or modification of the objects for   |
|                | which data authentication may apply could be        |
|                | configurable in the system                          |
+----------------+-----------------------------------------------------+
| FDP_ETC.2      | The additional exportation control rules could be   |
|                | configurable by a user in a defined role            |
+----------------+-----------------------------------------------------+
| FDP_IFF.1      | Managing the attributes used to make explicit       |
|                | access based decisions                              |
+----------------+-----------------------------------------------------+
| FDP_ITC.2      | The modification of the additional control rules    |
|                | used for import                                     |
+----------------+-----------------------------------------------------+
| FDP_ROL.1      | The boundary limit to which rollback may be         |
|                | performed could be a configurable item within the   |
|                | TOE                                                 |
|                |                                                     |
|                | Permission to perform a rollback operation could be |
|                | restricted to a well defined role                   |
+----------------+-----------------------------------------------------+
| FDP_SDI.2      | The actions to be taken upon detection of an        |
|                | integrity error could be configurable               |
+----------------+-----------------------------------------------------+
| FIA_AFL.1      | Management of the threshold for unsuccessful        |
|                | authentication attempts                             |
|                |                                                     |
|                | Management of actions to be taken in the event of   |
|                | an authentication failure                           |
+----------------+-----------------------------------------------------+
| FIA_ATD.1      | If so indicated in the assignment, the authorized   |
|                | administrator might be able to define additional    |
|                | security attributes for users                       |
+----------------+-----------------------------------------------------+
| FIA_SOS.1      | The management of the metric used to verify the     |
|                | secrets                                             |
+----------------+-----------------------------------------------------+
| FIA_UAU.2      | Management of the authentication data by an         |
|                | administrator                                       |
|                |                                                     |
|                | Management of the authentication data by the user   |
|                | associate with this data                            |
+----------------+-----------------------------------------------------+
| FIA_UAU.5      | The management of authentication mechanisms         |
|                |                                                     |
|                | The management of the rules for authentication      |
+----------------+-----------------------------------------------------+
| FIA_UID.2      | The management of the user identities               |
+----------------+-----------------------------------------------------+
| FIA_USB.1      | An authorized administrator can define default      |
|                | subject security attributes                         |
|                |                                                     |
|                | An authorized administrator can change subject      |
|                | security attributes                                 |
+----------------+-----------------------------------------------------+
| FMT_MOF.1      | Managing the group of roles that can interact with  |
|                | the functions in the TSF                            |
+----------------+-----------------------------------------------------+
| FMT_MSA.1      | Managing the group of roles that can interact with  |
|                | the security attributes                             |
+----------------+-----------------------------------------------------+
| FMT_MSA.3      | Managing the group of roles that can specify        |
|                | initial values                                      |
|                |                                                     |
|                | Managing the permissive or restrictive setting of   |
|                | default values for a given access control SFP       |
+----------------+-----------------------------------------------------+
| FMT_MTD.1      | Managing the group of roles that can interact with  |
|                | the TSF data                                        |
+----------------+-----------------------------------------------------+
| FMT_MTD.2      | Managing the group of roles that can interact with  |
|                | the limits on the TSF data                          |
+----------------+-----------------------------------------------------+
| FMT_REV.1      | Managing the group of roles that can invoke         |
|                | revocation of security attributes                   |
|                |                                                     |
|                | Managing the lists of users, subjects, objects and  |
|                | other resources for which revocation is possible    |
|                |                                                     |
|                | Managing the revocation rules                       |
+----------------+-----------------------------------------------------+
| FMT_SMR.1      | Managing the group of users that are part of a role |
+----------------+-----------------------------------------------------+
| FPT_AMT.1      | Management of the conditions under which abstract   |
|                | machine test occurs, such as during initial         |
|                | start-up, regular interval, or under specified      |
|                | conditions                                          |
|                |                                                     |
|                | Management of the time interval if appropriate      |
+----------------+-----------------------------------------------------+
| FPT_PHP.2      | Management of the user or role that gets informed   |
|                | about intrusions                                    |
|                |                                                     |
|                | Management of the list of devices that should       |
|                | inform the indicated user or role about the         |
|                | intrusion                                           |
+----------------+-----------------------------------------------------+
| FPT_RCV.3      | Management of who can access the restore capability |
|                | within the maintenance mode                         |
|                |                                                     |
|                | Management of the list of failures/service          |
|                | discontinuities that will be handled through the    |
|                | automatic procedures                                |
+----------------+-----------------------------------------------------+
| FPT_RPL.1      | Management of the list of identified entities for   |
|                | which replay shall be detected                      |
|                |                                                     |
|                | Management of the list of actions that need to be   |
|                | taken in case of replay                             |
+----------------+-----------------------------------------------------+
| FPT_STM.1      | Management of the time                              |
+----------------+-----------------------------------------------------+
| FPT_TST.1      | Management of the conditions under which TSF self   |
|                | testing occurs, such as during initial start-up,    |
|                | regular interval, or under specified conditions     |
|                |                                                     |
|                | Management of the time interval if appropriate      |
+----------------+-----------------------------------------------------+
| FRU_PRS.2      | Assignment of priorities to each subject in the TSF |
+----------------+-----------------------------------------------------+
| FRU_RSA.1      | Specifying maximum limits for a resource for groups |
|                | and/or individual users and/or subjects by an       |
|                | administrator                                       |
+----------------+-----------------------------------------------------+
| FTA_TAB.1      | Maintenance of the banner by the authorized         |
|                | administrator                                       |
+----------------+-----------------------------------------------------+
| FTA_TSE.1      | Management of the session establishment conditions  |
|                | by the authorized administrator                     |
+----------------+-----------------------------------------------------+
| FTA_TRP.1      | Configuring the actions that require trusted path,  |
|                | if supported                                        |
+----------------+-----------------------------------------------------+

*Table 5-3 Management Functions*

#### Security Roles (FMT_SMR.1)

FMT_SMR.1.1

The TSF shall maintain the roles \[Administrator, Operator, Display, and
\[assignment: *the authorized identified roles*\]\].

FMT_SMR.1.2

The TSF shall be able to associate users with roles.

### Protection Of The TSF (FPT) Requirements

#### Abstract Machine Testing (FPT_AMT.1)

FPT_AMT.1

The TSF shall run a suite of tests \[[*during initial start-up,
periodically during normal operation, and at the request of an
authorized user,* \[assignment: *other conditions*\]\]]{.underline} to
demonstrate the correct operation of the security assumptions provided
by the abstract machine that underlies the TSF.

#### Failure With Preservation Of Secure State (FPT_FLS.1)

FPT_FLS.1.1

The TSF shall preserve a secure state when the following types of
failures occur: \[reboot, absence or loss of available of computing
memory or storage, \[assignment: *list of types of failures in the
TSF*\]\].

#### Inter-TSF Detection of Modification (FPT_ITI.1)

FPT_ITI.1.1

The TSF shall provide the capability to detect modification of all TSF
data during transmission between the TSF and a remote trusted IT product
within the following metric: \[modification of one or more bits\].

FPT_ITI.1.2

The TSF shall provide the capability to verify the integrity of all TSF
data transmitted between the TSF and a remote trusted IT product and
perform \[the actions of discarding modified information and entering a
corrupt data event in the audit log\] if modifications are detected.

#### Notification Of Physical Attack (FPT_PHP.2)

FPT_PHP.2.1

The TSF shall provide unambiguous detection of physical tampering that
might compromise the TSF.

FPT_PHP.2.2

The TSF shall provide the capability to determine whether physical
tampering with the TSF's devices or TSF's elements has occurred.

FPT_PHP.2.3

For \[the TSF enclosure around TSF data processing and storage
components and \[assignment: *list of TSF devices/elements for which
active detection is required*\]\], the TSF shall monitor the devices and
elements and notify \[an administrator\] when physical tampering with
the TSF's devices or TSF's elements has occurred.

#### Automated Recovery Without Undue Loss (FPT_RCV.3)

FPT_RCV.3.1

When automated recovery from \[any failure or service discontinuity\] is
not possible, the TSF shall enter a maintenance mode where the ability
to return the TOE to a secure state is provided.

FPT_RCV.3.2

For \[all shutdowns, reboots, and \[*assignment: list of
failures/service discontinuities*\]\], the TSF shall ensure the return
of the TOE to a secure state using automated procedures.

FPT_RCV.3.3

The functions provided by the TSF to recover from failure or service
discontinuity shall ensure that the secure initial state is restored
without exceeding \[2 minutes of operational information\] for loss of
data or objects within the TSC.

FPT_RCV.3.4

The TSF shall provide the capability to determine the objects that were
or were not capable of being recovered.

#### Replay Detection (FPT_RPL.1)

FPT_RPL.1.1

The TSF shall detect replay for the following entities: \[all
entities\].

FPT_RPL.1.2

The TSF shall perform \[actions of discarding the replayed request or
response, generate a replay event message for the audit log, and
\[assignment: *list of specific actions*\]\] when replay is detected.

#### Non-bypassability Of The TSP (FPT_RVM.1)

FPT_RVM.1.1

The TSF shall ensure that TSP enforcement functions are invoked and
succeed before each function within the TSC is allowed to proceed.

#### TSF Domain Separation (FPT_SEP.1)

FPT_SEP.1.1

The TSF shall maintain a security domain for its execution that protects
it from interference and tampering by untrusted subjects.

FPT_SEP.1.2

The TSF shall enforce separation between the security domains of
subjects in the TSC.

#### Time Stamps (FPT_STM.1)

FPT_STM.1.1

The TSF shall be able to provide reliable time stamps for its own use.

#### TSF Testing (FPT_TST.1)

FPT_TST.1.1

The TSF shall run a suite of self tests \[*during initial start-up,
periodically during normal operation, and at the request of the
authorized user*[\]]{.underline} to demonstrate the correct operation of
\[the TSF\].

FPT_TST.1.2

The TSF shall provide authorized users with the capability to verify the
integrity of \[TSF data\].

FPT_TST.1.3

The TSF shall provide authorized users with the capability to verify the
integrity of stored TSF executable code.

### Resource Utilization (FRU) Requirements

#### Full Priority of Service (FRU_PRS.2)

FRU_PRS.2.1

The TSF shall assign a priority to each subject in the TSF.

FRU_PRS.2.2

The TSF shall ensure that each access to all shareable resources shall
be mediated on the basis of the subjects assigned priority.

#### Maximum Quotas (FRU_RSA.1)

FRU_RSA.1.1

The TSF shall enforce maximum quotas on the following resources:
\[memory, processing power, and data storage\] that \[[*an individual
user or subject*\]]{.underline} can use \[*simultaneously*\].

### TOE Access (FTA) Requirements

#### Default TOE Access Banners (FTA_TAB.1)

FTA_TAB.1.1

Before establishing a user session, the TSF shall display an advisory
warning message regarding unauthorized use of the TOE.

#### TOE Access History (FTA_TAH.1)

FTA_TAH.1.1

Upon successful session establishment, the TSF shall display the \[date
and time\] of the last successful session establishment to the user.

FTA_TAH.1.2

Upon successful session establishment, the TSF shall display the \[date
and time\] of the last unsuccessful attempt to session establishment and
the number of unsuccessful attempts since the last successful session
establishment.

#### TOE Session Establishment (FTA_TSE.1)

FTA_TSE.1.1

The TSF shall be able to deny session establishment based on \[user
location, time of day, day of week, and user role\].

### Trusted Path/Channels (FTP) Requirements

#### Trusted Path (FTP_TRP.1)

FTP_TRP.1.1

The TSF shall provide a communication path between itself and \[*remote
and local*\] users that is logically distinct from other communication
paths and provides assured identification of its end points and
protection of the communicated data from modification or disclosure.

FTP_TRP.1.2

The TSF shall permit \[*the TSF, local users and remote* users\] to
initiate communication via the trusted path.

FTP_TRP.1.3

The TSF shall require the use of the trusted path for \[*initial user
authentication*, all writes to points in the TSF, all management of the
TSF, \[assignment: *other services for which the trusted path is
required*\]\].