{"packId":"en-304-618","packVersion":"0.1.0","standard":{"reference":"ETSI EN 304 618","title":"CYBER; CRA; Essential cybersecurity requirements for password managers","status":"INTERIM DRAFT under open consultation — subject to substantial change before publication; approved versions come only from the ETSI Documentation Service. Not cited in the Official Journal: conformance confers NO presumption of conformity today.","sourceUrl":"https://labs.etsi.org/rep/stan4cra/en-304-618","sourceCommit":"d3a3e0bf","retrieved":"2026-09-02","retrievedAt":"2026-09-02","license":"BSD-3-Clause, © ETSI. Redistributed with attribution as the license requires; the verbatim requirement text below is reproduced from the interim draft.","licenseText":"Copyright 2025 ETSI\n\nRedistribution and use in source and binary forms, with or without\nmodification, are permitted provided that the following conditions are met:\n1. Redistributions of source code must retain the above copyright notice,\n   this list of conditions and the following disclaimer.\n2. Redistributions in binary form must reproduce the above copyright notice,\n   this list of conditions and the following disclaimer in the documentation\n   and/or other materials provided with the distribution.\n3. Neither the name of the copyright holder nor the names of its contributors\n   may be used to endorse or promote products derived from this software without\n   specific prior written permission.\n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\nANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\nWARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.\nIN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,\nINDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,\nBUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,\nDATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF\nLIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE\nOR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED\nOF THE POSSIBILITY OF SUCH DAMAGE."},"appliesTo":{"annexIIIItem":"Password managers","category":"important-1","craCategory":"important-1","note":"Attaches to a product whose CRA classification matched the Annex III password managers item, or manually."},"scope":"This standard focuses on password managers. These are designed to securely store\nand retrieve passwords, locally on a device or on a remote server, with a view\nto facilitate password management.\n\n## 1.1 Password managers\n\nPassword managers can be built on top of secret managers and function as a\ncomprehensive management service.\n\nWhen a password manager includes password rotation it transcends being just a\nstorage tool and becomes an active service that proactively manages credentials\nover time, this makes it a management service rather than simply a storage tool.\n\n## 1.2 What is a password\n\nPasswords are typically associated with user accounts and are a form of secret\nthat users know and use to authenticate themselves to a system. They play a role\nin secure authentication and access control and verify a user's identity or\nauthorisation to access a system or resource. They are integrated into\napplications, systems and services to verify user identity during login\nprocesses. The activity of using a password is the entering of this secret\ninformation at authentication points to gain authorised access to protected\ninformation.\n\n## 1.3 Use cases\n\nPassword managers can be characterized along several dimensions that influence\nhow users interact with them and the benefits they provide. At a high level,\nthese tools address distinct user segments: solutions for individual use,\nsolutions for family groups that require selective sharing while preserving\nprivacy, and basic enterprise configurations in which credentials may be\ninjected into connections dynamically to provide a transparent experience for\nend users.\n\nSynchronization is a central point of differentiation. Some solutions\nsynchronize credentials across devices through general-purpose cloud services,\nenabling access from any device associated with the user’s account. Others\nprovide synchronization that is native to the password manager itself, resulting\nin a more integrated but potentially narrower ecosystem. A third category\ncomprises non-synchronized deployments that operate as resident or standalone\nsystems, retaining all credentials locally on a single device or within a\ndefined environment.\n\nThe deployment model also varies by where the solution resides in the technology\nstack. Browser-integrated managers provide convenience for web authentication.\nOperating system level managers offer deeper integration across applications and\nservices. Standalone managers operate as independent applications, typically\noffering greater flexibility and feature breadth, while requiring separate\nmanagement by the user. The boundary between browser level and operating system\nlevel solutions has become increasingly indistinct as platform integrations have\ndeepened.\n\nOn mobile platforms, this integration manifests differently across ecosystems.\nSome provide a native keychain-style service with cloud-backed synchronization,\ndelivering a uniform experience across devices within that ecosystem. Others\nadopt a more open model in which the password management provider may be\nselected from multiple services through system APIs or plugins, increasing\nchoice but potentially creating ambiguity about which component is responsible\nfor managing credentials.\n\nThese distinctions reflect the evolution of password management from a basic\nbrowser convenience to a mature security capability. Each approach entails\nspecific tradeoffs among convenience, security, and flexibility. For the\npurposes of scope, this document considers solutions across these user segments,\nsynchronization models, and deployment models, with particular attention to the\ninteractions and overlaps among them.","applicabilityIntro":"In accordance with the proportionality principle mandated by the CRA, this\nclause defines representative use cases for password managers. These use cases\nillustrate typical deployment contexts that influence the selection and\napplicability of security requirements.\n\nEach use case is associated with a general risk level, derived directly from the\napplication of the risk assessment methodology detailed in Annex A. This risk\nmanagement level serves as a foundational element for determining the stringency\nof security requirements. While these use cases are representative, specific\ndeployment scenarios will necessitate a more granular and detailed risk\nassessment, also guided by Annex A.\n\n### 4.4.1 Universal Security Requirements\n\nAll password manager implementations, regardless of deployment model or use\ncase, SHALL implement the following baseline security controls:\n\n- **Fundamental Security Controls** - **Encryption at Rest**: All stored\ncredentials and sensitive metadata SHALL be encrypted using approved algorithms\n(minimum AES-256) with authenticated encryption modes\n- **Authenticated Access**: Every access to the password store SHALL require explicit\nauthentication, with no bypass mechanisms permitted for convenience\n- **Secure Key Derivation**: Master passwords SHALL be processed through computationally\nintensive key derivation functions\n - **Memory Protection**: Decrypted credentials SHALL be cleared from\nmemory immediately after use\n- **Transport Security**: All network communications SHALL utilize TLS 1.3 or higher with\ncertificate validation","useCases":[{"id":"UC-PM1","title":"Personal Password Manager on User Laptop","description":"**Description**: Individual consumer using password manager for personal\ncredential management across online services, financial accounts, and digital\nsubscriptions on their primary computing device.\n\n**Example Environments**: - Home office laptop with mixed personal/professional\nuse - Personal MacBook with iCloud Keychain - Windows laptop with third-party\npassword manager - Linux workstation with open-source solution\n\n**Security Characteristics**: Single user trust model; limited IT expertise;\nconsumer-grade threat profile; convenience prioritized with security defaults\n\n**Risk Level**: MEDIUM (See Annex B.1)"},{"id":"UC-PM2","title":"Enterprise Private Cloud Password Manager","description":"**Description**: Organization-hosted password management infrastructure deployed\nin private cloud or on-premises data center, providing complete control over\ndata residency and security implementation.\n\n**Example Environments**: - VMware private cloud deployment - OpenStack\ninfrastructure - Kubernetes containerized deployment - Hybrid cloud with\nsensitive data on-premises\n\n**Security Characteristics**: Full organizational control; compliance with data\nsovereignty requirements; integration with existing security infrastructure;\ndedicated security team management\n\n**Risk Level**: HIGH (See Annex B.2)"},{"id":"UC-PM3","title":"Cloud Password Manager with Local Caching","description":"**Description**: Cloud-first architecture with intelligent local caching for\nfrequently accessed credentials, optimizing performance while maintaining\ncloud-based management and backup.\n\n**Example Environments**: - Sales team with mobile devices and intermittent\nconnectivity - International travelers requiring offline access - Branch offices\nwith unreliable internet - Emergency response teams in field operations\n\n**Security Characteristics**: Selective sync based on access patterns; encrypted\ncache with TTL; conflict resolution protocols; bandwidth-optimized\nsynchronization\n\n**Risk Level**: HIGH (See Annex B.3)"},{"id":"UC-PM4","title":"Operating System Keychain Integration","description":"**Description**: OS-native credential management leveraging platform security\nfeatures, kernel-level protection, and hardware security modules for system-wide\npassword management.\n\n**Example Environments**: - macOS Keychain with TouchID/FaceID - Windows\nCredential Manager with Windows Hello - Linux Secret Service with GNOME\nKeyring - Android/iOS system credential stores\n\n**Security Characteristics**: OS-level encryption; biometric authentication;\ninter-application credential sharing; platform-specific security models\n\n**Risk Level**: MEDIUM (See Annex B.4)"},{"id":"UC-PM5","title":"Family Password Manager with Parental Controls","description":"**Description**: Multi-user password manager supporting family groups with\nhierarchical access control, allowing parents to manage children's passwords\nwhile teaching security practices.\n\n**Example Environments**: - Shared family computer with multiple user profiles -\nParent-managed passwords for children's educational accounts - Shared streaming\nservice credentials - Emergency access to family member accounts\n\n**Security Characteristics**: Role-based access (parent/teen/child);\nage-appropriate interfaces; shared vault separation; inheritance planning\nfeatures\n\n**Risk Level**: MEDIUM (See Annex B.5)"},{"id":"UC-PM6","title":"Industrial OT Password Management","description":"**Description**: Specialized password manager for operational technology\nenvironments, managing credentials for industrial control systems, SCADA\nnetworks, and critical infrastructure with air-gap requirements.\n\n**Example Environments**: - Manufacturing plant floor systems - Power grid\ncontrol systems - Water treatment facility SCADA - Transportation system\ncontrollers\n\n**Security Characteristics**: Air-gapped operation mandatory; change control\nworkflows; dual-person authentication; audit logging for compliance; emergency\nbreak-glass procedures\n\n**Risk Level**: CRITICAL (See Annex B.6)"}],"craMap":[{"craRef":"No known exploitable vulnerabilities","clauses":"R16.1b; R16.2; R16.4"},{"craRef":"Secure design, development, production","clauses":"R1.1; R2.2; R8.1a; R8.3a; R9.1a; R9.1b; R10.1"},{"craRef":"Secure by default configuration","clauses":"R18.1a; R18.2; R18.3"},{"craRef":"Secure updates","clauses":"R16.1a; R16.1b; R16.2; R16.3; R16.4"},{"craRef":"Authentication and access control mechanisms","clauses":"R1.1; R1.5a; R11.1; R11.2; R11.3; R11.4a; R12.1; R12.2a; R12.2b"},{"craRef":"Confidentiality protection","clauses":"R2.1a; R2.5; R13.1; R13.2; R13.3"},{"craRef":"Integrity protection for data and configuration","clauses":"R2.2b; R9.1b; R9.4; R17.3; R17.4"},{"craRef":"Data minimization","clauses":"R13.4c"},{"craRef":"Availability protection","clauses":"R14.1; R14.2a; R14.3; R14.4"},{"craRef":"Minimize impact on other devices or services","clauses":"R8.1b; R8.3b"},{"craRef":"Limit attack surface","clauses":"R3.4; R5.1; R18.2"},{"craRef":"Exploit mitigation by limiting incident impact","clauses":"R4.2a; R4.2b; R5.2b; R6.5; R9.2; R9.3"},{"craRef":"Logging and monitoring mechanisms","clauses":"R4.5; R5.3; R15.1; R15.2; R15.3a; R15.3b; R15.4a"},{"craRef":"Secure deletion and data transfer","clauses":"R4.3; R13.4a; R13.4b; R13.4c"}],"topics":[{"id":"5.1","clause":"5.1","title":"Master Password Authentication","overview":"Capability: Password manager employs master password authentication mechanism for primary access control.\n\nCondition: Master password authentication mechanism exposed without adequate protection against brute force or credential attacks.\n\nThreat:\n-   **T1.1**: Offline brute force attacks against encrypted vaults\n-   **T1.2**: Online credential stuffing and password spraying attacks\n-   **T1.3**: Shoulder surfing and keylogger-based credential theft\n-   **T1.4**: Memory scraping attacks targeting master password in RAM\n\nRisk: **HIGH** - Compromise of master password provides complete access to all stored credentials. Likelihood elevated due to targeted nature of password manager attacks.","addressedBy":[],"otherRequirements":[],"requirements":[{"id":"R1.1","clauseRef":"5.1","requirement":"SHALL implement key derivation function (KDF) with minimum 100,000 iterations (PBKDF2) or equivalent computational cost","applicability":{},"applicabilityText":"Capability: Password manager employs master password authentication mechanism for primary access control.\n\nCondition: Master password authentication mechanism exposed without adequate protection against brute force or credential attacks.","assessment":null},{"id":"R1.2","clauseRef":"5.1","requirement":"SHALL enforce minimum master password complexity (12+ characters, multiple character classes)","applicability":{},"applicabilityText":"Capability: Password manager employs master password authentication mechanism for primary access control.\n\nCondition: Master password authentication mechanism exposed without adequate protection against brute force or credential attacks.","assessment":null},{"id":"R1.3","clauseRef":"5.1","requirement":"SHALL implement exponential backoff for failed authentication attempts","applicability":{},"applicabilityText":"Capability: Password manager employs master password authentication mechanism for primary access control.\n\nCondition: Master password authentication mechanism exposed without adequate protection against brute force or credential attacks.","assessment":null},{"id":"R1.4","clauseRef":"5.1","requirement":"SHALL clear master password from memory immediately after use","applicability":{},"applicabilityText":"Capability: Password manager employs master password authentication mechanism for primary access control.\n\nCondition: Master password authentication mechanism exposed without adequate protection against brute force or credential attacks.","assessment":null},{"id":"R1.5a","clauseRef":"5.1","requirement":"SHALL support multi-factor authentication as mandatory option","applicability":{},"applicabilityText":"Capability: Password manager employs master password authentication mechanism for primary access control.\n\nCondition: Master password authentication mechanism exposed without adequate protection against brute force or credential attacks.","assessment":null},{"id":"R1.5b","clauseRef":"5.1","requirement":"SHALL mask password entry fields","applicability":{},"applicabilityText":"Capability: Password manager employs master password authentication mechanism for primary access control.\n\nCondition: Master password authentication mechanism exposed without adequate protection against brute force or credential attacks.","assessment":null}]},{"id":"5.2","clause":"5.2","title":"Password Database Storage","overview":"Capability: Encrypted storage mechanism for password database (local storage or cloud synchronization).\n\nCondition: Password database stored or transmitted with insufficient encryption or key management practices.\n\nThreat:\n-   **T2.1**: Database exfiltration through file system access\n-   **T2.2**: Man-in-the-middle attacks during cloud synchronization\n-   **T2.3**: Cryptographic downgrade attacks\n-   **T2.4**: Side-channel attacks against encryption implementation\n\nRisk: **CRITICAL** - Database contains all user credentials. Impact is catastrophic if encryption is compromised.","addressedBy":[],"otherRequirements":[],"requirements":[{"id":"R2.1a","clauseRef":"5.2","requirement":"SHALL use symmetric block cipher approved encryption algorithm","applicability":{},"applicabilityText":"Capability: Encrypted storage mechanism for password database (local storage or cloud synchronization).\n\nCondition: Password database stored or transmitted with insufficient encryption or key management practices.","assessment":null},{"id":"R2.1b","clauseRef":"5.2","requirement":"SHALL use unique salts per database","applicability":{},"applicabilityText":"Capability: Encrypted storage mechanism for password database (local storage or cloud synchronization).\n\nCondition: Password database stored or transmitted with insufficient encryption or key management practices.","assessment":null},{"id":"R2.2","clauseRef":"5.2","requirement":"SHALL implement authenticated encryption (AEAD) to ensure integrity","applicability":{},"applicabilityText":"Capability: Encrypted storage mechanism for password database (local storage or cloud synchronization).\n\nCondition: Password database stored or transmitted with insufficient encryption or key management practices.","assessment":null},{"id":"R2.2b","clauseRef":"5.2","requirement":"SHALL implement secure key derivation separate from authentication","applicability":{},"applicabilityText":"Capability: Encrypted storage mechanism for password database (local storage or cloud synchronization).\n\nCondition: Password database stored or transmitted with insufficient encryption or key management practices.","assessment":null},{"id":"R2.3","clauseRef":"5.2","requirement":"SHALL use encryption for all network transmissions","applicability":{},"applicabilityText":"Capability: Encrypted storage mechanism for password database (local storage or cloud synchronization).\n\nCondition: Password database stored or transmitted with insufficient encryption or key management practices.","assessment":null},{"id":"R2.4","clauseRef":"5.2","requirement":"SHALL implement countermeasures against side-channel attacks (constant-time operations, memory access patterns)","applicability":{},"applicabilityText":"Capability: Encrypted storage mechanism for password database (local storage or cloud synchronization).\n\nCondition: Password database stored or transmitted with insufficient encryption or key management practices.","assessment":null}]},{"id":"5.3","clause":"5.3","title":"Auto-fill Functionality","overview":"Capability: Browser integration and automatic credential insertion into web forms.\n\nCondition: Auto-fill mechanism operating without proper origin validation or user confirmation.\n\nThreat:\n-   **T3.1**: Phishing attacks through lookalike domains\n-   **T3.2**: Clickjacking to trigger unintended auto-fill\n-   **T3.3**: Form injection attacks on compromised sites\n-   **T3.4**: Cross-site scripting (XSS) credential theft\n\nRisk: **HIGH** - Auto-fill vulnerabilities enable credential theft at scale. Likelihood high due to prevalence of phishing.","addressedBy":[],"otherRequirements":[],"requirements":[{"id":"R3.1","clauseRef":"5.3","requirement":"SHALL validate exact domain match before auto-fill","applicability":{},"applicabilityText":"Capability: Browser integration and automatic credential insertion into web forms.\n\nCondition: Auto-fill mechanism operating without proper origin validation or user confirmation.","assessment":null},{"id":"R3.2","clauseRef":"5.3","requirement":"SHALL require explicit user interaction for credential insertion","applicability":{},"applicabilityText":"Capability: Browser integration and automatic credential insertion into web forms.\n\nCondition: Auto-fill mechanism operating without proper origin validation or user confirmation.","assessment":null},{"id":"R3.3","clauseRef":"5.3","requirement":"SHALL implement Content Security Policy (CSP) in browser extensions","applicability":{},"applicabilityText":"Capability: Browser integration and automatic credential insertion into web forms.\n\nCondition: Auto-fill mechanism operating without proper origin validation or user confirmation.","assessment":null},{"id":"R3.4","clauseRef":"5.3","requirement":"SHALL maintain domain whitelist/blacklist capability","applicability":{},"applicabilityText":"Capability: Browser integration and automatic credential insertion into web forms.\n\nCondition: Auto-fill mechanism operating without proper origin validation or user confirmation.","assessment":null}]},{"id":"5.4","clause":"5.4","title":"Import/Export Functionality","overview":"Capability: Data portability features allowing credential import from and export to external formats.\n\nCondition: Import/export operations handling sensitive data without adequate protection or validation.\n\nThreat:\n-   **T4.1**: Plaintext credential exposure during export\n-   **T4.2**: Malicious data injection through crafted import files\n-   **T4.3**: Format confusion attacks\n-   **T4.4**: Temporary file forensic recovery\n\nRisk: **MEDIUM** - Feature typically used infrequently but presents data exposure risk. Impact high if exploited.","addressedBy":[],"otherRequirements":[],"requirements":[{"id":"R4.1","clauseRef":"5.4","requirement":"SHALL provide encrypted export option as default","applicability":{},"applicabilityText":"Capability: Data portability features allowing credential import from and export to external formats.\n\nCondition: Import/export operations handling sensitive data without adequate protection or validation.","assessment":null},{"id":"R4.2a","clauseRef":"5.4","requirement":"SHALL validate and sanitize all imported data","applicability":{},"applicabilityText":"Capability: Data portability features allowing credential import from and export to external formats.\n\nCondition: Import/export operations handling sensitive data without adequate protection or validation.","assessment":null},{"id":"R4.2b","clauseRef":"5.4","requirement":"SHALL implement format validation and type checking","applicability":{},"applicabilityText":"Capability: Data portability features allowing credential import from and export to external formats.\n\nCondition: Import/export operations handling sensitive data without adequate protection or validation.","assessment":null},{"id":"R4.3","clauseRef":"5.4","requirement":"SHALL securely overwrite temporary files","applicability":{},"applicabilityText":"Capability: Data portability features allowing credential import from and export to external formats.\n\nCondition: Import/export operations handling sensitive data without adequate protection or validation.","assessment":null},{"id":"R4.4","clauseRef":"5.4","requirement":"SHALL require re-authentication for export operations","applicability":{},"applicabilityText":"Capability: Data portability features allowing credential import from and export to external formats.\n\nCondition: Import/export operations handling sensitive data without adequate protection or validation.","assessment":null},{"id":"R4.5","clauseRef":"5.4","requirement":"SHALL log all import/export activities","applicability":{},"applicabilityText":"Capability: Data portability features allowing credential import from and export to external formats.\n\nCondition: Import/export operations handling sensitive data without adequate protection or validation.","assessment":null}]},{"id":"5.5","clause":"5.5","title":"API/CLI Access","overview":"Capability: Programmatic access interface for integration with external systems or automation.\n\nCondition: API exposed without proper authentication, rate limiting, or audit logging.\n\nThreat:\n-   **T5.1**: Automated credential harvesting via API\n-   **T5.2**: Privilege escalation through API vulnerabilities\n-   **T5.3**: Token/session hijacking\n-   **T5.4**: Denial of service through resource exhaustion\n\nRisk: **HIGH** - APIs present expanded attack surface. Automation enables rapid exploitation at scale.","addressedBy":[],"otherRequirements":[],"requirements":[{"id":"R5.1a","clauseRef":"5.5","requirement":"SHALL implement OAuth 2.0 or equivalent secure authentication","applicability":{},"applicabilityText":"Capability: Programmatic access interface for integration with external systems or automation.\n\nCondition: API exposed without proper authentication, rate limiting, or audit logging.","assessment":null},{"id":"R5.1b","clauseRef":"5.5","requirement":"SHALL use short-lived tokens with secure refresh mechanisms","applicability":{},"applicabilityText":"Capability: Programmatic access interface for integration with external systems or automation.\n\nCondition: API exposed without proper authentication, rate limiting, or audit logging.","assessment":null},{"id":"R5.2a","clauseRef":"5.5","requirement":"SHALL enforce rate limiting per endpoint","applicability":{},"applicabilityText":"Capability: Programmatic access interface for integration with external systems or automation.\n\nCondition: API exposed without proper authentication, rate limiting, or audit logging.","assessment":null},{"id":"R5.2b","clauseRef":"5.5","requirement":"SHALL implement principle of least privilege for API permissions","applicability":{},"applicabilityText":"Capability: Programmatic access interface for integration with external systems or automation.\n\nCondition: API exposed without proper authentication, rate limiting, or audit logging.","assessment":null},{"id":"R5.3","clauseRef":"5.5","requirement":"SHALL maintain comprehensive audit logs with tamper protection","applicability":{},"applicabilityText":"Capability: Programmatic access interface for integration with external systems or automation.\n\nCondition: API exposed without proper authentication, rate limiting, or audit logging.","assessment":null},{"id":"R5.4","clauseRef":"5.5","requirement":"SHALL support API key rotation without service disruption","applicability":{},"applicabilityText":"Capability: Programmatic access interface for integration with external systems or automation.\n\nCondition: API exposed without proper authentication, rate limiting, or audit logging.","assessment":null},{"id":"R5.5","clauseRef":"5.5","requirement":"SHALL implement token binding or proof-of-possession mechanisms","applicability":{},"applicabilityText":"Capability: Programmatic access interface for integration with external systems or automation.\n\nCondition: API exposed without proper authentication, rate limiting, or audit logging.","assessment":null}]},{"id":"5.6","clause":"5.6","title":"Backup and Recovery","overview":"Capability: Backup creation and account recovery mechanisms for disaster recovery scenarios.\n\nCondition: Recovery mechanisms that bypass normal security controls or create alternative access paths.\n\nThreat:\n-   **T6.1**: Account takeover through weak recovery processes\n-   **T6.2**: Backup data exposure in less secure locations\n-   **T6.3**: Social engineering targeting recovery procedures\n-   **T6.4**: Recovery code interception or prediction\n\nRisk: **HIGH** - Recovery mechanisms are frequently targeted as the weakest link. Impact equals full account compromise.","addressedBy":[],"otherRequirements":[],"requirements":[{"id":"R6.1","clauseRef":"5.6","requirement":"SHALL encrypt all backup data with same standards as primary database","applicability":{},"applicabilityText":"Capability: Backup creation and account recovery mechanisms for disaster recovery scenarios.\n\nCondition: Recovery mechanisms that bypass normal security controls or create alternative access paths.","assessment":null},{"id":"R6.2a","clauseRef":"5.6","requirement":"SHALL implement multi-factor recovery process","applicability":{},"applicabilityText":"Capability: Backup creation and account recovery mechanisms for disaster recovery scenarios.\n\nCondition: Recovery mechanisms that bypass normal security controls or create alternative access paths.","assessment":null},{"id":"R6.2b","clauseRef":"5.6","requirement":"SHALL implement time-delayed recovery with notification period","applicability":{},"applicabilityText":"Capability: Backup creation and account recovery mechanisms for disaster recovery scenarios.\n\nCondition: Recovery mechanisms that bypass normal security controls or create alternative access paths.","assessment":null},{"id":"R6.3","clauseRef":"5.6","requirement":"SHALL generate cryptographically random recovery codes (minimum 128 bits entropy)","applicability":{},"applicabilityText":"Capability: Backup creation and account recovery mechanisms for disaster recovery scenarios.\n\nCondition: Recovery mechanisms that bypass normal security controls or create alternative access paths.","assessment":null},{"id":"R6.4a","clauseRef":"5.6","requirement":"SHALL notify users of all recovery attempts","applicability":{},"applicabilityText":"Capability: Backup creation and account recovery mechanisms for disaster recovery scenarios.\n\nCondition: Recovery mechanisms that bypass normal security controls or create alternative access paths.","assessment":null},{"id":"R6.4b","clauseRef":"5.6","requirement":"SHALL limit recovery code usage attempts","applicability":{},"applicabilityText":"Capability: Backup creation and account recovery mechanisms for disaster recovery scenarios.\n\nCondition: Recovery mechanisms that bypass normal security controls or create alternative access paths.","assessment":null}]},{"id":"5.7","clause":"5.7","title":"Password Generation","overview":"Capability: Cryptographically secure random password generation with configurable parameters.\n\nCondition: Password generator using predictable or weak randomness sources.\n\nThreat:\n-   **T7.1**: Predictable password generation enabling pre-computation attacks\n-   **T7.2**: Insufficient entropy in generated passwords\n-   **T7.3**: Side-channel leakage of generation parameters\n-   **T7.4**: Compromise of random number generator state\n\nRisk: **MEDIUM** - Weak password generation undermines security premise. Likelihood depends on implementation quality.","addressedBy":[],"otherRequirements":[],"requirements":[{"id":"R7.1","clauseRef":"5.7","requirement":"SHALL use cryptographically secure random number generator (CSRNG)","applicability":{},"applicabilityText":"Capability: Cryptographically secure random password generation with configurable parameters.\n\nCondition: Password generator using predictable or weak randomness sources.","assessment":null},{"id":"R7.2","clauseRef":"5.7","requirement":"SHALL provide minimum acceptable bits of entropy for generated passwords","applicability":{},"applicabilityText":"Capability: Cryptographically secure random password generation with configurable parameters.\n\nCondition: Password generator using predictable or weak randomness sources.","assessment":null},{"id":"R7.3","clauseRef":"5.7","requirement":"SHALL allow user-defined generation parameters","applicability":{},"applicabilityText":"Capability: Cryptographically secure random password generation with configurable parameters.\n\nCondition: Password generator using predictable or weak randomness sources.","assessment":null},{"id":"R7.4","clauseRef":"5.7","requirement":"SHALL implement secure random seed initialization","applicability":{},"applicabilityText":"Capability: Cryptographically secure random password generation with configurable parameters.\n\nCondition: Password generator using predictable or weak randomness sources.","assessment":null},{"id":"R7.5","clauseRef":"5.7","requirement":"SHALL NOT store or log generated passwords before user acceptance","applicability":{},"applicabilityText":"Capability: Cryptographically secure random password generation with configurable parameters.\n\nCondition: Password generator using predictable or weak randomness sources.","assessment":null},{"id":"R7.6","clauseRef":"5.7","requirement":"SHALL implement constant-time generation to prevent timing analysis","applicability":{},"applicabilityText":"Capability: Cryptographically secure random password generation with configurable parameters.\n\nCondition: Password generator using predictable or weak randomness sources.","assessment":null}]},{"id":"5.8","clause":"5.8","title":"Workload Isolation","overview":"Capability: Isolation enforcement between concurrent workloads, administrative functions, and network domains.\n\nCondition: Inadequate separation between concurrently executing workloads (e.g., remote synchronisation and secret injection).\n\nThreat:\n-   **T8.1**: Cross-workload memory access violations\n-   **T8.2**: Execution state interference between processes\n-   **T8.3**: Isolation boundary escape leading to privilege escalation\n-   **T8.4**: Side-channel attacks between isolated components\n\nRisk: **HIGH** - Compromises integrity, confidentiality, and authorization controls. Enables lateral movement between security domains.","addressedBy":[],"otherRequirements":[],"requirements":[{"id":"R8.1a","clauseRef":"5.8","requirement":"SHALL enforce process isolation using OS-level security boundaries","applicability":{},"applicabilityText":"Capability: Isolation enforcement between concurrent workloads, administrative functions, and network domains.\n\nCondition: Inadequate separation between concurrently executing workloads (e.g., remote synchronisation and secret injection).","assessment":null},{"id":"R8.1b","clauseRef":"5.8","requirement":"SHALL prevent unauthorized inter-process communication","applicability":{},"applicabilityText":"Capability: Isolation enforcement between concurrent workloads, administrative functions, and network domains.\n\nCondition: Inadequate separation between concurrently executing workloads (e.g., remote synchronisation and secret injection).","assessment":null},{"id":"R8.2","clauseRef":"5.8","requirement":"SHALL implement separate memory spaces for each workload","applicability":{},"applicabilityText":"Capability: Isolation enforcement between concurrent workloads, administrative functions, and network domains.\n\nCondition: Inadequate separation between concurrently executing workloads (e.g., remote synchronisation and secret injection).","assessment":null},{"id":"R8.3a","clauseRef":"5.8","requirement":"SHALL enforce network segmentation between administrative and user functions","applicability":{},"applicabilityText":"Capability: Isolation enforcement between concurrent workloads, administrative functions, and network domains.\n\nCondition: Inadequate separation between concurrently executing workloads (e.g., remote synchronisation and secret injection).","assessment":null},{"id":"R8.3b","clauseRef":"5.8","requirement":"SHALL monitor and alert on isolation violation attempts","applicability":{},"applicabilityText":"Capability: Isolation enforcement between concurrent workloads, administrative functions, and network domains.\n\nCondition: Inadequate separation between concurrently executing workloads (e.g., remote synchronisation and secret injection).","assessment":null},{"id":"R8.4b","clauseRef":"5.8","requirement":"SHALL implement side-channel resistant isolation (cache partitioning, timing isolation)","applicability":{},"applicabilityText":"Capability: Isolation enforcement between concurrent workloads, administrative functions, and network domains.\n\nCondition: Inadequate separation between concurrently executing workloads (e.g., remote synchronisation and secret injection).","assessment":null}]},{"id":"5.9","clause":"5.9","title":"Platform Integrity","overview":"Capability: Runtime and at-rest integrity protection for platform components and workloads.\n\nCondition: Insufficient protection of user interface or memory buffers against tampering.\n\nThreat:\n-   **T9.1**: Code injection through UI manipulation\n-   **T9.2**: Memory buffer overflow attacks\n-   **T9.3**: Binary patching of core components\n-   **T9.4**: Configuration file tampering\n\nRisk: **HIGH** - Compromises integrity and authorization mechanisms. Enables persistent malware installation.","addressedBy":[],"otherRequirements":[],"requirements":[{"id":"R9.1a","clauseRef":"5.9","requirement":"SHALL implement code signing for all executable components","applicability":{},"applicabilityText":"Capability: Runtime and at-rest integrity protection for platform components and workloads.\n\nCondition: Insufficient protection of user interface or memory buffers against tampering.","assessment":null},{"id":"R9.1b","clauseRef":"5.9","requirement":"SHALL perform runtime integrity checks on critical functions","applicability":{},"applicabilityText":"Capability: Runtime and at-rest integrity protection for platform components and workloads.\n\nCondition: Insufficient protection of user interface or memory buffers against tampering.","assessment":null},{"id":"R9.2","clauseRef":"5.9","requirement":"SHALL use address space layout randomization (ASLR)","applicability":{},"applicabilityText":"Capability: Runtime and at-rest integrity protection for platform components and workloads.\n\nCondition: Insufficient protection of user interface or memory buffers against tampering.","assessment":null},{"id":"R9.3","clauseRef":"5.9","requirement":"SHALL implement buffer overflow protections","applicability":{},"applicabilityText":"Capability: Runtime and at-rest integrity protection for platform components and workloads.\n\nCondition: Insufficient protection of user interface or memory buffers against tampering.","assessment":null},{"id":"R9.4","clauseRef":"5.9","requirement":"SHALL maintain cryptographic hashes of configuration files","applicability":{},"applicabilityText":"Capability: Runtime and at-rest integrity protection for platform components and workloads.\n\nCondition: Insufficient protection of user interface or memory buffers against tampering.","assessment":null}]},{"id":"5.10","clause":"5.10","title":"Platform Attestation","overview":"Capability: Verifiable integrity attestation mechanism for trust establishment.\n\nCondition: Absence of verifiable integrity evidence or attestation mechanisms.\n\nThreat:\n-   **T10.1**: Compromised platform masquerading as trustworthy\n-   **T10.2**: Man-in-the-middle attacks on attestation protocols\n-   **T10.3**: Replay attacks using old attestation tokens\n-   **T10.4**: Attestation bypass through component substitution\n\nRisk: **HIGH** - Undermines entire trust chain. External systems may trust compromised platforms.","addressedBy":[],"otherRequirements":[],"requirements":[{"id":"R10.1","clauseRef":"5.10","requirement":"SHALL generate cryptographically signed attestation reports","applicability":{},"applicabilityText":"Capability: Verifiable integrity attestation mechanism for trust establishment.\n\nCondition: Absence of verifiable integrity evidence or attestation mechanisms.","assessment":null},{"id":"R10.2a","clauseRef":"5.10","requirement":"SHALL include all security-critical components in attestation","applicability":{},"applicabilityText":"Capability: Verifiable integrity attestation mechanism for trust establishment.\n\nCondition: Absence of verifiable integrity evidence or attestation mechanisms.","assessment":null},{"id":"R10.2b","clauseRef":"5.10","requirement":"SHALL support remote attestation verification","applicability":{},"applicabilityText":"Capability: Verifiable integrity attestation mechanism for trust establishment.\n\nCondition: Absence of verifiable integrity evidence or attestation mechanisms.","assessment":null},{"id":"R10.3","clauseRef":"5.10","requirement":"SHALL use hardware-backed attestation where available","applicability":{},"applicabilityText":"Capability: Verifiable integrity attestation mechanism for trust establishment.\n\nCondition: Absence of verifiable integrity evidence or attestation mechanisms.","assessment":null},{"id":"R10.4a","clauseRef":"5.10","requirement":"SHALL implement attestation freshness mechanisms","applicability":{},"applicabilityText":"Capability: Verifiable integrity attestation mechanism for trust establishment.\n\nCondition: Absence of verifiable integrity evidence or attestation mechanisms.","assessment":null},{"id":"R10.4b","clauseRef":"5.10","requirement":"SHALL use mutual authentication for attestation protocols","applicability":{},"applicabilityText":"Capability: Verifiable integrity attestation mechanism for trust establishment.\n\nCondition: Absence of verifiable integrity evidence or attestation mechanisms.","assessment":null}]},{"id":"5.11","clause":"5.11","title":"Administrative Authentication","overview":"Capability: Strong authentication for administrative interfaces and sensitive operations.\n\nCondition: Missing or weak authentication mechanisms for critical functions.\n\nThreat:\n-   **T11.1**: Unauthorized vault access through weak authentication\n-   **T11.2**: Privilege escalation via authentication bypass\n-   **T11.3**: Session hijacking of administrative sessions\n-   **T11.4**: Credential reuse attacks\n\nRisk: **CRITICAL** - Full control of password manager and all stored secrets. Direct path to complete compromise.","addressedBy":[],"otherRequirements":[],"requirements":[{"id":"R11.1","clauseRef":"5.11","requirement":"SHALL enforce multi-factor authentication for administrative access","applicability":{},"applicabilityText":"Capability: Strong authentication for administrative interfaces and sensitive operations.\n\nCondition: Missing or weak authentication mechanisms for critical functions.","assessment":null},{"id":"R11.2","clauseRef":"5.11","requirement":"SHALL implement certificate-based authentication option","applicability":{},"applicabilityText":"Capability: Strong authentication for administrative interfaces and sensitive operations.\n\nCondition: Missing or weak authentication mechanisms for critical functions.","assessment":null},{"id":"R11.3","clauseRef":"5.11","requirement":"SHALL enforce session timeout and re-authentication","applicability":{},"applicabilityText":"Capability: Strong authentication for administrative interfaces and sensitive operations.\n\nCondition: Missing or weak authentication mechanisms for critical functions.","assessment":null},{"id":"R11.4a","clauseRef":"5.11","requirement":"SHALL use separate authentication credentials for administrative functions","applicability":{},"applicabilityText":"Capability: Strong authentication for administrative interfaces and sensitive operations.\n\nCondition: Missing or weak authentication mechanisms for critical functions.","assessment":null},{"id":"R11.4b","clauseRef":"5.11","requirement":"SHALL implement account lockout after failed attempts","applicability":{},"applicabilityText":"Capability: Strong authentication for administrative interfaces and sensitive operations.\n\nCondition: Missing or weak authentication mechanisms for critical functions.","assessment":null}]},{"id":"5.12","clause":"5.12","title":"Access Control","overview":"Capability: Authorization and access control enforcement for functions and data.\n\nCondition: Missing or weak authorization mechanisms within the password manager.\n\nThreat:\n-   **T12.1**: Unauthorized access to shared account credentials\n-   **T12.2**: Privilege escalation within the application\n-   **T12.3**: Bypassing access controls through API manipulation\n-   **T12.4**: Time-of-check to time-of-use (TOCTTOU) vulnerabilities\n\nRisk: **HIGH** - Enables unauthorized access to credentials beyond intended scope. Breaks compartmentalization.","addressedBy":[],"otherRequirements":[],"requirements":[{"id":"R12.1","clauseRef":"5.12","requirement":"SHALL implement role-based access control (RBAC)","applicability":{},"applicabilityText":"Capability: Authorization and access control enforcement for functions and data.\n\nCondition: Missing or weak authorization mechanisms within the password manager.","assessment":null},{"id":"R12.2a","clauseRef":"5.12","requirement":"SHALL enforce least privilege principle for all operations","applicability":{},"applicabilityText":"Capability: Authorization and access control enforcement for functions and data.\n\nCondition: Missing or weak authorization mechanisms within the password manager.","assessment":null},{"id":"R12.2b","clauseRef":"5.12","requirement":"SHALL validate authorization for each sensitive operation","applicability":{},"applicabilityText":"Capability: Authorization and access control enforcement for functions and data.\n\nCondition: Missing or weak authorization mechanisms within the password manager.","assessment":null},{"id":"R12.3a","clauseRef":"5.12","requirement":"SHALL support granular permission assignment","applicability":{},"applicabilityText":"Capability: Authorization and access control enforcement for functions and data.\n\nCondition: Missing or weak authorization mechanisms within the password manager.","assessment":null},{"id":"R12.3b","clauseRef":"5.12","requirement":"SHALL log all authorization decisions and violations","applicability":{},"applicabilityText":"Capability: Authorization and access control enforcement for functions and data.\n\nCondition: Missing or weak authorization mechanisms within the password manager.","assessment":null},{"id":"R12.4","clauseRef":"5.12","requirement":"SHALL implement atomic authorization checks to prevent TOCTTOU","applicability":{},"applicabilityText":"Capability: Authorization and access control enforcement for functions and data.\n\nCondition: Missing or weak authorization mechanisms within the password manager.","assessment":null}]},{"id":"5.13","clause":"5.13","title":"Data Confidentiality","overview":"Capability: Comprehensive encryption for data at rest and in transit.\n\nCondition: Insufficient encryption enforcement, compromised storage, or inadequate network isolation.\n\nThreat:\n-   **T13.1**: Local vault exposure through file system access\n-   **T13.2**: Network interception during synchronization\n-   **T13.3**: Memory dump exposure of decrypted credentials\n-   **T13.4**: Cache and temporary file recovery\n\nRisk: **CRITICAL** - Direct exposure of all stored credentials. Catastrophic impact on user security.","addressedBy":[],"otherRequirements":[],"requirements":[{"id":"R13.1","clauseRef":"5.13","requirement":"SHALL encrypt all data at rest using AES-256 or equivalent","applicability":{},"applicabilityText":"Capability: Comprehensive encryption for data at rest and in transit.\n\nCondition: Insufficient encryption enforcement, compromised storage, or inadequate network isolation.","assessment":null},{"id":"R13.2","clauseRef":"5.13","requirement":"SHALL use TLS 1.3 for all network communications","applicability":{},"applicabilityText":"Capability: Comprehensive encryption for data at rest and in transit.\n\nCondition: Insufficient encryption enforcement, compromised storage, or inadequate network isolation.","assessment":null},{"id":"R13.3","clauseRef":"5.13","requirement":"SHALL implement perfect forward secrecy for communications","applicability":{},"applicabilityText":"Capability: Comprehensive encryption for data at rest and in transit.\n\nCondition: Insufficient encryption enforcement, compromised storage, or inadequate network isolation.","assessment":null},{"id":"R13.4a","clauseRef":"5.13","requirement":"SHALL clear sensitive data from memory after use","applicability":{},"applicabilityText":"Capability: Comprehensive encryption for data at rest and in transit.\n\nCondition: Insufficient encryption enforcement, compromised storage, or inadequate network isolation.","assessment":null},{"id":"R13.4b","clauseRef":"5.13","requirement":"SHALL disable caching of decrypted credentials","applicability":{},"applicabilityText":"Capability: Comprehensive encryption for data at rest and in transit.\n\nCondition: Insufficient encryption enforcement, compromised storage, or inadequate network isolation.","assessment":null}]},{"id":"5.14","clause":"5.14","title":"Availability Protection","overview":"Capability: Resilience against denial of service and resource exhaustion attacks.\n\nCondition: Insufficient protection against resource exhaustion or overwhelming request volumes.\n\nThreat:\n-   **T14.1**: API flooding causing service unavailability\n-   **T14.2**: Resource exhaustion through memory leaks\n-   **T14.3**: CPU exhaustion through computational attacks\n-   **T14.4**: Storage exhaustion through log flooding\n\nRisk: **MEDIUM** - Prevents access to credentials when needed. Critical during incident response scenarios.","addressedBy":[],"otherRequirements":[],"requirements":[{"id":"R14.1","clauseRef":"5.14","requirement":"SHALL implement rate limiting on all interfaces","applicability":{},"applicabilityText":"Capability: Resilience against denial of service and resource exhaustion attacks.\n\nCondition: Insufficient protection against resource exhaustion or overwhelming request volumes.","assessment":null},{"id":"R14.2a","clauseRef":"5.14","requirement":"SHALL enforce resource quotas per user/session","applicability":{},"applicabilityText":"Capability: Resilience against denial of service and resource exhaustion attacks.\n\nCondition: Insufficient protection against resource exhaustion or overwhelming request volumes.","assessment":null},{"id":"R14.2b","clauseRef":"5.14","requirement":"SHALL implement automatic resource cleanup","applicability":{},"applicabilityText":"Capability: Resilience against denial of service and resource exhaustion attacks.\n\nCondition: Insufficient protection against resource exhaustion or overwhelming request volumes.","assessment":null},{"id":"R14.3","clauseRef":"5.14","requirement":"SHALL support graceful degradation under load","applicability":{},"applicabilityText":"Capability: Resilience against denial of service and resource exhaustion attacks.\n\nCondition: Insufficient protection against resource exhaustion or overwhelming request volumes.","assessment":null},{"id":"R14.4","clauseRef":"5.14","requirement":"SHALL maintain service availability monitoring","applicability":{},"applicabilityText":"Capability: Resilience against denial of service and resource exhaustion attacks.\n\nCondition: Insufficient protection against resource exhaustion or overwhelming request volumes.","assessment":null}]},{"id":"5.15","clause":"5.15","title":"Audit Logging","overview":"Capability: Comprehensive security logging with integrity protection.\n\nCondition: Insufficient logging capabilities or unprotected log storage.\n\nThreat:\n-   **T15.1**: Undetected unauthorized access attempts\n-   **T15.2**: Log tampering to hide malicious activities\n-   **T15.3**: Log deletion to prevent forensic analysis\n-   **T15.4**: Log flooding to obscure attacks\n\nRisk: **MEDIUM** - Prevents detection and investigation of security incidents. Enables persistent threats.","addressedBy":[],"otherRequirements":[],"requirements":[{"id":"R15.1","clauseRef":"5.15","requirement":"SHALL log all authentication attempts and outcomes","applicability":{},"applicabilityText":"Capability: Comprehensive security logging with integrity protection.\n\nCondition: Insufficient logging capabilities or unprotected log storage.","assessment":null},{"id":"R15.2","clauseRef":"5.15","requirement":"SHALL log all credential access and modifications","applicability":{},"applicabilityText":"Capability: Comprehensive security logging with integrity protection.\n\nCondition: Insufficient logging capabilities or unprotected log storage.","assessment":null},{"id":"R15.3a","clauseRef":"5.15","requirement":"SHALL implement tamper-evident log storage","applicability":{},"applicabilityText":"Capability: Comprehensive security logging with integrity protection.\n\nCondition: Insufficient logging capabilities or unprotected log storage.","assessment":null},{"id":"R15.3b","clauseRef":"5.15","requirement":"SHALL support secure log export and archival","applicability":{},"applicabilityText":"Capability: Comprehensive security logging with integrity protection.\n\nCondition: Insufficient logging capabilities or unprotected log storage.","assessment":null},{"id":"R15.4a","clauseRef":"5.15","requirement":"SHALL implement log retention policies","applicability":{},"applicabilityText":"Capability: Comprehensive security logging with integrity protection.\n\nCondition: Insufficient logging capabilities or unprotected log storage.","assessment":null},{"id":"R15.4b","clauseRef":"5.15","requirement":"SHALL implement log rotation and size limits to prevent flooding","applicability":{},"applicabilityText":"Capability: Comprehensive security logging with integrity protection.\n\nCondition: Insufficient logging capabilities or unprotected log storage.","assessment":null}]},{"id":"5.16","clause":"5.16","title":"Update Security","overview":"Capability: Secure update and patch management mechanisms.\n\nCondition: Lack of cryptographic validation or rollback protection for updates.\n\nThreat:\n-   **T16.1**: Malicious update injection\n-   **T16.2**: Update replay attacks with vulnerable versions\n-   **T16.3**: Update corruption causing system instability\n-   **T16.4**: Rollback attacks to reintroduce vulnerabilities\n\nRisk: **HIGH** - Compromises entire system integrity. Enables persistent backdoor installation.","addressedBy":[],"otherRequirements":[],"requirements":[{"id":"R16.1a","clauseRef":"5.16","requirement":"SHALL cryptographically sign all update packages","applicability":{},"applicabilityText":"Capability: Secure update and patch management mechanisms.\n\nCondition: Lack of cryptographic validation or rollback protection for updates.","assessment":null},{"id":"R16.1b","clauseRef":"5.16","requirement":"SHALL verify signatures before applying updates","applicability":{},"applicabilityText":"Capability: Secure update and patch management mechanisms.\n\nCondition: Lack of cryptographic validation or rollback protection for updates.","assessment":null},{"id":"R16.2","clauseRef":"5.16","requirement":"SHALL implement secure rollback mechanisms","applicability":{},"applicabilityText":"Capability: Secure update and patch management mechanisms.\n\nCondition: Lack of cryptographic validation or rollback protection for updates.","assessment":null},{"id":"R16.3","clauseRef":"5.16","requirement":"SHALL maintain update audit trail","applicability":{},"applicabilityText":"Capability: Secure update and patch management mechanisms.\n\nCondition: Lack of cryptographic validation or rollback protection for updates.","assessment":null},{"id":"R16.4","clauseRef":"5.16","requirement":"SHALL include version checking to prevent downgrade attacks","applicability":{},"applicabilityText":"Capability: Secure update and patch management mechanisms.\n\nCondition: Lack of cryptographic validation or rollback protection for updates.","assessment":null}]},{"id":"5.17","clause":"5.17","title":"Configuration Security","overview":"Capability: Protected configuration management and change control.\n\nCondition: Insufficient protection of configuration interfaces or files.\n\nThreat:\n-   **T17.1**: Unauthorized security setting modifications\n-   **T17.2**: Configuration injection attacks\n-   **T17.3**: Privilege escalation through configuration manipulation\n-   **T17.4**: Configuration drift from secure baseline\n\nRisk: **HIGH** - Weakens overall security posture. Enables bypass of security controls.","addressedBy":[],"otherRequirements":[],"requirements":[{"id":"R17.1a","clauseRef":"5.17","requirement":"SHALL protect configuration files with appropriate permissions","applicability":{},"applicabilityText":"Capability: Protected configuration management and change control.\n\nCondition: Insufficient protection of configuration interfaces or files.","assessment":null},{"id":"R17.1b","clauseRef":"5.17","requirement":"SHALL require authentication for configuration changes","applicability":{},"applicabilityText":"Capability: Protected configuration management and change control.\n\nCondition: Insufficient protection of configuration interfaces or files.","assessment":null},{"id":"R17.2","clauseRef":"5.17","requirement":"SHALL validate all configuration inputs","applicability":{},"applicabilityText":"Capability: Protected configuration management and change control.\n\nCondition: Insufficient protection of configuration interfaces or files.","assessment":null},{"id":"R17.3","clauseRef":"5.17","requirement":"SHALL maintain configuration change history","applicability":{},"applicabilityText":"Capability: Protected configuration management and change control.\n\nCondition: Insufficient protection of configuration interfaces or files.","assessment":null},{"id":"R17.4","clauseRef":"5.17","requirement":"SHALL support configuration integrity monitoring","applicability":{},"applicabilityText":"Capability: Protected configuration management and change control.\n\nCondition: Insufficient protection of configuration interfaces or files.","assessment":null}]},{"id":"5.18","clause":"5.18","title":"Secure Defaults","overview":"Capability: Security-by-default configuration and minimal attack surface. [Hard requirement of the Regulation]\n\nCondition: Product shipped with insecure default settings requiring manual hardening.\n\nThreat:\n-   **T18.1**: Default credentials enabling immediate compromise\n-   **T18.2**: Unnecessary services exposed by default\n-   **T18.3**: Weak cryptographic defaults\n-   **T18.4**: Overly permissive default access controls\n\nRisk: **MEDIUM** - Many deployments never change defaults. Provides easy initial compromise vector.","addressedBy":[],"otherRequirements":[],"requirements":[{"id":"R18.1a","clauseRef":"5.18","requirement":"SHALL enforce secure defaults without user intervention","applicability":{},"applicabilityText":"Capability: Security-by-default configuration and minimal attack surface. [Hard requirement of the Regulation]\n\nCondition: Product shipped with insecure default settings requiring manual hardening.","assessment":null},{"id":"R18.1b","clauseRef":"5.18","requirement":"SHALL require password change on first use","applicability":{},"applicabilityText":"Capability: Security-by-default configuration and minimal attack surface. [Hard requirement of the Regulation]\n\nCondition: Product shipped with insecure default settings requiring manual hardening.","assessment":null},{"id":"R18.2","clauseRef":"5.18","requirement":"SHALL disable unnecessary features by default","applicability":{},"applicabilityText":"Capability: Security-by-default configuration and minimal attack surface. [Hard requirement of the Regulation]\n\nCondition: Product shipped with insecure default settings requiring manual hardening.","assessment":null},{"id":"R18.3","clauseRef":"5.18","requirement":"SHALL use strongest available cryptography by default","applicability":{},"applicabilityText":"Capability: Security-by-default configuration and minimal attack surface. [Hard requirement of the Regulation]\n\nCondition: Product shipped with insecure default settings requiring manual hardening.","assessment":null},{"id":"R18.4","clauseRef":"5.18","requirement":"SHALL provide security hardening guide","applicability":{},"applicabilityText":"Capability: Security-by-default configuration and minimal attack surface. [Hard requirement of the Regulation]\n\nCondition: Product shipped with insecure default settings requiring manual hardening.","assessment":null}]},{"id":"5.19","clause":"5.19","title":"Time Synchronization","overview":"Capability: Accurate and secure time synchronization for security operations.\n\nCondition: Unprotected or unreliable time source mechanisms.\n\nThreat:\n-   **T19.1**: Log timestamp manipulation hiding attack timeline\n-   **T19.2**: Token expiry bypass through time manipulation\n-   **T19.3**: Certificate validation bypass via time shifting\n-   **T19.4**: Password rotation schedule disruption\n\nRisk: **MEDIUM** - Undermines time-based security controls. Complicates incident investigation.","addressedBy":[],"otherRequirements":[],"requirements":[{"id":"R19.1","clauseRef":"5.19","requirement":"SHALL use authenticated NTP or equivalent protocol","applicability":{},"applicabilityText":"Capability: Accurate and secure time synchronization for security operations.\n\nCondition: Unprotected or unreliable time source mechanisms.","assessment":null},{"id":"R19.2a","clauseRef":"5.19","requirement":"SHALL validate time source authenticity","applicability":{},"applicabilityText":"Capability: Accurate and secure time synchronization for security operations.\n\nCondition: Unprotected or unreliable time source mechanisms.","assessment":null},{"id":"R19.2b","clauseRef":"5.19","requirement":"SHALL detect and alert on significant time changes","applicability":{},"applicabilityText":"Capability: Accurate and secure time synchronization for security operations.\n\nCondition: Unprotected or unreliable time source mechanisms.","assessment":null},{"id":"R19.3","clauseRef":"5.19","requirement":"SHALL maintain monotonic clock for security events","applicability":{},"applicabilityText":"Capability: Accurate and secure time synchronization for security operations.\n\nCondition: Unprotected or unreliable time source mechanisms.","assessment":null},{"id":"R19.4","clauseRef":"5.19","requirement":"SHALL implement time synchronization monitoring","applicability":{},"applicabilityText":"Capability: Accurate and secure time synchronization for security operations.\n\nCondition: Unprotected or unreliable time source mechanisms.","assessment":null}]}],"rdps":{"applicability":"","families":[],"requirements":[]},"threats":[{"id":"T1.1","title":"Offline brute force attacks against encrypted vaults","description":"Identified in clause 5.1 (Master Password Authentication). Risk: **HIGH** - Compromise of master password provides complete access to all stored credentials. Likelihood elevated due to targeted nature of password manager attacks."},{"id":"T1.2","title":"Online credential stuffing and password spraying attacks","description":"Identified in clause 5.1 (Master Password Authentication). Risk: **HIGH** - Compromise of master password provides complete access to all stored credentials. Likelihood elevated due to targeted nature of password manager attacks."},{"id":"T1.3","title":"Shoulder surfing and keylogger-based credential theft","description":"Identified in clause 5.1 (Master Password Authentication). Risk: **HIGH** - Compromise of master password provides complete access to all stored credentials. Likelihood elevated due to targeted nature of password manager attacks."},{"id":"T1.4","title":"Memory scraping attacks targeting master password in RAM","description":"Identified in clause 5.1 (Master Password Authentication). Risk: **HIGH** - Compromise of master password provides complete access to all stored credentials. Likelihood elevated due to targeted nature of password manager attacks."},{"id":"T2.1","title":"Database exfiltration through file system access","description":"Identified in clause 5.2 (Password Database Storage). Risk: **CRITICAL** - Database contains all user credentials. Impact is catastrophic if encryption is compromised."},{"id":"T2.2","title":"Man-in-the-middle attacks during cloud synchronization","description":"Identified in clause 5.2 (Password Database Storage). Risk: **CRITICAL** - Database contains all user credentials. Impact is catastrophic if encryption is compromised."},{"id":"T2.3","title":"Cryptographic downgrade attacks","description":"Identified in clause 5.2 (Password Database Storage). Risk: **CRITICAL** - Database contains all user credentials. Impact is catastrophic if encryption is compromised."},{"id":"T2.4","title":"Side-channel attacks against encryption implementation","description":"Identified in clause 5.2 (Password Database Storage). Risk: **CRITICAL** - Database contains all user credentials. Impact is catastrophic if encryption is compromised."},{"id":"T3.1","title":"Phishing attacks through lookalike domains","description":"Identified in clause 5.3 (Auto-fill Functionality). Risk: **HIGH** - Auto-fill vulnerabilities enable credential theft at scale. Likelihood high due to prevalence of phishing."},{"id":"T3.2","title":"Clickjacking to trigger unintended auto-fill","description":"Identified in clause 5.3 (Auto-fill Functionality). Risk: **HIGH** - Auto-fill vulnerabilities enable credential theft at scale. Likelihood high due to prevalence of phishing."},{"id":"T3.3","title":"Form injection attacks on compromised sites","description":"Identified in clause 5.3 (Auto-fill Functionality). Risk: **HIGH** - Auto-fill vulnerabilities enable credential theft at scale. Likelihood high due to prevalence of phishing."},{"id":"T3.4","title":"Cross-site scripting (XSS) credential theft","description":"Identified in clause 5.3 (Auto-fill Functionality). Risk: **HIGH** - Auto-fill vulnerabilities enable credential theft at scale. Likelihood high due to prevalence of phishing."},{"id":"T4.1","title":"Plaintext credential exposure during export","description":"Identified in clause 5.4 (Import/Export Functionality). Risk: **MEDIUM** - Feature typically used infrequently but presents data exposure risk. Impact high if exploited."},{"id":"T4.2","title":"Malicious data injection through crafted import files","description":"Identified in clause 5.4 (Import/Export Functionality). Risk: **MEDIUM** - Feature typically used infrequently but presents data exposure risk. Impact high if exploited."},{"id":"T4.3","title":"Format confusion attacks","description":"Identified in clause 5.4 (Import/Export Functionality). Risk: **MEDIUM** - Feature typically used infrequently but presents data exposure risk. Impact high if exploited."},{"id":"T4.4","title":"Temporary file forensic recovery","description":"Identified in clause 5.4 (Import/Export Functionality). Risk: **MEDIUM** - Feature typically used infrequently but presents data exposure risk. Impact high if exploited."},{"id":"T5.1","title":"Automated credential harvesting via API","description":"Identified in clause 5.5 (API/CLI Access). Risk: **HIGH** - APIs present expanded attack surface. Automation enables rapid exploitation at scale."},{"id":"T5.2","title":"Privilege escalation through API vulnerabilities","description":"Identified in clause 5.5 (API/CLI Access). Risk: **HIGH** - APIs present expanded attack surface. Automation enables rapid exploitation at scale."},{"id":"T5.3","title":"Token/session hijacking","description":"Identified in clause 5.5 (API/CLI Access). Risk: **HIGH** - APIs present expanded attack surface. Automation enables rapid exploitation at scale."},{"id":"T5.4","title":"Denial of service through resource exhaustion","description":"Identified in clause 5.5 (API/CLI Access). Risk: **HIGH** - APIs present expanded attack surface. Automation enables rapid exploitation at scale."},{"id":"T6.1","title":"Account takeover through weak recovery processes","description":"Identified in clause 5.6 (Backup and Recovery). Risk: **HIGH** - Recovery mechanisms are frequently targeted as the weakest link. Impact equals full account compromise."},{"id":"T6.2","title":"Backup data exposure in less secure locations","description":"Identified in clause 5.6 (Backup and Recovery). Risk: **HIGH** - Recovery mechanisms are frequently targeted as the weakest link. Impact equals full account compromise."},{"id":"T6.3","title":"Social engineering targeting recovery procedures","description":"Identified in clause 5.6 (Backup and Recovery). Risk: **HIGH** - Recovery mechanisms are frequently targeted as the weakest link. Impact equals full account compromise."},{"id":"T6.4","title":"Recovery code interception or prediction","description":"Identified in clause 5.6 (Backup and Recovery). Risk: **HIGH** - Recovery mechanisms are frequently targeted as the weakest link. Impact equals full account compromise."},{"id":"T7.1","title":"Predictable password generation enabling pre-computation attacks","description":"Identified in clause 5.7 (Password Generation). Risk: **MEDIUM** - Weak password generation undermines security premise. Likelihood depends on implementation quality."},{"id":"T7.2","title":"Insufficient entropy in generated passwords","description":"Identified in clause 5.7 (Password Generation). Risk: **MEDIUM** - Weak password generation undermines security premise. Likelihood depends on implementation quality."},{"id":"T7.3","title":"Side-channel leakage of generation parameters","description":"Identified in clause 5.7 (Password Generation). Risk: **MEDIUM** - Weak password generation undermines security premise. Likelihood depends on implementation quality."},{"id":"T7.4","title":"Compromise of random number generator state","description":"Identified in clause 5.7 (Password Generation). Risk: **MEDIUM** - Weak password generation undermines security premise. Likelihood depends on implementation quality."},{"id":"T8.1","title":"Cross-workload memory access violations","description":"Identified in clause 5.8 (Workload Isolation). Risk: **HIGH** - Compromises integrity, confidentiality, and authorization controls. Enables lateral movement between security domains."},{"id":"T8.2","title":"Execution state interference between processes","description":"Identified in clause 5.8 (Workload Isolation). Risk: **HIGH** - Compromises integrity, confidentiality, and authorization controls. Enables lateral movement between security domains."},{"id":"T8.3","title":"Isolation boundary escape leading to privilege escalation","description":"Identified in clause 5.8 (Workload Isolation). Risk: **HIGH** - Compromises integrity, confidentiality, and authorization controls. Enables lateral movement between security domains."},{"id":"T8.4","title":"Side-channel attacks between isolated components","description":"Identified in clause 5.8 (Workload Isolation). Risk: **HIGH** - Compromises integrity, confidentiality, and authorization controls. Enables lateral movement between security domains."},{"id":"T9.1","title":"Code injection through UI manipulation","description":"Identified in clause 5.9 (Platform Integrity). Risk: **HIGH** - Compromises integrity and authorization mechanisms. Enables persistent malware installation."},{"id":"T9.2","title":"Memory buffer overflow attacks","description":"Identified in clause 5.9 (Platform Integrity). Risk: **HIGH** - Compromises integrity and authorization mechanisms. Enables persistent malware installation."},{"id":"T9.3","title":"Binary patching of core components","description":"Identified in clause 5.9 (Platform Integrity). Risk: **HIGH** - Compromises integrity and authorization mechanisms. Enables persistent malware installation."},{"id":"T9.4","title":"Configuration file tampering","description":"Identified in clause 5.9 (Platform Integrity). Risk: **HIGH** - Compromises integrity and authorization mechanisms. Enables persistent malware installation."},{"id":"T10.1","title":"Compromised platform masquerading as trustworthy","description":"Identified in clause 5.10 (Platform Attestation). Risk: **HIGH** - Undermines entire trust chain. External systems may trust compromised platforms."},{"id":"T10.2","title":"Man-in-the-middle attacks on attestation protocols","description":"Identified in clause 5.10 (Platform Attestation). Risk: **HIGH** - Undermines entire trust chain. External systems may trust compromised platforms."},{"id":"T10.3","title":"Replay attacks using old attestation tokens","description":"Identified in clause 5.10 (Platform Attestation). Risk: **HIGH** - Undermines entire trust chain. External systems may trust compromised platforms."},{"id":"T10.4","title":"Attestation bypass through component substitution","description":"Identified in clause 5.10 (Platform Attestation). Risk: **HIGH** - Undermines entire trust chain. External systems may trust compromised platforms."},{"id":"T11.1","title":"Unauthorized vault access through weak authentication","description":"Identified in clause 5.11 (Administrative Authentication). Risk: **CRITICAL** - Full control of password manager and all stored secrets. Direct path to complete compromise."},{"id":"T11.2","title":"Privilege escalation via authentication bypass","description":"Identified in clause 5.11 (Administrative Authentication). Risk: **CRITICAL** - Full control of password manager and all stored secrets. Direct path to complete compromise."},{"id":"T11.3","title":"Session hijacking of administrative sessions","description":"Identified in clause 5.11 (Administrative Authentication). Risk: **CRITICAL** - Full control of password manager and all stored secrets. Direct path to complete compromise."},{"id":"T11.4","title":"Credential reuse attacks","description":"Identified in clause 5.11 (Administrative Authentication). Risk: **CRITICAL** - Full control of password manager and all stored secrets. Direct path to complete compromise."},{"id":"T12.1","title":"Unauthorized access to shared account credentials","description":"Identified in clause 5.12 (Access Control). Risk: **HIGH** - Enables unauthorized access to credentials beyond intended scope. Breaks compartmentalization."},{"id":"T12.2","title":"Privilege escalation within the application","description":"Identified in clause 5.12 (Access Control). Risk: **HIGH** - Enables unauthorized access to credentials beyond intended scope. Breaks compartmentalization."},{"id":"T12.3","title":"Bypassing access controls through API manipulation","description":"Identified in clause 5.12 (Access Control). Risk: **HIGH** - Enables unauthorized access to credentials beyond intended scope. Breaks compartmentalization."},{"id":"T12.4","title":"Time-of-check to time-of-use (TOCTTOU) vulnerabilities","description":"Identified in clause 5.12 (Access Control). Risk: **HIGH** - Enables unauthorized access to credentials beyond intended scope. Breaks compartmentalization."},{"id":"T13.1","title":"Local vault exposure through file system access","description":"Identified in clause 5.13 (Data Confidentiality). Risk: **CRITICAL** - Direct exposure of all stored credentials. Catastrophic impact on user security."},{"id":"T13.2","title":"Network interception during synchronization","description":"Identified in clause 5.13 (Data Confidentiality). Risk: **CRITICAL** - Direct exposure of all stored credentials. Catastrophic impact on user security."},{"id":"T13.3","title":"Memory dump exposure of decrypted credentials","description":"Identified in clause 5.13 (Data Confidentiality). Risk: **CRITICAL** - Direct exposure of all stored credentials. Catastrophic impact on user security."},{"id":"T13.4","title":"Cache and temporary file recovery","description":"Identified in clause 5.13 (Data Confidentiality). Risk: **CRITICAL** - Direct exposure of all stored credentials. Catastrophic impact on user security."},{"id":"T14.1","title":"API flooding causing service unavailability","description":"Identified in clause 5.14 (Availability Protection). Risk: **MEDIUM** - Prevents access to credentials when needed. Critical during incident response scenarios."},{"id":"T14.2","title":"Resource exhaustion through memory leaks","description":"Identified in clause 5.14 (Availability Protection). Risk: **MEDIUM** - Prevents access to credentials when needed. Critical during incident response scenarios."},{"id":"T14.3","title":"CPU exhaustion through computational attacks","description":"Identified in clause 5.14 (Availability Protection). Risk: **MEDIUM** - Prevents access to credentials when needed. Critical during incident response scenarios."},{"id":"T14.4","title":"Storage exhaustion through log flooding","description":"Identified in clause 5.14 (Availability Protection). Risk: **MEDIUM** - Prevents access to credentials when needed. Critical during incident response scenarios."},{"id":"T15.1","title":"Undetected unauthorized access attempts","description":"Identified in clause 5.15 (Audit Logging). Risk: **MEDIUM** - Prevents detection and investigation of security incidents. Enables persistent threats."},{"id":"T15.2","title":"Log tampering to hide malicious activities","description":"Identified in clause 5.15 (Audit Logging). Risk: **MEDIUM** - Prevents detection and investigation of security incidents. Enables persistent threats."},{"id":"T15.3","title":"Log deletion to prevent forensic analysis","description":"Identified in clause 5.15 (Audit Logging). Risk: **MEDIUM** - Prevents detection and investigation of security incidents. Enables persistent threats."},{"id":"T15.4","title":"Log flooding to obscure attacks","description":"Identified in clause 5.15 (Audit Logging). Risk: **MEDIUM** - Prevents detection and investigation of security incidents. Enables persistent threats."},{"id":"T16.1","title":"Malicious update injection","description":"Identified in clause 5.16 (Update Security). Risk: **HIGH** - Compromises entire system integrity. Enables persistent backdoor installation."},{"id":"T16.2","title":"Update replay attacks with vulnerable versions","description":"Identified in clause 5.16 (Update Security). Risk: **HIGH** - Compromises entire system integrity. Enables persistent backdoor installation."},{"id":"T16.3","title":"Update corruption causing system instability","description":"Identified in clause 5.16 (Update Security). Risk: **HIGH** - Compromises entire system integrity. Enables persistent backdoor installation."},{"id":"T16.4","title":"Rollback attacks to reintroduce vulnerabilities","description":"Identified in clause 5.16 (Update Security). Risk: **HIGH** - Compromises entire system integrity. Enables persistent backdoor installation."},{"id":"T17.1","title":"Unauthorized security setting modifications","description":"Identified in clause 5.17 (Configuration Security). Risk: **HIGH** - Weakens overall security posture. Enables bypass of security controls."},{"id":"T17.2","title":"Configuration injection attacks","description":"Identified in clause 5.17 (Configuration Security). Risk: **HIGH** - Weakens overall security posture. Enables bypass of security controls."},{"id":"T17.3","title":"Privilege escalation through configuration manipulation","description":"Identified in clause 5.17 (Configuration Security). Risk: **HIGH** - Weakens overall security posture. Enables bypass of security controls."},{"id":"T17.4","title":"Configuration drift from secure baseline","description":"Identified in clause 5.17 (Configuration Security). Risk: **HIGH** - Weakens overall security posture. Enables bypass of security controls."},{"id":"T18.1","title":"Default credentials enabling immediate compromise","description":"Identified in clause 5.18 (Secure Defaults). Risk: **MEDIUM** - Many deployments never change defaults. Provides easy initial compromise vector."},{"id":"T18.2","title":"Unnecessary services exposed by default","description":"Identified in clause 5.18 (Secure Defaults). Risk: **MEDIUM** - Many deployments never change defaults. Provides easy initial compromise vector."},{"id":"T18.3","title":"Weak cryptographic defaults","description":"Identified in clause 5.18 (Secure Defaults). Risk: **MEDIUM** - Many deployments never change defaults. Provides easy initial compromise vector."},{"id":"T18.4","title":"Overly permissive default access controls","description":"Identified in clause 5.18 (Secure Defaults). Risk: **MEDIUM** - Many deployments never change defaults. Provides easy initial compromise vector."},{"id":"T19.1","title":"Log timestamp manipulation hiding attack timeline","description":"Identified in clause 5.19 (Time Synchronization). Risk: **MEDIUM** - Undermines time-based security controls. Complicates incident investigation."},{"id":"T19.2","title":"Token expiry bypass through time manipulation","description":"Identified in clause 5.19 (Time Synchronization). Risk: **MEDIUM** - Undermines time-based security controls. Complicates incident investigation."},{"id":"T19.3","title":"Certificate validation bypass via time shifting","description":"Identified in clause 5.19 (Time Synchronization). Risk: **MEDIUM** - Undermines time-based security controls. Complicates incident investigation."},{"id":"T19.4","title":"Password rotation schedule disruption","description":"Identified in clause 5.19 (Time Synchronization). Risk: **MEDIUM** - Undermines time-based security controls. Complicates incident investigation."}],"draftGaps":["This interim draft contains NO assessment criteria anywhere: there is no clause 6 and no per-requirement assessment/conformance section (the skeleton's Annex E/F risk-methodology annexes are unfilled template placeholders). All 105 requirements therefore carry assessment: null — the standard's evidence-collection method does not exist yet.","Requirement id scheme: the draft defines its own per-topic bullet ids R1.1–R19.4 (with a/b variants, e.g. R1.5a) instead of the REQ-PP-ESR-NNN convention other stan4cra drafts use; the pack uses those R ids verbatim, with clauseRef recording the containing clause (5.1–5.19).","Id-sequence irregularities in the draft: clause 5.2 defines R2.2 and R2.2b but no R2.2a; clause 5.8 defines R8.4b but no R8.4a.","Annex ZA/ZB correspondence tables reference four ids clause 5 never defines: R2.5, R5.1 (only R5.1a/R5.1b exist), R6.5 and R13.4c. The craMap rows carry the tables verbatim, dangling references included.","No per-use-case applicability mapping exists: clause 4.4.3 defines six use cases (UC-PM1–UC-PM6) with risk levels, but no matrix ties requirements to them. Every requirement carries an empty applicability map plus the verbatim Capability/Condition prose of its topic as applicabilityText.","Clause 4.4.1 (Universal Security Requirements) contains five normative SHALL controls with no requirement ids; they are carried verbatim in applicabilityIntro, not as answerable requirement rows.","Annex L (the formal CRA relationship annex) is marked “DRAFT ANNEX L - DO NOT CONSIDER THE CONTENT”; the craMap is taken from the informative Annex ZA table instead.","Annex ZA's second table (“Compliance Mapping to CRA Annex I (Daniel's sketch with commentary)”) uses CRA Annex I reference numbering inconsistent with the regulation (e.g. “Part I, 1(a) - Secure by default”); it is not extracted.","Threats are the per-topic T1.1–T19.4 bullets (76 entries, extracted); Annex E (risk identification) and Annex F (risk evaluation) are empty template placeholders.","Structural draft defects: two different clauses are both numbered 4.1 (“Password Manager” and “Scope Boundaries”); clauses 4.1/4.3/4.5 sit at top level instead of under clause 4; “Annex C” appears twice; the Foreword still carries Group-Report boilerplate (“This Group Report (GR) has been produced by ETSI Industry Specification Group…”); the version field is an unfilled {{VERSION}} placeholder.","The Modal verbs clause omits “shall”/“shall not” from the list of interpreted verbs even though every requirement uses SHALL.","Requirements embed specific technical parameters that the executive summary says will be tiered by implementation priority (critical / six-month / medium), but no such tiering appears in the normative text."]}