ETSI EN 304 618

CYBER; CRA; Essential cybersecurity requirements for password managers · vertical pack 0.1.0 · 105 clause-5 requirements

INTERIM DRAFT under open consultation — subject to substantial change before publication; approved versions come only from the ETSI Documentation Service. Not cited in the Official Journal: conformance confers NO presumption of conformity today.

This is a vertical pack: a product-category standard, published in full and evaluated alongside the horizontal CRA rule pack— it supplements that pack for one Annex III category, it does not replace it. Everything below — every requirement, applicability entry, assessment block, correspondence row, threat and draft defect — is rendered from the same file the assessment engine reads. Nothing is generated at answer time, so this page cannot drift from what the product evaluates.

The same data, machine-readable, is served at /api/pack/vertical?id=en-304-618 — fetch it, keep a copy, and diff it when the draft moves. Because the standard is a moving draft, the source card pins exactly which text this pack was built from, and the draft gaps card records the defects we found in that text rather than papering over them.

On this page: source & license · how it attaches · requirement index · full text · CRA correspondence · threats · draft gaps · how it's built

Source, license and attribution

  • Source: https://labs.etsi.org/rep/stan4cra/en-304-618 (the ETSI Labs draft repository), commit d3a3e0bf, retrieved 2026-09-02.
  • License: BSD-3-Clause, © ETSI. Redistributed with attribution as the license requires; the verbatim requirement text below is reproduced from the interim draft.

To be plain about what that means: the normative requirement and assessment text on this page is reproduced verbatim from the interim draft under the license above, with the required copyright notice, conditions and disclaimer preserved in full below. The draft is a consultation document, not an ETSI deliverable — approved versions of ETSI standards are available only from the ETSI Documentation Service, and nothing reproduced here confers any presumption of conformity.

Full license text
Copyright 2025 ETSI Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. 3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission. THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

How this pack attaches

The pack applies to products classified under the CRA Annex III item “Password managers” (pack category id: important-1). Attaches to a product whose CRA classification matched the Annex III password managers item, or manually. The horizontal CRA pack keeps evaluating the product either way; this pack adds the category-specific requirements on top.

Scope (the draft’s own)

This standard focuses on password managers. These are designed to securely store and retrieve passwords, locally on a device or on a remote server, with a view to facilitate password management. ## 1.1 Password managers Password managers can be built on top of secret managers and function as a comprehensive management service. When a password manager includes password rotation it transcends being just a storage tool and becomes an active service that proactively manages credentials over time, this makes it a management service rather than simply a storage tool. ## 1.2 What is a password Passwords are typically associated with user accounts and are a form of secret that users know and use to authenticate themselves to a system. They play a role in secure authentication and access control and verify a user's identity or authorisation to access a system or resource. They are integrated into applications, systems and services to verify user identity during login processes. The activity of using a password is the entering of this secret information at authentication points to gain authorised access to protected information. ## 1.3 Use cases Password managers can be characterized along several dimensions that influence how users interact with them and the benefits they provide. At a high level, these tools address distinct user segments: solutions for individual use, solutions for family groups that require selective sharing while preserving privacy, and basic enterprise configurations in which credentials may be injected into connections dynamically to provide a transparent experience for end users. Synchronization is a central point of differentiation. Some solutions synchronize credentials across devices through general-purpose cloud services, enabling access from any device associated with the user’s account. Others provide synchronization that is native to the password manager itself, resulting in a more integrated but potentially narrower ecosystem. A third category comprises non-synchronized deployments that operate as resident or standalone systems, retaining all credentials locally on a single device or within a defined environment. The deployment model also varies by where the solution resides in the technology stack. Browser-integrated managers provide convenience for web authentication. Operating system level managers offer deeper integration across applications and services. Standalone managers operate as independent applications, typically offering greater flexibility and feature breadth, while requiring separate management by the user. The boundary between browser level and operating system level solutions has become increasingly indistinct as platform integrations have deepened. On mobile platforms, this integration manifests differently across ecosystems. Some provide a native keychain-style service with cloud-backed synchronization, delivering a uniform experience across devices within that ecosystem. Others adopt a more open model in which the password management provider may be selected from multiple services through system APIs or plugins, increasing choice but potentially creating ambiguity about which component is responsible for managing credentials. These distinctions reflect the evolution of password management from a basic browser convenience to a mature security capability. Each approach entails specific tradeoffs among convenience, security, and flexibility. For the purposes of scope, this document considers solutions across these user segments, synchronization models, and deployment models, with particular attention to the interactions and overlaps among them.

Applicability (the draft’s own)

In accordance with the proportionality principle mandated by the CRA, this clause defines representative use cases for password managers. These use cases illustrate typical deployment contexts that influence the selection and applicability of security requirements. Each use case is associated with a general risk level, derived directly from the application of the risk assessment methodology detailed in Annex A. This risk management level serves as a foundational element for determining the stringency of security requirements. While these use cases are representative, specific deployment scenarios will necessitate a more granular and detailed risk assessment, also guided by Annex A.
4.4.1 Universal Security Requirements All password manager implementations, regardless of deployment model or use case, SHALL implement the following baseline security controls: - Fundamental Security Controls - Encryption at Rest: All stored credentials and sensitive metadata SHALL be encrypted using approved algorithms (minimum AES-256) with authenticated encryption modes - Authenticated Access: Every access to the password store SHALL require explicit authentication, with no bypass mechanisms permitted for convenience - Secure Key Derivation: Master passwords SHALL be processed through computationally intensive key derivation functions - Memory Protection: Decrypted credentials SHALL be cleared from memory immediately after use - Transport Security: All network communications SHALL utilize TLS 1.3 or higher with certificate validation

The 6 use cases

Applicability is declared per use case: the draft defines 6 product contexts, and each clause-5 requirement states, per use case, whether it is required. The index below renders every column; enabling the pack on an assessment means choosing one of these.

Personal Password Manager on User LaptopUC-PM1
Description: Individual consumer using password manager for personal credential management across online services, financial accounts, and digital subscriptions on their primary computing device. Example Environments: - Home office laptop with mixed personal/professional use - Personal MacBook with iCloud Keychain - Windows laptop with third-party password manager - Linux workstation with open-source solution Security Characteristics: Single user trust model; limited IT expertise; consumer-grade threat profile; convenience prioritized with security defaults Risk Level: MEDIUM (See Annex B.1)
Enterprise Private Cloud Password ManagerUC-PM2
Description: Organization-hosted password management infrastructure deployed in private cloud or on-premises data center, providing complete control over data residency and security implementation. Example Environments: - VMware private cloud deployment - OpenStack infrastructure - Kubernetes containerized deployment - Hybrid cloud with sensitive data on-premises Security Characteristics: Full organizational control; compliance with data sovereignty requirements; integration with existing security infrastructure; dedicated security team management Risk Level: HIGH (See Annex B.2)
Cloud Password Manager with Local CachingUC-PM3
Description: Cloud-first architecture with intelligent local caching for frequently accessed credentials, optimizing performance while maintaining cloud-based management and backup. Example Environments: - Sales team with mobile devices and intermittent connectivity - International travelers requiring offline access - Branch offices with unreliable internet - Emergency response teams in field operations Security Characteristics: Selective sync based on access patterns; encrypted cache with TTL; conflict resolution protocols; bandwidth-optimized synchronization Risk Level: HIGH (See Annex B.3)
Operating System Keychain IntegrationUC-PM4
Description: OS-native credential management leveraging platform security features, kernel-level protection, and hardware security modules for system-wide password management. Example Environments: - macOS Keychain with TouchID/FaceID - Windows Credential Manager with Windows Hello - Linux Secret Service with GNOME Keyring - Android/iOS system credential stores Security Characteristics: OS-level encryption; biometric authentication; inter-application credential sharing; platform-specific security models Risk Level: MEDIUM (See Annex B.4)
Family Password Manager with Parental ControlsUC-PM5
Description: Multi-user password manager supporting family groups with hierarchical access control, allowing parents to manage children's passwords while teaching security practices. Example Environments: - Shared family computer with multiple user profiles - Parent-managed passwords for children's educational accounts - Shared streaming service credentials - Emergency access to family member accounts Security Characteristics: Role-based access (parent/teen/child); age-appropriate interfaces; shared vault separation; inheritance planning features Risk Level: MEDIUM (See Annex B.5)
Industrial OT Password ManagementUC-PM6
Description: Specialized password manager for operational technology environments, managing credentials for industrial control systems, SCADA networks, and critical infrastructure with air-gap requirements. Example Environments: - Manufacturing plant floor systems - Power grid control systems - Water treatment facility SCADA - Transportation system controllers Security Characteristics: Air-gapped operation mandatory; change control workflows; dual-person authentication; audit logging for compliance; emergency break-glass procedures Risk Level: CRITICAL (See Annex B.6)

Requirement index

Every requirement in one place: the 105 clause-5 requirements with their per-use-case applicability. Ids link to the full verbatim text below; each row is addressable so a review can cite specific rows.

IdRequirement (first line)UC-PM1UC-PM2UC-PM3UC-PM4UC-PM5UC-PM6
5.1 — Master Password Authentication
R1.1SHALL implement key derivation function (KDF) with minimum 100,000 iterations (PBKDF2) or equivalent computational cost●●●●●●
R1.2SHALL enforce minimum master password complexity (12+ characters, multiple character classes)●●●●●●
R1.3SHALL implement exponential backoff for failed authentication attempts●●●●●●
R1.4SHALL clear master password from memory immediately after use●●●●●●
R1.5aSHALL support multi-factor authentication as mandatory option●●●●●●
R1.5bSHALL mask password entry fields●●●●●●
5.2 — Password Database Storage
R2.1aSHALL use symmetric block cipher approved encryption algorithm●●●●●●
R2.1bSHALL use unique salts per database●●●●●●
R2.2SHALL implement authenticated encryption (AEAD) to ensure integrity●●●●●●
R2.2bSHALL implement secure key derivation separate from authentication●●●●●●
R2.3SHALL use encryption for all network transmissions●●●●●●
R2.4SHALL implement countermeasures against side-channel attacks (constant-time operations, memory access patterns)●●●●●●
5.3 — Auto-fill Functionality
R3.1SHALL validate exact domain match before auto-fill●●●●●●
R3.2SHALL require explicit user interaction for credential insertion●●●●●●
R3.3SHALL implement Content Security Policy (CSP) in browser extensions●●●●●●
R3.4SHALL maintain domain whitelist/blacklist capability●●●●●●
5.4 — Import/Export Functionality
R4.1SHALL provide encrypted export option as default●●●●●●
R4.2aSHALL validate and sanitize all imported data●●●●●●
R4.2bSHALL implement format validation and type checking●●●●●●
R4.3SHALL securely overwrite temporary files●●●●●●
R4.4SHALL require re-authentication for export operations●●●●●●
R4.5SHALL log all import/export activities●●●●●●
5.5 — API/CLI Access
R5.1aSHALL implement OAuth 2.0 or equivalent secure authentication●●●●●●
R5.1bSHALL use short-lived tokens with secure refresh mechanisms●●●●●●
R5.2aSHALL enforce rate limiting per endpoint●●●●●●
R5.2bSHALL implement principle of least privilege for API permissions●●●●●●
R5.3SHALL maintain comprehensive audit logs with tamper protection●●●●●●
R5.4SHALL support API key rotation without service disruption●●●●●●
R5.5SHALL implement token binding or proof-of-possession mechanisms●●●●●●
5.6 — Backup and Recovery
R6.1SHALL encrypt all backup data with same standards as primary database●●●●●●
R6.2aSHALL implement multi-factor recovery process●●●●●●
R6.2bSHALL implement time-delayed recovery with notification period●●●●●●
R6.3SHALL generate cryptographically random recovery codes (minimum 128 bits entropy)●●●●●●
R6.4aSHALL notify users of all recovery attempts●●●●●●
R6.4bSHALL limit recovery code usage attempts●●●●●●
5.7 — Password Generation
R7.1SHALL use cryptographically secure random number generator (CSRNG)●●●●●●
R7.2SHALL provide minimum acceptable bits of entropy for generated passwords●●●●●●
R7.3SHALL allow user-defined generation parameters●●●●●●
R7.4SHALL implement secure random seed initialization●●●●●●
R7.5SHALL NOT store or log generated passwords before user acceptance●●●●●●
R7.6SHALL implement constant-time generation to prevent timing analysis●●●●●●
5.8 — Workload Isolation
R8.1aSHALL enforce process isolation using OS-level security boundaries●●●●●●
R8.1bSHALL prevent unauthorized inter-process communication●●●●●●
R8.2SHALL implement separate memory spaces for each workload●●●●●●
R8.3aSHALL enforce network segmentation between administrative and user functions●●●●●●
R8.3bSHALL monitor and alert on isolation violation attempts●●●●●●
R8.4bSHALL implement side-channel resistant isolation (cache partitioning, timing isolation)●●●●●●
5.9 — Platform Integrity
R9.1aSHALL implement code signing for all executable components●●●●●●
R9.1bSHALL perform runtime integrity checks on critical functions●●●●●●
R9.2SHALL use address space layout randomization (ASLR)●●●●●●
R9.3SHALL implement buffer overflow protections●●●●●●
R9.4SHALL maintain cryptographic hashes of configuration files●●●●●●
5.10 — Platform Attestation
R10.1SHALL generate cryptographically signed attestation reports●●●●●●
R10.2aSHALL include all security-critical components in attestation●●●●●●
R10.2bSHALL support remote attestation verification●●●●●●
R10.3SHALL use hardware-backed attestation where available●●●●●●
R10.4aSHALL implement attestation freshness mechanisms●●●●●●
R10.4bSHALL use mutual authentication for attestation protocols●●●●●●
5.11 — Administrative Authentication
R11.1SHALL enforce multi-factor authentication for administrative access●●●●●●
R11.2SHALL implement certificate-based authentication option●●●●●●
R11.3SHALL enforce session timeout and re-authentication●●●●●●
R11.4aSHALL use separate authentication credentials for administrative functions●●●●●●
R11.4bSHALL implement account lockout after failed attempts●●●●●●
5.12 — Access Control
R12.1SHALL implement role-based access control (RBAC)●●●●●●
R12.2aSHALL enforce least privilege principle for all operations●●●●●●
R12.2bSHALL validate authorization for each sensitive operation●●●●●●
R12.3aSHALL support granular permission assignment●●●●●●
R12.3bSHALL log all authorization decisions and violations●●●●●●
R12.4SHALL implement atomic authorization checks to prevent TOCTTOU●●●●●●
5.13 — Data Confidentiality
R13.1SHALL encrypt all data at rest using AES-256 or equivalent●●●●●●
R13.2SHALL use TLS 1.3 for all network communications●●●●●●
R13.3SHALL implement perfect forward secrecy for communications●●●●●●
R13.4aSHALL clear sensitive data from memory after use●●●●●●
R13.4bSHALL disable caching of decrypted credentials●●●●●●
5.14 — Availability Protection
R14.1SHALL implement rate limiting on all interfaces●●●●●●
R14.2aSHALL enforce resource quotas per user/session●●●●●●
R14.2bSHALL implement automatic resource cleanup●●●●●●
R14.3SHALL support graceful degradation under load●●●●●●
R14.4SHALL maintain service availability monitoring●●●●●●
5.15 — Audit Logging
R15.1SHALL log all authentication attempts and outcomes●●●●●●
R15.2SHALL log all credential access and modifications●●●●●●
R15.3aSHALL implement tamper-evident log storage●●●●●●
R15.3bSHALL support secure log export and archival●●●●●●
R15.4aSHALL implement log retention policies●●●●●●
R15.4bSHALL implement log rotation and size limits to prevent flooding●●●●●●
5.16 — Update Security
R16.1aSHALL cryptographically sign all update packages●●●●●●
R16.1bSHALL verify signatures before applying updates●●●●●●
R16.2SHALL implement secure rollback mechanisms●●●●●●
R16.3SHALL maintain update audit trail●●●●●●
R16.4SHALL include version checking to prevent downgrade attacks●●●●●●
5.17 — Configuration Security
R17.1aSHALL protect configuration files with appropriate permissions●●●●●●
R17.1bSHALL require authentication for configuration changes●●●●●●
R17.2SHALL validate all configuration inputs●●●●●●
R17.3SHALL maintain configuration change history●●●●●●
R17.4SHALL support configuration integrity monitoring●●●●●●
5.18 — Secure Defaults
R18.1aSHALL enforce secure defaults without user intervention●●●●●●
R18.1bSHALL require password change on first use●●●●●●
R18.2SHALL disable unnecessary features by default●●●●●●
R18.3SHALL use strongest available cryptography by default●●●●●●
R18.4SHALL provide security hardening guide●●●●●●
5.19 — Time Synchronization
R19.1SHALL use authenticated NTP or equivalent protocol●●●●●●
R19.2aSHALL validate time source authenticity●●●●●●
R19.2bSHALL detect and alert on significant time changes●●●●●●
R19.3SHALL maintain monotonic clock for security events●●●●●●
R19.4SHALL implement time synchronization monitoring●●●●●●

● = required for that use case · — = not required. Use cases: UC-PM1 Personal Password Manager on User Laptop · UC-PM2 Enterprise Private Cloud Password Manager · UC-PM3 Cloud Password Manager with Local Caching · UC-PM4 Operating System Keychain Integration · UC-PM5 Family Password Manager with Parental Controls · UC-PM6 Industrial OT Password Management.

5.1 — Master Password Authentication

Capability: Password manager employs master password authentication mechanism for primary access control. Condition: Master password authentication mechanism exposed without adequate protection against brute force or credential attacks. Threat: - T1.1: Offline brute force attacks against encrypted vaults - T1.2: Online credential stuffing and password spraying attacks - T1.3: Shoulder surfing and keylogger-based credential theft - T1.4: Memory scraping attacks targeting master password in RAM Risk: HIGH - Compromise of master password provides complete access to all stored credentials. Likelihood elevated due to targeted nature of password manager attacks.
R1.1 — SHALL implement key derivation function (KDF) with minimum 100,000 iterations (PBKDF2) or equiv…Clause 5.1

Requirement (verbatim from the interim draft)

SHALL implement key derivation function (KDF) with minimum 100,000 iterations (PBKDF2) or equivalent computational cost

Applicability

Capability: Password manager employs master password authentication mechanism for primary access control. Condition: Master password authentication mechanism exposed without adequate protection against brute force or credential attacks.

This interim draft contains no assessment block for this requirement. Recorded in the draft gaps.

R1.2 — SHALL enforce minimum master password complexity (12+ characters, multiple character classes)Clause 5.1

Requirement (verbatim from the interim draft)

SHALL enforce minimum master password complexity (12+ characters, multiple character classes)

Applicability

Capability: Password manager employs master password authentication mechanism for primary access control. Condition: Master password authentication mechanism exposed without adequate protection against brute force or credential attacks.

This interim draft contains no assessment block for this requirement. Recorded in the draft gaps.

R1.3 — SHALL implement exponential backoff for failed authentication attemptsClause 5.1

Requirement (verbatim from the interim draft)

SHALL implement exponential backoff for failed authentication attempts

Applicability

Capability: Password manager employs master password authentication mechanism for primary access control. Condition: Master password authentication mechanism exposed without adequate protection against brute force or credential attacks.

This interim draft contains no assessment block for this requirement. Recorded in the draft gaps.

R1.4 — SHALL clear master password from memory immediately after useClause 5.1

Requirement (verbatim from the interim draft)

SHALL clear master password from memory immediately after use

Applicability

Capability: Password manager employs master password authentication mechanism for primary access control. Condition: Master password authentication mechanism exposed without adequate protection against brute force or credential attacks.

This interim draft contains no assessment block for this requirement. Recorded in the draft gaps.

R1.5a — SHALL support multi-factor authentication as mandatory optionClause 5.1

Requirement (verbatim from the interim draft)

SHALL support multi-factor authentication as mandatory option

Applicability

Capability: Password manager employs master password authentication mechanism for primary access control. Condition: Master password authentication mechanism exposed without adequate protection against brute force or credential attacks.

This interim draft contains no assessment block for this requirement. Recorded in the draft gaps.

R1.5b — SHALL mask password entry fieldsClause 5.1

Requirement (verbatim from the interim draft)

SHALL mask password entry fields

Applicability

Capability: Password manager employs master password authentication mechanism for primary access control. Condition: Master password authentication mechanism exposed without adequate protection against brute force or credential attacks.

This interim draft contains no assessment block for this requirement. Recorded in the draft gaps.

5.2 — Password Database Storage

Capability: Encrypted storage mechanism for password database (local storage or cloud synchronization). Condition: Password database stored or transmitted with insufficient encryption or key management practices. Threat: - T2.1: Database exfiltration through file system access - T2.2: Man-in-the-middle attacks during cloud synchronization - T2.3: Cryptographic downgrade attacks - T2.4: Side-channel attacks against encryption implementation Risk: CRITICAL - Database contains all user credentials. Impact is catastrophic if encryption is compromised.
R2.1a — SHALL use symmetric block cipher approved encryption algorithmClause 5.2

Requirement (verbatim from the interim draft)

SHALL use symmetric block cipher approved encryption algorithm

Applicability

Capability: Encrypted storage mechanism for password database (local storage or cloud synchronization). Condition: Password database stored or transmitted with insufficient encryption or key management practices.

This interim draft contains no assessment block for this requirement. Recorded in the draft gaps.

R2.1b — SHALL use unique salts per databaseClause 5.2

Requirement (verbatim from the interim draft)

SHALL use unique salts per database

Applicability

Capability: Encrypted storage mechanism for password database (local storage or cloud synchronization). Condition: Password database stored or transmitted with insufficient encryption or key management practices.

This interim draft contains no assessment block for this requirement. Recorded in the draft gaps.

R2.2 — SHALL implement authenticated encryption (AEAD) to ensure integrityClause 5.2

Requirement (verbatim from the interim draft)

SHALL implement authenticated encryption (AEAD) to ensure integrity

Applicability

Capability: Encrypted storage mechanism for password database (local storage or cloud synchronization). Condition: Password database stored or transmitted with insufficient encryption or key management practices.

This interim draft contains no assessment block for this requirement. Recorded in the draft gaps.

R2.2b — SHALL implement secure key derivation separate from authenticationClause 5.2

Requirement (verbatim from the interim draft)

SHALL implement secure key derivation separate from authentication

Applicability

Capability: Encrypted storage mechanism for password database (local storage or cloud synchronization). Condition: Password database stored or transmitted with insufficient encryption or key management practices.

This interim draft contains no assessment block for this requirement. Recorded in the draft gaps.

R2.3 — SHALL use encryption for all network transmissionsClause 5.2

Requirement (verbatim from the interim draft)

SHALL use encryption for all network transmissions

Applicability

Capability: Encrypted storage mechanism for password database (local storage or cloud synchronization). Condition: Password database stored or transmitted with insufficient encryption or key management practices.

This interim draft contains no assessment block for this requirement. Recorded in the draft gaps.

R2.4 — SHALL implement countermeasures against side-channel attacks (constant-time operations, memory…Clause 5.2

Requirement (verbatim from the interim draft)

SHALL implement countermeasures against side-channel attacks (constant-time operations, memory access patterns)

Applicability

Capability: Encrypted storage mechanism for password database (local storage or cloud synchronization). Condition: Password database stored or transmitted with insufficient encryption or key management practices.

This interim draft contains no assessment block for this requirement. Recorded in the draft gaps.

5.3 — Auto-fill Functionality

Capability: Browser integration and automatic credential insertion into web forms. Condition: Auto-fill mechanism operating without proper origin validation or user confirmation. Threat: - T3.1: Phishing attacks through lookalike domains - T3.2: Clickjacking to trigger unintended auto-fill - T3.3: Form injection attacks on compromised sites - T3.4: Cross-site scripting (XSS) credential theft Risk: HIGH - Auto-fill vulnerabilities enable credential theft at scale. Likelihood high due to prevalence of phishing.
R3.1 — SHALL validate exact domain match before auto-fillClause 5.3

Requirement (verbatim from the interim draft)

SHALL validate exact domain match before auto-fill

Applicability

Capability: Browser integration and automatic credential insertion into web forms. Condition: Auto-fill mechanism operating without proper origin validation or user confirmation.

This interim draft contains no assessment block for this requirement. Recorded in the draft gaps.

R3.2 — SHALL require explicit user interaction for credential insertionClause 5.3

Requirement (verbatim from the interim draft)

SHALL require explicit user interaction for credential insertion

Applicability

Capability: Browser integration and automatic credential insertion into web forms. Condition: Auto-fill mechanism operating without proper origin validation or user confirmation.

This interim draft contains no assessment block for this requirement. Recorded in the draft gaps.

R3.3 — SHALL implement Content Security Policy (CSP) in browser extensionsClause 5.3

Requirement (verbatim from the interim draft)

SHALL implement Content Security Policy (CSP) in browser extensions

Applicability

Capability: Browser integration and automatic credential insertion into web forms. Condition: Auto-fill mechanism operating without proper origin validation or user confirmation.

This interim draft contains no assessment block for this requirement. Recorded in the draft gaps.

R3.4 — SHALL maintain domain whitelist/blacklist capabilityClause 5.3

Requirement (verbatim from the interim draft)

SHALL maintain domain whitelist/blacklist capability

Applicability

Capability: Browser integration and automatic credential insertion into web forms. Condition: Auto-fill mechanism operating without proper origin validation or user confirmation.

This interim draft contains no assessment block for this requirement. Recorded in the draft gaps.

5.4 — Import/Export Functionality

Capability: Data portability features allowing credential import from and export to external formats. Condition: Import/export operations handling sensitive data without adequate protection or validation. Threat: - T4.1: Plaintext credential exposure during export - T4.2: Malicious data injection through crafted import files - T4.3: Format confusion attacks - T4.4: Temporary file forensic recovery Risk: MEDIUM - Feature typically used infrequently but presents data exposure risk. Impact high if exploited.
R4.1 — SHALL provide encrypted export option as defaultClause 5.4

Requirement (verbatim from the interim draft)

SHALL provide encrypted export option as default

Applicability

Capability: Data portability features allowing credential import from and export to external formats. Condition: Import/export operations handling sensitive data without adequate protection or validation.

This interim draft contains no assessment block for this requirement. Recorded in the draft gaps.

R4.2a — SHALL validate and sanitize all imported dataClause 5.4

Requirement (verbatim from the interim draft)

SHALL validate and sanitize all imported data

Applicability

Capability: Data portability features allowing credential import from and export to external formats. Condition: Import/export operations handling sensitive data without adequate protection or validation.

This interim draft contains no assessment block for this requirement. Recorded in the draft gaps.

R4.2b — SHALL implement format validation and type checkingClause 5.4

Requirement (verbatim from the interim draft)

SHALL implement format validation and type checking

Applicability

Capability: Data portability features allowing credential import from and export to external formats. Condition: Import/export operations handling sensitive data without adequate protection or validation.

This interim draft contains no assessment block for this requirement. Recorded in the draft gaps.

R4.3 — SHALL securely overwrite temporary filesClause 5.4

Requirement (verbatim from the interim draft)

SHALL securely overwrite temporary files

Applicability

Capability: Data portability features allowing credential import from and export to external formats. Condition: Import/export operations handling sensitive data without adequate protection or validation.

This interim draft contains no assessment block for this requirement. Recorded in the draft gaps.

R4.4 — SHALL require re-authentication for export operationsClause 5.4

Requirement (verbatim from the interim draft)

SHALL require re-authentication for export operations

Applicability

Capability: Data portability features allowing credential import from and export to external formats. Condition: Import/export operations handling sensitive data without adequate protection or validation.

This interim draft contains no assessment block for this requirement. Recorded in the draft gaps.

R4.5 — SHALL log all import/export activitiesClause 5.4

Requirement (verbatim from the interim draft)

SHALL log all import/export activities

Applicability

Capability: Data portability features allowing credential import from and export to external formats. Condition: Import/export operations handling sensitive data without adequate protection or validation.

This interim draft contains no assessment block for this requirement. Recorded in the draft gaps.

5.5 — API/CLI Access

Capability: Programmatic access interface for integration with external systems or automation. Condition: API exposed without proper authentication, rate limiting, or audit logging. Threat: - T5.1: Automated credential harvesting via API - T5.2: Privilege escalation through API vulnerabilities - T5.3: Token/session hijacking - T5.4: Denial of service through resource exhaustion Risk: HIGH - APIs present expanded attack surface. Automation enables rapid exploitation at scale.
R5.1a — SHALL implement OAuth 2.0 or equivalent secure authenticationClause 5.5

Requirement (verbatim from the interim draft)

SHALL implement OAuth 2.0 or equivalent secure authentication

Applicability

Capability: Programmatic access interface for integration with external systems or automation. Condition: API exposed without proper authentication, rate limiting, or audit logging.

This interim draft contains no assessment block for this requirement. Recorded in the draft gaps.

R5.1b — SHALL use short-lived tokens with secure refresh mechanismsClause 5.5

Requirement (verbatim from the interim draft)

SHALL use short-lived tokens with secure refresh mechanisms

Applicability

Capability: Programmatic access interface for integration with external systems or automation. Condition: API exposed without proper authentication, rate limiting, or audit logging.

This interim draft contains no assessment block for this requirement. Recorded in the draft gaps.

R5.2a — SHALL enforce rate limiting per endpointClause 5.5

Requirement (verbatim from the interim draft)

SHALL enforce rate limiting per endpoint

Applicability

Capability: Programmatic access interface for integration with external systems or automation. Condition: API exposed without proper authentication, rate limiting, or audit logging.

This interim draft contains no assessment block for this requirement. Recorded in the draft gaps.

R5.2b — SHALL implement principle of least privilege for API permissionsClause 5.5

Requirement (verbatim from the interim draft)

SHALL implement principle of least privilege for API permissions

Applicability

Capability: Programmatic access interface for integration with external systems or automation. Condition: API exposed without proper authentication, rate limiting, or audit logging.

This interim draft contains no assessment block for this requirement. Recorded in the draft gaps.

R5.3 — SHALL maintain comprehensive audit logs with tamper protectionClause 5.5

Requirement (verbatim from the interim draft)

SHALL maintain comprehensive audit logs with tamper protection

Applicability

Capability: Programmatic access interface for integration with external systems or automation. Condition: API exposed without proper authentication, rate limiting, or audit logging.

This interim draft contains no assessment block for this requirement. Recorded in the draft gaps.

R5.4 — SHALL support API key rotation without service disruptionClause 5.5

Requirement (verbatim from the interim draft)

SHALL support API key rotation without service disruption

Applicability

Capability: Programmatic access interface for integration with external systems or automation. Condition: API exposed without proper authentication, rate limiting, or audit logging.

This interim draft contains no assessment block for this requirement. Recorded in the draft gaps.

R5.5 — SHALL implement token binding or proof-of-possession mechanismsClause 5.5

Requirement (verbatim from the interim draft)

SHALL implement token binding or proof-of-possession mechanisms

Applicability

Capability: Programmatic access interface for integration with external systems or automation. Condition: API exposed without proper authentication, rate limiting, or audit logging.

This interim draft contains no assessment block for this requirement. Recorded in the draft gaps.

5.6 — Backup and Recovery

Capability: Backup creation and account recovery mechanisms for disaster recovery scenarios. Condition: Recovery mechanisms that bypass normal security controls or create alternative access paths. Threat: - T6.1: Account takeover through weak recovery processes - T6.2: Backup data exposure in less secure locations - T6.3: Social engineering targeting recovery procedures - T6.4: Recovery code interception or prediction Risk: HIGH - Recovery mechanisms are frequently targeted as the weakest link. Impact equals full account compromise.
R6.1 — SHALL encrypt all backup data with same standards as primary databaseClause 5.6

Requirement (verbatim from the interim draft)

SHALL encrypt all backup data with same standards as primary database

Applicability

Capability: Backup creation and account recovery mechanisms for disaster recovery scenarios. Condition: Recovery mechanisms that bypass normal security controls or create alternative access paths.

This interim draft contains no assessment block for this requirement. Recorded in the draft gaps.

R6.2a — SHALL implement multi-factor recovery processClause 5.6

Requirement (verbatim from the interim draft)

SHALL implement multi-factor recovery process

Applicability

Capability: Backup creation and account recovery mechanisms for disaster recovery scenarios. Condition: Recovery mechanisms that bypass normal security controls or create alternative access paths.

This interim draft contains no assessment block for this requirement. Recorded in the draft gaps.

R6.2b — SHALL implement time-delayed recovery with notification periodClause 5.6

Requirement (verbatim from the interim draft)

SHALL implement time-delayed recovery with notification period

Applicability

Capability: Backup creation and account recovery mechanisms for disaster recovery scenarios. Condition: Recovery mechanisms that bypass normal security controls or create alternative access paths.

This interim draft contains no assessment block for this requirement. Recorded in the draft gaps.

R6.3 — SHALL generate cryptographically random recovery codes (minimum 128 bits entropy)Clause 5.6

Requirement (verbatim from the interim draft)

SHALL generate cryptographically random recovery codes (minimum 128 bits entropy)

Applicability

Capability: Backup creation and account recovery mechanisms for disaster recovery scenarios. Condition: Recovery mechanisms that bypass normal security controls or create alternative access paths.

This interim draft contains no assessment block for this requirement. Recorded in the draft gaps.

R6.4a — SHALL notify users of all recovery attemptsClause 5.6

Requirement (verbatim from the interim draft)

SHALL notify users of all recovery attempts

Applicability

Capability: Backup creation and account recovery mechanisms for disaster recovery scenarios. Condition: Recovery mechanisms that bypass normal security controls or create alternative access paths.

This interim draft contains no assessment block for this requirement. Recorded in the draft gaps.

R6.4b — SHALL limit recovery code usage attemptsClause 5.6

Requirement (verbatim from the interim draft)

SHALL limit recovery code usage attempts

Applicability

Capability: Backup creation and account recovery mechanisms for disaster recovery scenarios. Condition: Recovery mechanisms that bypass normal security controls or create alternative access paths.

This interim draft contains no assessment block for this requirement. Recorded in the draft gaps.

5.7 — Password Generation

Capability: Cryptographically secure random password generation with configurable parameters. Condition: Password generator using predictable or weak randomness sources. Threat: - T7.1: Predictable password generation enabling pre-computation attacks - T7.2: Insufficient entropy in generated passwords - T7.3: Side-channel leakage of generation parameters - T7.4: Compromise of random number generator state Risk: MEDIUM - Weak password generation undermines security premise. Likelihood depends on implementation quality.
R7.1 — SHALL use cryptographically secure random number generator (CSRNG)Clause 5.7

Requirement (verbatim from the interim draft)

SHALL use cryptographically secure random number generator (CSRNG)

Applicability

Capability: Cryptographically secure random password generation with configurable parameters. Condition: Password generator using predictable or weak randomness sources.

This interim draft contains no assessment block for this requirement. Recorded in the draft gaps.

R7.2 — SHALL provide minimum acceptable bits of entropy for generated passwordsClause 5.7

Requirement (verbatim from the interim draft)

SHALL provide minimum acceptable bits of entropy for generated passwords

Applicability

Capability: Cryptographically secure random password generation with configurable parameters. Condition: Password generator using predictable or weak randomness sources.

This interim draft contains no assessment block for this requirement. Recorded in the draft gaps.

R7.3 — SHALL allow user-defined generation parametersClause 5.7

Requirement (verbatim from the interim draft)

SHALL allow user-defined generation parameters

Applicability

Capability: Cryptographically secure random password generation with configurable parameters. Condition: Password generator using predictable or weak randomness sources.

This interim draft contains no assessment block for this requirement. Recorded in the draft gaps.

R7.4 — SHALL implement secure random seed initializationClause 5.7

Requirement (verbatim from the interim draft)

SHALL implement secure random seed initialization

Applicability

Capability: Cryptographically secure random password generation with configurable parameters. Condition: Password generator using predictable or weak randomness sources.

This interim draft contains no assessment block for this requirement. Recorded in the draft gaps.

R7.5 — SHALL NOT store or log generated passwords before user acceptanceClause 5.7

Requirement (verbatim from the interim draft)

SHALL NOT store or log generated passwords before user acceptance

Applicability

Capability: Cryptographically secure random password generation with configurable parameters. Condition: Password generator using predictable or weak randomness sources.

This interim draft contains no assessment block for this requirement. Recorded in the draft gaps.

R7.6 — SHALL implement constant-time generation to prevent timing analysisClause 5.7

Requirement (verbatim from the interim draft)

SHALL implement constant-time generation to prevent timing analysis

Applicability

Capability: Cryptographically secure random password generation with configurable parameters. Condition: Password generator using predictable or weak randomness sources.

This interim draft contains no assessment block for this requirement. Recorded in the draft gaps.

5.8 — Workload Isolation

Capability: Isolation enforcement between concurrent workloads, administrative functions, and network domains. Condition: Inadequate separation between concurrently executing workloads (e.g., remote synchronisation and secret injection). Threat: - T8.1: Cross-workload memory access violations - T8.2: Execution state interference between processes - T8.3: Isolation boundary escape leading to privilege escalation - T8.4: Side-channel attacks between isolated components Risk: HIGH - Compromises integrity, confidentiality, and authorization controls. Enables lateral movement between security domains.
R8.1a — SHALL enforce process isolation using OS-level security boundariesClause 5.8

Requirement (verbatim from the interim draft)

SHALL enforce process isolation using OS-level security boundaries

Applicability

Capability: Isolation enforcement between concurrent workloads, administrative functions, and network domains. Condition: Inadequate separation between concurrently executing workloads (e.g., remote synchronisation and secret injection).

This interim draft contains no assessment block for this requirement. Recorded in the draft gaps.

R8.1b — SHALL prevent unauthorized inter-process communicationClause 5.8

Requirement (verbatim from the interim draft)

SHALL prevent unauthorized inter-process communication

Applicability

Capability: Isolation enforcement between concurrent workloads, administrative functions, and network domains. Condition: Inadequate separation between concurrently executing workloads (e.g., remote synchronisation and secret injection).

This interim draft contains no assessment block for this requirement. Recorded in the draft gaps.

R8.2 — SHALL implement separate memory spaces for each workloadClause 5.8

Requirement (verbatim from the interim draft)

SHALL implement separate memory spaces for each workload

Applicability

Capability: Isolation enforcement between concurrent workloads, administrative functions, and network domains. Condition: Inadequate separation between concurrently executing workloads (e.g., remote synchronisation and secret injection).

This interim draft contains no assessment block for this requirement. Recorded in the draft gaps.

R8.3a — SHALL enforce network segmentation between administrative and user functionsClause 5.8

Requirement (verbatim from the interim draft)

SHALL enforce network segmentation between administrative and user functions

Applicability

Capability: Isolation enforcement between concurrent workloads, administrative functions, and network domains. Condition: Inadequate separation between concurrently executing workloads (e.g., remote synchronisation and secret injection).

This interim draft contains no assessment block for this requirement. Recorded in the draft gaps.

R8.3b — SHALL monitor and alert on isolation violation attemptsClause 5.8

Requirement (verbatim from the interim draft)

SHALL monitor and alert on isolation violation attempts

Applicability

Capability: Isolation enforcement between concurrent workloads, administrative functions, and network domains. Condition: Inadequate separation between concurrently executing workloads (e.g., remote synchronisation and secret injection).

This interim draft contains no assessment block for this requirement. Recorded in the draft gaps.

R8.4b — SHALL implement side-channel resistant isolation (cache partitioning, timing isolation)Clause 5.8

Requirement (verbatim from the interim draft)

SHALL implement side-channel resistant isolation (cache partitioning, timing isolation)

Applicability

Capability: Isolation enforcement between concurrent workloads, administrative functions, and network domains. Condition: Inadequate separation between concurrently executing workloads (e.g., remote synchronisation and secret injection).

This interim draft contains no assessment block for this requirement. Recorded in the draft gaps.

5.9 — Platform Integrity

Capability: Runtime and at-rest integrity protection for platform components and workloads. Condition: Insufficient protection of user interface or memory buffers against tampering. Threat: - T9.1: Code injection through UI manipulation - T9.2: Memory buffer overflow attacks - T9.3: Binary patching of core components - T9.4: Configuration file tampering Risk: HIGH - Compromises integrity and authorization mechanisms. Enables persistent malware installation.
R9.1a — SHALL implement code signing for all executable componentsClause 5.9

Requirement (verbatim from the interim draft)

SHALL implement code signing for all executable components

Applicability

Capability: Runtime and at-rest integrity protection for platform components and workloads. Condition: Insufficient protection of user interface or memory buffers against tampering.

This interim draft contains no assessment block for this requirement. Recorded in the draft gaps.

R9.1b — SHALL perform runtime integrity checks on critical functionsClause 5.9

Requirement (verbatim from the interim draft)

SHALL perform runtime integrity checks on critical functions

Applicability

Capability: Runtime and at-rest integrity protection for platform components and workloads. Condition: Insufficient protection of user interface or memory buffers against tampering.

This interim draft contains no assessment block for this requirement. Recorded in the draft gaps.

R9.2 — SHALL use address space layout randomization (ASLR)Clause 5.9

Requirement (verbatim from the interim draft)

SHALL use address space layout randomization (ASLR)

Applicability

Capability: Runtime and at-rest integrity protection for platform components and workloads. Condition: Insufficient protection of user interface or memory buffers against tampering.

This interim draft contains no assessment block for this requirement. Recorded in the draft gaps.

R9.3 — SHALL implement buffer overflow protectionsClause 5.9

Requirement (verbatim from the interim draft)

SHALL implement buffer overflow protections

Applicability

Capability: Runtime and at-rest integrity protection for platform components and workloads. Condition: Insufficient protection of user interface or memory buffers against tampering.

This interim draft contains no assessment block for this requirement. Recorded in the draft gaps.

R9.4 — SHALL maintain cryptographic hashes of configuration filesClause 5.9

Requirement (verbatim from the interim draft)

SHALL maintain cryptographic hashes of configuration files

Applicability

Capability: Runtime and at-rest integrity protection for platform components and workloads. Condition: Insufficient protection of user interface or memory buffers against tampering.

This interim draft contains no assessment block for this requirement. Recorded in the draft gaps.

5.10 — Platform Attestation

Capability: Verifiable integrity attestation mechanism for trust establishment. Condition: Absence of verifiable integrity evidence or attestation mechanisms. Threat: - T10.1: Compromised platform masquerading as trustworthy - T10.2: Man-in-the-middle attacks on attestation protocols - T10.3: Replay attacks using old attestation tokens - T10.4: Attestation bypass through component substitution Risk: HIGH - Undermines entire trust chain. External systems may trust compromised platforms.
R10.1 — SHALL generate cryptographically signed attestation reportsClause 5.10

Requirement (verbatim from the interim draft)

SHALL generate cryptographically signed attestation reports

Applicability

Capability: Verifiable integrity attestation mechanism for trust establishment. Condition: Absence of verifiable integrity evidence or attestation mechanisms.

This interim draft contains no assessment block for this requirement. Recorded in the draft gaps.

R10.2a — SHALL include all security-critical components in attestationClause 5.10

Requirement (verbatim from the interim draft)

SHALL include all security-critical components in attestation

Applicability

Capability: Verifiable integrity attestation mechanism for trust establishment. Condition: Absence of verifiable integrity evidence or attestation mechanisms.

This interim draft contains no assessment block for this requirement. Recorded in the draft gaps.

R10.2b — SHALL support remote attestation verificationClause 5.10

Requirement (verbatim from the interim draft)

SHALL support remote attestation verification

Applicability

Capability: Verifiable integrity attestation mechanism for trust establishment. Condition: Absence of verifiable integrity evidence or attestation mechanisms.

This interim draft contains no assessment block for this requirement. Recorded in the draft gaps.

R10.3 — SHALL use hardware-backed attestation where availableClause 5.10

Requirement (verbatim from the interim draft)

SHALL use hardware-backed attestation where available

Applicability

Capability: Verifiable integrity attestation mechanism for trust establishment. Condition: Absence of verifiable integrity evidence or attestation mechanisms.

This interim draft contains no assessment block for this requirement. Recorded in the draft gaps.

R10.4a — SHALL implement attestation freshness mechanismsClause 5.10

Requirement (verbatim from the interim draft)

SHALL implement attestation freshness mechanisms

Applicability

Capability: Verifiable integrity attestation mechanism for trust establishment. Condition: Absence of verifiable integrity evidence or attestation mechanisms.

This interim draft contains no assessment block for this requirement. Recorded in the draft gaps.

R10.4b — SHALL use mutual authentication for attestation protocolsClause 5.10

Requirement (verbatim from the interim draft)

SHALL use mutual authentication for attestation protocols

Applicability

Capability: Verifiable integrity attestation mechanism for trust establishment. Condition: Absence of verifiable integrity evidence or attestation mechanisms.

This interim draft contains no assessment block for this requirement. Recorded in the draft gaps.

5.11 — Administrative Authentication

Capability: Strong authentication for administrative interfaces and sensitive operations. Condition: Missing or weak authentication mechanisms for critical functions. Threat: - T11.1: Unauthorized vault access through weak authentication - T11.2: Privilege escalation via authentication bypass - T11.3: Session hijacking of administrative sessions - T11.4: Credential reuse attacks Risk: CRITICAL - Full control of password manager and all stored secrets. Direct path to complete compromise.
R11.1 — SHALL enforce multi-factor authentication for administrative accessClause 5.11

Requirement (verbatim from the interim draft)

SHALL enforce multi-factor authentication for administrative access

Applicability

Capability: Strong authentication for administrative interfaces and sensitive operations. Condition: Missing or weak authentication mechanisms for critical functions.

This interim draft contains no assessment block for this requirement. Recorded in the draft gaps.

R11.2 — SHALL implement certificate-based authentication optionClause 5.11

Requirement (verbatim from the interim draft)

SHALL implement certificate-based authentication option

Applicability

Capability: Strong authentication for administrative interfaces and sensitive operations. Condition: Missing or weak authentication mechanisms for critical functions.

This interim draft contains no assessment block for this requirement. Recorded in the draft gaps.

R11.3 — SHALL enforce session timeout and re-authenticationClause 5.11

Requirement (verbatim from the interim draft)

SHALL enforce session timeout and re-authentication

Applicability

Capability: Strong authentication for administrative interfaces and sensitive operations. Condition: Missing or weak authentication mechanisms for critical functions.

This interim draft contains no assessment block for this requirement. Recorded in the draft gaps.

R11.4a — SHALL use separate authentication credentials for administrative functionsClause 5.11

Requirement (verbatim from the interim draft)

SHALL use separate authentication credentials for administrative functions

Applicability

Capability: Strong authentication for administrative interfaces and sensitive operations. Condition: Missing or weak authentication mechanisms for critical functions.

This interim draft contains no assessment block for this requirement. Recorded in the draft gaps.

R11.4b — SHALL implement account lockout after failed attemptsClause 5.11

Requirement (verbatim from the interim draft)

SHALL implement account lockout after failed attempts

Applicability

Capability: Strong authentication for administrative interfaces and sensitive operations. Condition: Missing or weak authentication mechanisms for critical functions.

This interim draft contains no assessment block for this requirement. Recorded in the draft gaps.

5.12 — Access Control

Capability: Authorization and access control enforcement for functions and data. Condition: Missing or weak authorization mechanisms within the password manager. Threat: - T12.1: Unauthorized access to shared account credentials - T12.2: Privilege escalation within the application - T12.3: Bypassing access controls through API manipulation - T12.4: Time-of-check to time-of-use (TOCTTOU) vulnerabilities Risk: HIGH - Enables unauthorized access to credentials beyond intended scope. Breaks compartmentalization.
R12.1 — SHALL implement role-based access control (RBAC)Clause 5.12

Requirement (verbatim from the interim draft)

SHALL implement role-based access control (RBAC)

Applicability

Capability: Authorization and access control enforcement for functions and data. Condition: Missing or weak authorization mechanisms within the password manager.

This interim draft contains no assessment block for this requirement. Recorded in the draft gaps.

R12.2a — SHALL enforce least privilege principle for all operationsClause 5.12

Requirement (verbatim from the interim draft)

SHALL enforce least privilege principle for all operations

Applicability

Capability: Authorization and access control enforcement for functions and data. Condition: Missing or weak authorization mechanisms within the password manager.

This interim draft contains no assessment block for this requirement. Recorded in the draft gaps.

R12.2b — SHALL validate authorization for each sensitive operationClause 5.12

Requirement (verbatim from the interim draft)

SHALL validate authorization for each sensitive operation

Applicability

Capability: Authorization and access control enforcement for functions and data. Condition: Missing or weak authorization mechanisms within the password manager.

This interim draft contains no assessment block for this requirement. Recorded in the draft gaps.

R12.3a — SHALL support granular permission assignmentClause 5.12

Requirement (verbatim from the interim draft)

SHALL support granular permission assignment

Applicability

Capability: Authorization and access control enforcement for functions and data. Condition: Missing or weak authorization mechanisms within the password manager.

This interim draft contains no assessment block for this requirement. Recorded in the draft gaps.

R12.3b — SHALL log all authorization decisions and violationsClause 5.12

Requirement (verbatim from the interim draft)

SHALL log all authorization decisions and violations

Applicability

Capability: Authorization and access control enforcement for functions and data. Condition: Missing or weak authorization mechanisms within the password manager.

This interim draft contains no assessment block for this requirement. Recorded in the draft gaps.

R12.4 — SHALL implement atomic authorization checks to prevent TOCTTOUClause 5.12

Requirement (verbatim from the interim draft)

SHALL implement atomic authorization checks to prevent TOCTTOU

Applicability

Capability: Authorization and access control enforcement for functions and data. Condition: Missing or weak authorization mechanisms within the password manager.

This interim draft contains no assessment block for this requirement. Recorded in the draft gaps.

5.13 — Data Confidentiality

Capability: Comprehensive encryption for data at rest and in transit. Condition: Insufficient encryption enforcement, compromised storage, or inadequate network isolation. Threat: - T13.1: Local vault exposure through file system access - T13.2: Network interception during synchronization - T13.3: Memory dump exposure of decrypted credentials - T13.4: Cache and temporary file recovery Risk: CRITICAL - Direct exposure of all stored credentials. Catastrophic impact on user security.
R13.1 — SHALL encrypt all data at rest using AES-256 or equivalentClause 5.13

Requirement (verbatim from the interim draft)

SHALL encrypt all data at rest using AES-256 or equivalent

Applicability

Capability: Comprehensive encryption for data at rest and in transit. Condition: Insufficient encryption enforcement, compromised storage, or inadequate network isolation.

This interim draft contains no assessment block for this requirement. Recorded in the draft gaps.

R13.2 — SHALL use TLS 1.3 for all network communicationsClause 5.13

Requirement (verbatim from the interim draft)

SHALL use TLS 1.3 for all network communications

Applicability

Capability: Comprehensive encryption for data at rest and in transit. Condition: Insufficient encryption enforcement, compromised storage, or inadequate network isolation.

This interim draft contains no assessment block for this requirement. Recorded in the draft gaps.

R13.3 — SHALL implement perfect forward secrecy for communicationsClause 5.13

Requirement (verbatim from the interim draft)

SHALL implement perfect forward secrecy for communications

Applicability

Capability: Comprehensive encryption for data at rest and in transit. Condition: Insufficient encryption enforcement, compromised storage, or inadequate network isolation.

This interim draft contains no assessment block for this requirement. Recorded in the draft gaps.

R13.4a — SHALL clear sensitive data from memory after useClause 5.13

Requirement (verbatim from the interim draft)

SHALL clear sensitive data from memory after use

Applicability

Capability: Comprehensive encryption for data at rest and in transit. Condition: Insufficient encryption enforcement, compromised storage, or inadequate network isolation.

This interim draft contains no assessment block for this requirement. Recorded in the draft gaps.

R13.4b — SHALL disable caching of decrypted credentialsClause 5.13

Requirement (verbatim from the interim draft)

SHALL disable caching of decrypted credentials

Applicability

Capability: Comprehensive encryption for data at rest and in transit. Condition: Insufficient encryption enforcement, compromised storage, or inadequate network isolation.

This interim draft contains no assessment block for this requirement. Recorded in the draft gaps.

5.14 — Availability Protection

Capability: Resilience against denial of service and resource exhaustion attacks. Condition: Insufficient protection against resource exhaustion or overwhelming request volumes. Threat: - T14.1: API flooding causing service unavailability - T14.2: Resource exhaustion through memory leaks - T14.3: CPU exhaustion through computational attacks - T14.4: Storage exhaustion through log flooding Risk: MEDIUM - Prevents access to credentials when needed. Critical during incident response scenarios.
R14.1 — SHALL implement rate limiting on all interfacesClause 5.14

Requirement (verbatim from the interim draft)

SHALL implement rate limiting on all interfaces

Applicability

Capability: Resilience against denial of service and resource exhaustion attacks. Condition: Insufficient protection against resource exhaustion or overwhelming request volumes.

This interim draft contains no assessment block for this requirement. Recorded in the draft gaps.

R14.2a — SHALL enforce resource quotas per user/sessionClause 5.14

Requirement (verbatim from the interim draft)

SHALL enforce resource quotas per user/session

Applicability

Capability: Resilience against denial of service and resource exhaustion attacks. Condition: Insufficient protection against resource exhaustion or overwhelming request volumes.

This interim draft contains no assessment block for this requirement. Recorded in the draft gaps.

R14.2b — SHALL implement automatic resource cleanupClause 5.14

Requirement (verbatim from the interim draft)

SHALL implement automatic resource cleanup

Applicability

Capability: Resilience against denial of service and resource exhaustion attacks. Condition: Insufficient protection against resource exhaustion or overwhelming request volumes.

This interim draft contains no assessment block for this requirement. Recorded in the draft gaps.

R14.3 — SHALL support graceful degradation under loadClause 5.14

Requirement (verbatim from the interim draft)

SHALL support graceful degradation under load

Applicability

Capability: Resilience against denial of service and resource exhaustion attacks. Condition: Insufficient protection against resource exhaustion or overwhelming request volumes.

This interim draft contains no assessment block for this requirement. Recorded in the draft gaps.

R14.4 — SHALL maintain service availability monitoringClause 5.14

Requirement (verbatim from the interim draft)

SHALL maintain service availability monitoring

Applicability

Capability: Resilience against denial of service and resource exhaustion attacks. Condition: Insufficient protection against resource exhaustion or overwhelming request volumes.

This interim draft contains no assessment block for this requirement. Recorded in the draft gaps.

5.15 — Audit Logging

Capability: Comprehensive security logging with integrity protection. Condition: Insufficient logging capabilities or unprotected log storage. Threat: - T15.1: Undetected unauthorized access attempts - T15.2: Log tampering to hide malicious activities - T15.3: Log deletion to prevent forensic analysis - T15.4: Log flooding to obscure attacks Risk: MEDIUM - Prevents detection and investigation of security incidents. Enables persistent threats.
R15.1 — SHALL log all authentication attempts and outcomesClause 5.15

Requirement (verbatim from the interim draft)

SHALL log all authentication attempts and outcomes

Applicability

Capability: Comprehensive security logging with integrity protection. Condition: Insufficient logging capabilities or unprotected log storage.

This interim draft contains no assessment block for this requirement. Recorded in the draft gaps.

R15.2 — SHALL log all credential access and modificationsClause 5.15

Requirement (verbatim from the interim draft)

SHALL log all credential access and modifications

Applicability

Capability: Comprehensive security logging with integrity protection. Condition: Insufficient logging capabilities or unprotected log storage.

This interim draft contains no assessment block for this requirement. Recorded in the draft gaps.

R15.3a — SHALL implement tamper-evident log storageClause 5.15

Requirement (verbatim from the interim draft)

SHALL implement tamper-evident log storage

Applicability

Capability: Comprehensive security logging with integrity protection. Condition: Insufficient logging capabilities or unprotected log storage.

This interim draft contains no assessment block for this requirement. Recorded in the draft gaps.

R15.3b — SHALL support secure log export and archivalClause 5.15

Requirement (verbatim from the interim draft)

SHALL support secure log export and archival

Applicability

Capability: Comprehensive security logging with integrity protection. Condition: Insufficient logging capabilities or unprotected log storage.

This interim draft contains no assessment block for this requirement. Recorded in the draft gaps.

R15.4a — SHALL implement log retention policiesClause 5.15

Requirement (verbatim from the interim draft)

SHALL implement log retention policies

Applicability

Capability: Comprehensive security logging with integrity protection. Condition: Insufficient logging capabilities or unprotected log storage.

This interim draft contains no assessment block for this requirement. Recorded in the draft gaps.

R15.4b — SHALL implement log rotation and size limits to prevent floodingClause 5.15

Requirement (verbatim from the interim draft)

SHALL implement log rotation and size limits to prevent flooding

Applicability

Capability: Comprehensive security logging with integrity protection. Condition: Insufficient logging capabilities or unprotected log storage.

This interim draft contains no assessment block for this requirement. Recorded in the draft gaps.

5.16 — Update Security

Capability: Secure update and patch management mechanisms. Condition: Lack of cryptographic validation or rollback protection for updates. Threat: - T16.1: Malicious update injection - T16.2: Update replay attacks with vulnerable versions - T16.3: Update corruption causing system instability - T16.4: Rollback attacks to reintroduce vulnerabilities Risk: HIGH - Compromises entire system integrity. Enables persistent backdoor installation.
R16.1a — SHALL cryptographically sign all update packagesClause 5.16

Requirement (verbatim from the interim draft)

SHALL cryptographically sign all update packages

Applicability

Capability: Secure update and patch management mechanisms. Condition: Lack of cryptographic validation or rollback protection for updates.

This interim draft contains no assessment block for this requirement. Recorded in the draft gaps.

R16.1b — SHALL verify signatures before applying updatesClause 5.16

Requirement (verbatim from the interim draft)

SHALL verify signatures before applying updates

Applicability

Capability: Secure update and patch management mechanisms. Condition: Lack of cryptographic validation or rollback protection for updates.

This interim draft contains no assessment block for this requirement. Recorded in the draft gaps.

R16.2 — SHALL implement secure rollback mechanismsClause 5.16

Requirement (verbatim from the interim draft)

SHALL implement secure rollback mechanisms

Applicability

Capability: Secure update and patch management mechanisms. Condition: Lack of cryptographic validation or rollback protection for updates.

This interim draft contains no assessment block for this requirement. Recorded in the draft gaps.

R16.3 — SHALL maintain update audit trailClause 5.16

Requirement (verbatim from the interim draft)

SHALL maintain update audit trail

Applicability

Capability: Secure update and patch management mechanisms. Condition: Lack of cryptographic validation or rollback protection for updates.

This interim draft contains no assessment block for this requirement. Recorded in the draft gaps.

R16.4 — SHALL include version checking to prevent downgrade attacksClause 5.16

Requirement (verbatim from the interim draft)

SHALL include version checking to prevent downgrade attacks

Applicability

Capability: Secure update and patch management mechanisms. Condition: Lack of cryptographic validation or rollback protection for updates.

This interim draft contains no assessment block for this requirement. Recorded in the draft gaps.

5.17 — Configuration Security

Capability: Protected configuration management and change control. Condition: Insufficient protection of configuration interfaces or files. Threat: - T17.1: Unauthorized security setting modifications - T17.2: Configuration injection attacks - T17.3: Privilege escalation through configuration manipulation - T17.4: Configuration drift from secure baseline Risk: HIGH - Weakens overall security posture. Enables bypass of security controls.
R17.1a — SHALL protect configuration files with appropriate permissionsClause 5.17

Requirement (verbatim from the interim draft)

SHALL protect configuration files with appropriate permissions

Applicability

Capability: Protected configuration management and change control. Condition: Insufficient protection of configuration interfaces or files.

This interim draft contains no assessment block for this requirement. Recorded in the draft gaps.

R17.1b — SHALL require authentication for configuration changesClause 5.17

Requirement (verbatim from the interim draft)

SHALL require authentication for configuration changes

Applicability

Capability: Protected configuration management and change control. Condition: Insufficient protection of configuration interfaces or files.

This interim draft contains no assessment block for this requirement. Recorded in the draft gaps.

R17.2 — SHALL validate all configuration inputsClause 5.17

Requirement (verbatim from the interim draft)

SHALL validate all configuration inputs

Applicability

Capability: Protected configuration management and change control. Condition: Insufficient protection of configuration interfaces or files.

This interim draft contains no assessment block for this requirement. Recorded in the draft gaps.

R17.3 — SHALL maintain configuration change historyClause 5.17

Requirement (verbatim from the interim draft)

SHALL maintain configuration change history

Applicability

Capability: Protected configuration management and change control. Condition: Insufficient protection of configuration interfaces or files.

This interim draft contains no assessment block for this requirement. Recorded in the draft gaps.

R17.4 — SHALL support configuration integrity monitoringClause 5.17

Requirement (verbatim from the interim draft)

SHALL support configuration integrity monitoring

Applicability

Capability: Protected configuration management and change control. Condition: Insufficient protection of configuration interfaces or files.

This interim draft contains no assessment block for this requirement. Recorded in the draft gaps.

5.18 — Secure Defaults

Capability: Security-by-default configuration and minimal attack surface. [Hard requirement of the Regulation] Condition: Product shipped with insecure default settings requiring manual hardening. Threat: - T18.1: Default credentials enabling immediate compromise - T18.2: Unnecessary services exposed by default - T18.3: Weak cryptographic defaults - T18.4: Overly permissive default access controls Risk: MEDIUM - Many deployments never change defaults. Provides easy initial compromise vector.
R18.1a — SHALL enforce secure defaults without user interventionClause 5.18

Requirement (verbatim from the interim draft)

SHALL enforce secure defaults without user intervention

Applicability

Capability: Security-by-default configuration and minimal attack surface. [Hard requirement of the Regulation] Condition: Product shipped with insecure default settings requiring manual hardening.

This interim draft contains no assessment block for this requirement. Recorded in the draft gaps.

R18.1b — SHALL require password change on first useClause 5.18

Requirement (verbatim from the interim draft)

SHALL require password change on first use

Applicability

Capability: Security-by-default configuration and minimal attack surface. [Hard requirement of the Regulation] Condition: Product shipped with insecure default settings requiring manual hardening.

This interim draft contains no assessment block for this requirement. Recorded in the draft gaps.

R18.2 — SHALL disable unnecessary features by defaultClause 5.18

Requirement (verbatim from the interim draft)

SHALL disable unnecessary features by default

Applicability

Capability: Security-by-default configuration and minimal attack surface. [Hard requirement of the Regulation] Condition: Product shipped with insecure default settings requiring manual hardening.

This interim draft contains no assessment block for this requirement. Recorded in the draft gaps.

R18.3 — SHALL use strongest available cryptography by defaultClause 5.18

Requirement (verbatim from the interim draft)

SHALL use strongest available cryptography by default

Applicability

Capability: Security-by-default configuration and minimal attack surface. [Hard requirement of the Regulation] Condition: Product shipped with insecure default settings requiring manual hardening.

This interim draft contains no assessment block for this requirement. Recorded in the draft gaps.

R18.4 — SHALL provide security hardening guideClause 5.18

Requirement (verbatim from the interim draft)

SHALL provide security hardening guide

Applicability

Capability: Security-by-default configuration and minimal attack surface. [Hard requirement of the Regulation] Condition: Product shipped with insecure default settings requiring manual hardening.

This interim draft contains no assessment block for this requirement. Recorded in the draft gaps.

5.19 — Time Synchronization

Capability: Accurate and secure time synchronization for security operations. Condition: Unprotected or unreliable time source mechanisms. Threat: - T19.1: Log timestamp manipulation hiding attack timeline - T19.2: Token expiry bypass through time manipulation - T19.3: Certificate validation bypass via time shifting - T19.4: Password rotation schedule disruption Risk: MEDIUM - Undermines time-based security controls. Complicates incident investigation.
R19.1 — SHALL use authenticated NTP or equivalent protocolClause 5.19

Requirement (verbatim from the interim draft)

SHALL use authenticated NTP or equivalent protocol

Applicability

Capability: Accurate and secure time synchronization for security operations. Condition: Unprotected or unreliable time source mechanisms.

This interim draft contains no assessment block for this requirement. Recorded in the draft gaps.

R19.2a — SHALL validate time source authenticityClause 5.19

Requirement (verbatim from the interim draft)

SHALL validate time source authenticity

Applicability

Capability: Accurate and secure time synchronization for security operations. Condition: Unprotected or unreliable time source mechanisms.

This interim draft contains no assessment block for this requirement. Recorded in the draft gaps.

R19.2b — SHALL detect and alert on significant time changesClause 5.19

Requirement (verbatim from the interim draft)

SHALL detect and alert on significant time changes

Applicability

Capability: Accurate and secure time synchronization for security operations. Condition: Unprotected or unreliable time source mechanisms.

This interim draft contains no assessment block for this requirement. Recorded in the draft gaps.

R19.3 — SHALL maintain monotonic clock for security eventsClause 5.19

Requirement (verbatim from the interim draft)

SHALL maintain monotonic clock for security events

Applicability

Capability: Accurate and secure time synchronization for security operations. Condition: Unprotected or unreliable time source mechanisms.

This interim draft contains no assessment block for this requirement. Recorded in the draft gaps.

R19.4 — SHALL implement time synchronization monitoringClause 5.19

Requirement (verbatim from the interim draft)

SHALL implement time synchronization monitoring

Applicability

Capability: Accurate and secure time synchronization for security operations. Condition: Unprotected or unreliable time source mechanisms.

This interim draft contains no assessment block for this requirement. Recorded in the draft gaps.

Correspondence to the CRA

The draft’s own correspondence table: which of its clauses address which essential requirement of CRA Annex I. This is the draft’s claim, reproduced as it stands — not Vandorisk’s judgment of coverage, and (status block above) not a presumption of conformity.

CRA provisionDraft clause(s)
No known exploitable vulnerabilitiesR16.1b; R16.2; R16.4
Secure design, development, productionR1.1; R2.2; R8.1a; R8.3a; R9.1a; R9.1b; R10.1
Secure by default configurationR18.1a; R18.2; R18.3
Secure updatesR16.1a; R16.1b; R16.2; R16.3; R16.4
Authentication and access control mechanismsR1.1; R1.5a; R11.1; R11.2; R11.3; R11.4a; R12.1; R12.2a; R12.2b
Confidentiality protectionR2.1a; R2.5; R13.1; R13.2; R13.3
Integrity protection for data and configurationR2.2b; R9.1b; R9.4; R17.3; R17.4
Data minimizationR13.4c
Availability protectionR14.1; R14.2a; R14.3; R14.4
Minimize impact on other devices or servicesR8.1b; R8.3b
Limit attack surfaceR3.4; R5.1; R18.2
Exploit mitigation by limiting incident impactR4.2a; R4.2b; R5.2b; R6.5; R9.2; R9.3
Logging and monitoring mechanismsR4.5; R5.3; R15.1; R15.2; R15.3a; R15.3b; R15.4a
Secure deletion and data transferR4.3; R13.4a; R13.4b; R13.4c

Where the table covers CRA Annex I Part 1 only, the Part 2 (vulnerability handling) obligations remain assessed through the horizontal CRA pack(II.1–II.8).

Threat catalogue

The 76 threats the draft derives its requirements against, verbatim:

T1.1 — Offline brute force attacks against encrypted vaults
Identified in clause 5.1 (Master Password Authentication). Risk: HIGH - Compromise of master password provides complete access to all stored credentials. Likelihood elevated due to targeted nature of password manager attacks.
T1.2 — Online credential stuffing and password spraying attacks
Identified in clause 5.1 (Master Password Authentication). Risk: HIGH - Compromise of master password provides complete access to all stored credentials. Likelihood elevated due to targeted nature of password manager attacks.
T1.3 — Shoulder surfing and keylogger-based credential theft
Identified in clause 5.1 (Master Password Authentication). Risk: HIGH - Compromise of master password provides complete access to all stored credentials. Likelihood elevated due to targeted nature of password manager attacks.
T1.4 — Memory scraping attacks targeting master password in RAM
Identified in clause 5.1 (Master Password Authentication). Risk: HIGH - Compromise of master password provides complete access to all stored credentials. Likelihood elevated due to targeted nature of password manager attacks.
T2.1 — Database exfiltration through file system access
Identified in clause 5.2 (Password Database Storage). Risk: CRITICAL - Database contains all user credentials. Impact is catastrophic if encryption is compromised.
T2.2 — Man-in-the-middle attacks during cloud synchronization
Identified in clause 5.2 (Password Database Storage). Risk: CRITICAL - Database contains all user credentials. Impact is catastrophic if encryption is compromised.
T2.3 — Cryptographic downgrade attacks
Identified in clause 5.2 (Password Database Storage). Risk: CRITICAL - Database contains all user credentials. Impact is catastrophic if encryption is compromised.
T2.4 — Side-channel attacks against encryption implementation
Identified in clause 5.2 (Password Database Storage). Risk: CRITICAL - Database contains all user credentials. Impact is catastrophic if encryption is compromised.
T3.1 — Phishing attacks through lookalike domains
Identified in clause 5.3 (Auto-fill Functionality). Risk: HIGH - Auto-fill vulnerabilities enable credential theft at scale. Likelihood high due to prevalence of phishing.
T3.2 — Clickjacking to trigger unintended auto-fill
Identified in clause 5.3 (Auto-fill Functionality). Risk: HIGH - Auto-fill vulnerabilities enable credential theft at scale. Likelihood high due to prevalence of phishing.
T3.3 — Form injection attacks on compromised sites
Identified in clause 5.3 (Auto-fill Functionality). Risk: HIGH - Auto-fill vulnerabilities enable credential theft at scale. Likelihood high due to prevalence of phishing.
T3.4 — Cross-site scripting (XSS) credential theft
Identified in clause 5.3 (Auto-fill Functionality). Risk: HIGH - Auto-fill vulnerabilities enable credential theft at scale. Likelihood high due to prevalence of phishing.
T4.1 — Plaintext credential exposure during export
Identified in clause 5.4 (Import/Export Functionality). Risk: MEDIUM - Feature typically used infrequently but presents data exposure risk. Impact high if exploited.
T4.2 — Malicious data injection through crafted import files
Identified in clause 5.4 (Import/Export Functionality). Risk: MEDIUM - Feature typically used infrequently but presents data exposure risk. Impact high if exploited.
T4.3 — Format confusion attacks
Identified in clause 5.4 (Import/Export Functionality). Risk: MEDIUM - Feature typically used infrequently but presents data exposure risk. Impact high if exploited.
T4.4 — Temporary file forensic recovery
Identified in clause 5.4 (Import/Export Functionality). Risk: MEDIUM - Feature typically used infrequently but presents data exposure risk. Impact high if exploited.
T5.1 — Automated credential harvesting via API
Identified in clause 5.5 (API/CLI Access). Risk: HIGH - APIs present expanded attack surface. Automation enables rapid exploitation at scale.
T5.2 — Privilege escalation through API vulnerabilities
Identified in clause 5.5 (API/CLI Access). Risk: HIGH - APIs present expanded attack surface. Automation enables rapid exploitation at scale.
T5.3 — Token/session hijacking
Identified in clause 5.5 (API/CLI Access). Risk: HIGH - APIs present expanded attack surface. Automation enables rapid exploitation at scale.
T5.4 — Denial of service through resource exhaustion
Identified in clause 5.5 (API/CLI Access). Risk: HIGH - APIs present expanded attack surface. Automation enables rapid exploitation at scale.
T6.1 — Account takeover through weak recovery processes
Identified in clause 5.6 (Backup and Recovery). Risk: HIGH - Recovery mechanisms are frequently targeted as the weakest link. Impact equals full account compromise.
T6.2 — Backup data exposure in less secure locations
Identified in clause 5.6 (Backup and Recovery). Risk: HIGH - Recovery mechanisms are frequently targeted as the weakest link. Impact equals full account compromise.
T6.3 — Social engineering targeting recovery procedures
Identified in clause 5.6 (Backup and Recovery). Risk: HIGH - Recovery mechanisms are frequently targeted as the weakest link. Impact equals full account compromise.
T6.4 — Recovery code interception or prediction
Identified in clause 5.6 (Backup and Recovery). Risk: HIGH - Recovery mechanisms are frequently targeted as the weakest link. Impact equals full account compromise.
T7.1 — Predictable password generation enabling pre-computation attacks
Identified in clause 5.7 (Password Generation). Risk: MEDIUM - Weak password generation undermines security premise. Likelihood depends on implementation quality.
T7.2 — Insufficient entropy in generated passwords
Identified in clause 5.7 (Password Generation). Risk: MEDIUM - Weak password generation undermines security premise. Likelihood depends on implementation quality.
T7.3 — Side-channel leakage of generation parameters
Identified in clause 5.7 (Password Generation). Risk: MEDIUM - Weak password generation undermines security premise. Likelihood depends on implementation quality.
T7.4 — Compromise of random number generator state
Identified in clause 5.7 (Password Generation). Risk: MEDIUM - Weak password generation undermines security premise. Likelihood depends on implementation quality.
T8.1 — Cross-workload memory access violations
Identified in clause 5.8 (Workload Isolation). Risk: HIGH - Compromises integrity, confidentiality, and authorization controls. Enables lateral movement between security domains.
T8.2 — Execution state interference between processes
Identified in clause 5.8 (Workload Isolation). Risk: HIGH - Compromises integrity, confidentiality, and authorization controls. Enables lateral movement between security domains.
T8.3 — Isolation boundary escape leading to privilege escalation
Identified in clause 5.8 (Workload Isolation). Risk: HIGH - Compromises integrity, confidentiality, and authorization controls. Enables lateral movement between security domains.
T8.4 — Side-channel attacks between isolated components
Identified in clause 5.8 (Workload Isolation). Risk: HIGH - Compromises integrity, confidentiality, and authorization controls. Enables lateral movement between security domains.
T9.1 — Code injection through UI manipulation
Identified in clause 5.9 (Platform Integrity). Risk: HIGH - Compromises integrity and authorization mechanisms. Enables persistent malware installation.
T9.2 — Memory buffer overflow attacks
Identified in clause 5.9 (Platform Integrity). Risk: HIGH - Compromises integrity and authorization mechanisms. Enables persistent malware installation.
T9.3 — Binary patching of core components
Identified in clause 5.9 (Platform Integrity). Risk: HIGH - Compromises integrity and authorization mechanisms. Enables persistent malware installation.
T9.4 — Configuration file tampering
Identified in clause 5.9 (Platform Integrity). Risk: HIGH - Compromises integrity and authorization mechanisms. Enables persistent malware installation.
T10.1 — Compromised platform masquerading as trustworthy
Identified in clause 5.10 (Platform Attestation). Risk: HIGH - Undermines entire trust chain. External systems may trust compromised platforms.
T10.2 — Man-in-the-middle attacks on attestation protocols
Identified in clause 5.10 (Platform Attestation). Risk: HIGH - Undermines entire trust chain. External systems may trust compromised platforms.
T10.3 — Replay attacks using old attestation tokens
Identified in clause 5.10 (Platform Attestation). Risk: HIGH - Undermines entire trust chain. External systems may trust compromised platforms.
T10.4 — Attestation bypass through component substitution
Identified in clause 5.10 (Platform Attestation). Risk: HIGH - Undermines entire trust chain. External systems may trust compromised platforms.
T11.1 — Unauthorized vault access through weak authentication
Identified in clause 5.11 (Administrative Authentication). Risk: CRITICAL - Full control of password manager and all stored secrets. Direct path to complete compromise.
T11.2 — Privilege escalation via authentication bypass
Identified in clause 5.11 (Administrative Authentication). Risk: CRITICAL - Full control of password manager and all stored secrets. Direct path to complete compromise.
T11.3 — Session hijacking of administrative sessions
Identified in clause 5.11 (Administrative Authentication). Risk: CRITICAL - Full control of password manager and all stored secrets. Direct path to complete compromise.
T11.4 — Credential reuse attacks
Identified in clause 5.11 (Administrative Authentication). Risk: CRITICAL - Full control of password manager and all stored secrets. Direct path to complete compromise.
T12.1 — Unauthorized access to shared account credentials
Identified in clause 5.12 (Access Control). Risk: HIGH - Enables unauthorized access to credentials beyond intended scope. Breaks compartmentalization.
T12.2 — Privilege escalation within the application
Identified in clause 5.12 (Access Control). Risk: HIGH - Enables unauthorized access to credentials beyond intended scope. Breaks compartmentalization.
T12.3 — Bypassing access controls through API manipulation
Identified in clause 5.12 (Access Control). Risk: HIGH - Enables unauthorized access to credentials beyond intended scope. Breaks compartmentalization.
T12.4 — Time-of-check to time-of-use (TOCTTOU) vulnerabilities
Identified in clause 5.12 (Access Control). Risk: HIGH - Enables unauthorized access to credentials beyond intended scope. Breaks compartmentalization.
T13.1 — Local vault exposure through file system access
Identified in clause 5.13 (Data Confidentiality). Risk: CRITICAL - Direct exposure of all stored credentials. Catastrophic impact on user security.
T13.2 — Network interception during synchronization
Identified in clause 5.13 (Data Confidentiality). Risk: CRITICAL - Direct exposure of all stored credentials. Catastrophic impact on user security.
T13.3 — Memory dump exposure of decrypted credentials
Identified in clause 5.13 (Data Confidentiality). Risk: CRITICAL - Direct exposure of all stored credentials. Catastrophic impact on user security.
T13.4 — Cache and temporary file recovery
Identified in clause 5.13 (Data Confidentiality). Risk: CRITICAL - Direct exposure of all stored credentials. Catastrophic impact on user security.
T14.1 — API flooding causing service unavailability
Identified in clause 5.14 (Availability Protection). Risk: MEDIUM - Prevents access to credentials when needed. Critical during incident response scenarios.
T14.2 — Resource exhaustion through memory leaks
Identified in clause 5.14 (Availability Protection). Risk: MEDIUM - Prevents access to credentials when needed. Critical during incident response scenarios.
T14.3 — CPU exhaustion through computational attacks
Identified in clause 5.14 (Availability Protection). Risk: MEDIUM - Prevents access to credentials when needed. Critical during incident response scenarios.
T14.4 — Storage exhaustion through log flooding
Identified in clause 5.14 (Availability Protection). Risk: MEDIUM - Prevents access to credentials when needed. Critical during incident response scenarios.
T15.1 — Undetected unauthorized access attempts
Identified in clause 5.15 (Audit Logging). Risk: MEDIUM - Prevents detection and investigation of security incidents. Enables persistent threats.
T15.2 — Log tampering to hide malicious activities
Identified in clause 5.15 (Audit Logging). Risk: MEDIUM - Prevents detection and investigation of security incidents. Enables persistent threats.
T15.3 — Log deletion to prevent forensic analysis
Identified in clause 5.15 (Audit Logging). Risk: MEDIUM - Prevents detection and investigation of security incidents. Enables persistent threats.
T15.4 — Log flooding to obscure attacks
Identified in clause 5.15 (Audit Logging). Risk: MEDIUM - Prevents detection and investigation of security incidents. Enables persistent threats.
T16.1 — Malicious update injection
Identified in clause 5.16 (Update Security). Risk: HIGH - Compromises entire system integrity. Enables persistent backdoor installation.
T16.2 — Update replay attacks with vulnerable versions
Identified in clause 5.16 (Update Security). Risk: HIGH - Compromises entire system integrity. Enables persistent backdoor installation.
T16.3 — Update corruption causing system instability
Identified in clause 5.16 (Update Security). Risk: HIGH - Compromises entire system integrity. Enables persistent backdoor installation.
T16.4 — Rollback attacks to reintroduce vulnerabilities
Identified in clause 5.16 (Update Security). Risk: HIGH - Compromises entire system integrity. Enables persistent backdoor installation.
T17.1 — Unauthorized security setting modifications
Identified in clause 5.17 (Configuration Security). Risk: HIGH - Weakens overall security posture. Enables bypass of security controls.
T17.2 — Configuration injection attacks
Identified in clause 5.17 (Configuration Security). Risk: HIGH - Weakens overall security posture. Enables bypass of security controls.
T17.3 — Privilege escalation through configuration manipulation
Identified in clause 5.17 (Configuration Security). Risk: HIGH - Weakens overall security posture. Enables bypass of security controls.
T17.4 — Configuration drift from secure baseline
Identified in clause 5.17 (Configuration Security). Risk: HIGH - Weakens overall security posture. Enables bypass of security controls.
T18.1 — Default credentials enabling immediate compromise
Identified in clause 5.18 (Secure Defaults). Risk: MEDIUM - Many deployments never change defaults. Provides easy initial compromise vector.
T18.2 — Unnecessary services exposed by default
Identified in clause 5.18 (Secure Defaults). Risk: MEDIUM - Many deployments never change defaults. Provides easy initial compromise vector.
T18.3 — Weak cryptographic defaults
Identified in clause 5.18 (Secure Defaults). Risk: MEDIUM - Many deployments never change defaults. Provides easy initial compromise vector.
T18.4 — Overly permissive default access controls
Identified in clause 5.18 (Secure Defaults). Risk: MEDIUM - Many deployments never change defaults. Provides easy initial compromise vector.
T19.1 — Log timestamp manipulation hiding attack timeline
Identified in clause 5.19 (Time Synchronization). Risk: MEDIUM - Undermines time-based security controls. Complicates incident investigation.
T19.2 — Token expiry bypass through time manipulation
Identified in clause 5.19 (Time Synchronization). Risk: MEDIUM - Undermines time-based security controls. Complicates incident investigation.
T19.3 — Certificate validation bypass via time shifting
Identified in clause 5.19 (Time Synchronization). Risk: MEDIUM - Undermines time-based security controls. Complicates incident investigation.
T19.4 — Password rotation schedule disruption
Identified in clause 5.19 (Time Synchronization). Risk: MEDIUM - Undermines time-based security controls. Complicates incident investigation.

Draft gaps

Defects and holes we found in the interim draft while building this pack — recorded rather than papered over; they will be rechecked against each new draft. A standard under consultation is allowed to have holes. A pack that hides them is not.

  • This interim draft contains NO assessment criteria anywhere: there is no clause 6 and no per-requirement assessment/conformance section (the skeleton's Annex E/F risk-methodology annexes are unfilled template placeholders). All 105 requirements therefore carry assessment: null — the standard's evidence-collection method does not exist yet.
  • Requirement id scheme: the draft defines its own per-topic bullet ids R1.1–R19.4 (with a/b variants, e.g. R1.5a) instead of the REQ-PP-ESR-NNN convention other stan4cra drafts use; the pack uses those R ids verbatim, with clauseRef recording the containing clause (5.1–5.19).
  • Id-sequence irregularities in the draft: clause 5.2 defines R2.2 and R2.2b but no R2.2a; clause 5.8 defines R8.4b but no R8.4a.
  • Annex ZA/ZB correspondence tables reference four ids clause 5 never defines: R2.5, R5.1 (only R5.1a/R5.1b exist), R6.5 and R13.4c. The craMap rows carry the tables verbatim, dangling references included.
  • No per-use-case applicability mapping exists: clause 4.4.3 defines six use cases (UC-PM1–UC-PM6) with risk levels, but no matrix ties requirements to them. Every requirement carries an empty applicability map plus the verbatim Capability/Condition prose of its topic as applicabilityText.
  • Clause 4.4.1 (Universal Security Requirements) contains five normative SHALL controls with no requirement ids; they are carried verbatim in applicabilityIntro, not as answerable requirement rows.
  • Annex L (the formal CRA relationship annex) is marked “DRAFT ANNEX L - DO NOT CONSIDER THE CONTENT”; the craMap is taken from the informative Annex ZA table instead.
  • Annex ZA's second table (“Compliance Mapping to CRA Annex I (Daniel's sketch with commentary)”) uses CRA Annex I reference numbering inconsistent with the regulation (e.g. “Part I, 1(a) - Secure by default”); it is not extracted.
  • Threats are the per-topic T1.1–T19.4 bullets (76 entries, extracted); Annex E (risk identification) and Annex F (risk evaluation) are empty template placeholders.
  • Structural draft defects: two different clauses are both numbered 4.1 (“Password Manager” and “Scope Boundaries”); clauses 4.1/4.3/4.5 sit at top level instead of under clause 4; “Annex C” appears twice; the Foreword still carries Group-Report boilerplate (“This Group Report (GR) has been produced by ETSI Industry Specification Group…”); the version field is an unfilled {{VERSION}} placeholder.
  • The Modal verbs clause omits “shall”/“shall not” from the list of interpreted verbs even though every requirement uses SHALL.
  • Requirements embed specific technical parameters that the executive summary says will be tiered by implementation priority (critical / six-month / medium), but no such tiering appears in the normative text.

How this pack is built, and corrections

The pack is produced by a deterministic parser over the vendored draft text pinned in the source card— no model writes or rewrites any requirement. When ETSI updates the draft, the pack is rebuilt from the new text, the draft gaps are rechecked, and the result ships as a new pack version — never a silent edit.

The interim draft and, once published, the standard itself are the authoritative texts — this pack reproduces and cites them, it does not replace them, and nothing on this page is legal advice. If you find an error — a mis-parsed requirement, an applicability entry that does not match the draft, a gap we missed — write to hello@vandorisk.com. The horizontal pack this one attaches alongside is published at /pack, with every tracked vertical standard listed there.