oSIST prEN 304 631 V1.0.0:2026
(Main)Cyber Security (CYBER) - CRA - Cybersecurity requirements for smart home general purpose virtual assistants
- Abstract
DEN/CYBER-EUS-0011
- Status
- Not Published
- Public Enquiry End Date
- 30-Sep-2026
- Technical Committee
- SPN - Services and Protocols for Networks
- Current Stage
- 4020 - Public enquire (PE) (Adopted Project)
- Start Date
- 03-Aug-2026
- Due Date
- 21-Dec-2026
- Completion Date
- 29-Sep-2026
oSIST prEN 304 631 V1.0.0:2026 is the Slovenian version of ETSI EN 304 631 V1.0.0 (2026-07). It sets cybersecurity requirements and assessment criteria for smart home general purpose virtual assistants (SHGPVA) that communicate on the public Internet, process natural-language prompts, and provide access to services or control connected devices in residential settings.
The standard is written for products with digital elements used by consumers and for manufacturers who integrate such assistants into other consumer products. It covers vulnerability handling, secure default configuration, updates, authentication and access control, confidentiality, integrity, availability, monitoring, attack surface reduction, and cryptography.
What does oSIST prEN 304 631 V1.0.0:2026 specify?
oSIST prEN 304 631 V1.0.0:2026 specifies cybersecurity requirements, vulnerability handling activities, and corresponding assessment criteria for SHGPVA. The document is organized so that clause 4 sets the product context, clause 5 states the technical requirements, and clause 6 gives the assessment criteria used to check conformity.
The shown contents also include annexes that support the risk-based approach and the technical tests.
| Annex | What it covers |
|---|---|
| Annex B | Security analysis, assets, risk factors, assumptions, threats, and the relationship between covered and uncovered cybersecurity risks |
| Annex D | Mapping of data assets and function assets to impact classes |
| Annex E | Protection measures, strength levels, and the test criteria used to assess them |
| Annex K | Cryptography, crypto agility, ACM-extended mechanisms, and interoperability-based cryptographic mechanisms |
The scope ties the requirements to the product context and intended use. In practice, that means a supplier must first identify the assistant's functions, data, interfaces, users, and operational environment, then apply the requirements that are relevant to that context.
What are the key requirements of oSIST prEN 304 631 V1.0.0:2026?
Product context and applicability
Clause 4 and clause 5.1 link the technical requirements to the SHGPVA's intended use, architecture, users, interfaces, and impact classes. The standard says the product shall comply with all applicable requirements at all times when operating in its product context. In practice, this means the vendor has to identify what the assistant actually does, what data it handles, and which functions fall into which impact class before choosing the controls.
The document also distinguishes between what the SHGPVA provides itself and what it relies on from other products in its context. That matters because a requirement can be satisfied by the assistant or by another connected product, but the assessment still has to show how the security function is delivered.
Secure default behavior, setup, and updates
Clause 5.4 covers secure by default configuration. The visible requirements include default handling of update notifications, factory reset behavior, default handling of monitored events, and cryptographic defaults such as key sizes and password complexity. For a buyer or integrator, this means the product should already be set up securely before first use, rather than depending on the installer to harden it later.
Clause 5.3 requires no known exploitable vulnerabilities and includes first-use behavior for security updates. The visible text shows that, when possible, the assistant should request and install available security update packages before or during first use. This matters because vulnerable devices are often attacked immediately after deployment.
Clause 5.5 addresses security updates. The assessment criteria show that the standard expects documented update mechanisms, automated security update capability where relevant, support for disabling or postponing automated updates, and update notifications. In practice, a supplier has to be able to explain how software is updated and how users are informed.
Authentication, access control, and configuration safety
Clause 5.6 covers authentication and access control. Table 1 assigns access control mechanisms according to impact class and communication path, and the visible requirements include least privilege and revocability of permissions. In practice, this means access should be limited to what is needed, and granted permissions should be removable later.
Clause 5.2.3 requires GUIs for security-related configuration to clearly separate security options from other settings, explain the consequences in understandable language, and visually highlight security-related changes. This matters because consumer assistants are often configured through simple interfaces where confusing wording can lead to unsafe choices.
Clause 5.2.4 and the related assessment text cover backup or transfer mechanisms for loss sensitive data. The standard expects documented transfer mechanisms and testable behavior. For a supplier, this means the product must show how important data can be moved or preserved without exposing it unnecessarily.
Confidentiality and integrity protection
Clause 5.7 covers confidentiality protection, including the strength of protection for confidential data in storage and communication. Table 4 assigns protection levels based on impact class and communication type. The clause also covers indications when audio or video capture is active, including an API method for software components without a human interface, and a mechanism to disable capture where the assistant has an external sensing function. In practice, the product must both protect private data and make sensing visible to users.
Clause 5.8 covers integrity protection. Table 5 assigns secure-storage strength levels for integrity-relevant data, clause 5.8.2 covers integrity-protecting communication mechanisms, and clause 5.8.3 requires software package verification before installation. That means update files and installed data must be checked so the assistant does not accept altered software or corrupted integrity-relevant data.
Data minimisation, availability, and non-interference
Clause 5.9 requires data minimisation. The visible requirement says that if the SHGPVA monitors captured audio or video to detect events, it shall not use public communication interfaces to transfer that data before event detection. This is important for designs that process audio or video locally and only send data onward when needed.
Clause 5.10 covers availability protection, including notification before low power conditions limit use and network prioritisation for time-sensitive functions. That matters for assistants that control home functions or provide real-time responses, because a loss of power or network access can interrupt expected behavior.
Clause 5.11 requires non-interference controls to prevent effective amplification of requests or traffic for functions that could affect the availability of other devices, services, or networks. In practice, the assistant should not become a source of traffic amplification that harms the home network or external services.
Attack surface reduction, monitoring, and reset
Clause 5.12 reduces attack surface through sanitisation of external input, limiting physical and logical interfaces to what is necessary, limiting apps by default, and secure boot. The secure boot requirement applies where the assistant includes hardware components and a function whose misuse can cause high harm. This means startup code should only execute verified core software.
Clause 5.14 covers monitoring. The visible text requires event logging for configuration changes, state changes, software errors, audio or video capture, and storage or transmission of captured data, depending on the function impact class. It also requires handling of audit event data through logging or data transfer, timestamps in logs, user control over logging configuration, and user access to logs that affect privacy. In practice, this gives traceability for incidents and support investigations.
Clause 5.15 covers factory reset and data portability, and the assessment section shows that permission handling is part of the expected evaluation. This is relevant for decommissioning, transfer, and removal of the product from service.
What terms does oSIST prEN 304 631 V1.0.0:2026 define?
- architectural component - A self-contained hardware or software part of the SHGPVA.
- core software - Software that abstracts hardware, manages resources, and provides interfaces for other software or for itself.
- public communication - Ingoing or outgoing communication to or from public networks, such as the Internet.
- strict local communication - Communication that requires physical presence at the communication partner, such as using a keypad on the device.
- private audio data - Non-public audio information handled by the SHGPVA, including recordings captured by it or provided by the user.
- input validation mechanism - A function that rejects input data when it does not match an accepted pattern.
- security insurance time (T_SI) - The time during which an authentication mechanism is expected to withstand random-guessing attacks.
- single factor authentication - Authentication that uses only one authentication factor.
Who uses oSIST prEN 304 631 V1.0.0:2026?
The standard is intended for Consumers and for Manufactures for integration in other products with digital elements intended for consumers. In practice, that means product designers, software and hardware engineers, cybersecurity teams, and system integrators use it when building or combining smart home voice assistants.
It is also useful for quality managers, compliance teams, test labs, and buyers who need to check whether a SHGPVA has the required controls, documentation, and assessment evidence. Clause 6 is especially relevant for conformity assessment because it describes objective and reproducible checks, including documentation review, inspection of interfaces, functional testing, and penetration-style verification.
Which standards are used with oSIST prEN 304 631 V1.0.0:2026?
| Reference | What it contributes |
|---|---|
| ENISA Report 1747792503, version 2 - April 2025 | The list of Agreed Cryptographic Mechanisms used by Annex K and clause K.1 |
| Regulation (EU) 2024/2847 | The Cyber Resilience Act framework that the standard supports |
| Standardisation request M/606 - C(2025)618 | The standardisation mandate for products with digital elements |
| prEN 40000-1-1 | Vocabulary for cybersecurity requirements for products with digital elements |
| ETSI EN 304 623 [i.6] | Cited in the secure boot note as the related verified boot capability |
What does the oSIST prEN 304 631 V1.0.0:2026 document contain?
The document contains a structured risk-based security specification for SHGPVA, with asset and threat analysis in Annex B, impact-class mappings in Annex D, and strength-level based protection measures in Annex E. It also contains cryptography rules in Annex K, including requirements for default cryptographic mechanisms, crypto agility, and allowed mechanism lists.
It provides tables for assigning access-control, confidentiality, integrity, and software-verification measures to the right impact classes. It also includes assessment procedures that rely on documentation, inspections of physical and logical interfaces, and tests on sample devices, including startup, update, logging, capture indication, and network or power-condition checks.
The assessment sections show the kind of evidence the standard expects: lists of mechanisms, descriptions of interfaces, test setups, and records of performed tests. That makes the document useful both for design work and for conformity checking.
Get Certified
Connect with accredited certification bodies for this standard
BSI Group
BSI (British Standards Institution) is the business standards company that helps organizations make excellence a habit.
Bureau Veritas
Bureau Veritas is a world leader in laboratory testing, inspection and certification services.
DNV
DNV is an independent assurance and risk management provider.
Sponsored listings
Frequently Asked Questions
oSIST prEN 304 631 V1.0.0:2026 is a standard published by the Slovenian Institute for Standardization (SIST). Its full title is "Cyber Security (CYBER) - CRA - Cybersecurity requirements for smart home general purpose virtual assistants". This standard covers: DEN/CYBER-EUS-0011
DEN/CYBER-EUS-0011
oSIST prEN 304 631 V1.0.0:2026 is classified under the following ICS (International Classification for Standards) categories: 35.030 - IT Security. The ICS classification helps identify the subject area and facilitates finding related standards.
oSIST prEN 304 631 V1.0.0:2026 is available in PDF format for immediate download after purchase. The document can be added to your cart and obtained through the secure checkout process. Digital delivery ensures instant access to the complete standard document.
Standards Content (Sample)
Draft ETSI EN 304 631 V1.0.0 (2026-07)
HARMONISED EUROPEAN STANDARD
Cyber Security (CYBER);
CRA;
Cybersecurity requirements for
smart home general purpose virtual assistants
2 Draft ETSI EN 304 631 V1.0.0 (2026-07)
Reference
DEN/CYBER-EUS-0011
Keywords
CRA, cybersecurity, intelligent homes & buildings
ETSI
650 Route des Lucioles
F-06921 Sophia Antipolis Cedex - FRANCE
Tel.: +33 4 92 94 42 00 Fax: +33 4 93 65 47 16
Siret N° 348 623 562 00017 - APE 7112B
Association à but non lucratif enregistrée à la
Sous-Préfecture de Grasse (06) N° w061004871
Important notice
The present document can be downloaded from the
ETSI Search & Browse Standards application.
The present document may be made available in electronic versions and/or in print. The content of any electronic and/or
print versions of the present document shall not be modified without the prior written authorization of ETSI. In case of any
existing or perceived difference in contents between such versions and/or in print, the prevailing version of an ETSI
deliverable is the one made publicly available in PDF format on ETSI deliver repository.
Users should be aware that the present document may be revised or have its status changed,
this information is available in the Milestones listing.
If you find errors in the present document, please send your comments to
the relevant service listed under Committee Support Staff.
If you find a security vulnerability in the present document, please report it through our
Coordinated Vulnerability Disclosure (CVD) program.
Notice of disclaimer & limitation of liability
The information provided in the present deliverable is directed solely to professionals who have the appropriate degree of
experience to understand and interpret its content in accordance with generally accepted engineering or
other professional standard and applicable regulations.
No recommendation as to products and services or vendors is made or should be implied.
In no event shall ETSI be held liable for loss of profits or any other incidental or consequential damages.
Any software contained in this deliverable is provided "AS IS" with no warranties, express or implied, including but not
limited to, the warranties of merchantability, fitness for a particular purpose and non-infringement of intellectual property
rights and ETSI shall not be held liable in any event for any damages whatsoever (including, without limitation, damages
for loss of profits, business interruption, loss of information, or any other pecuniary loss) arising out of or related to the use
of or inability to use the software.
Copyright Notification
No part of this document may be reproduced in any form, by any means and in any media, without the prior written
authorization of ETSI and except as expressly permitted below.
By way of exception and when the document is a normative deliverable (European Standard (EN),
Technical Specification (TS), Group Specification (GS) or ETSI Standard (ES)), ETSI authorizes to reproduce
and incorporate into products, services and technical documentation only those extracts (e.g. templates) that are strictly
necessary for the technical implementation of the normative deliverable, to ensure compliance with the latter.
Nothing in this notice shall be construed as limiting any mandatory exceptions to copyright provided by applicable law.
© ETSI 2026.
All rights reserved.
ETSI
3 Draft ETSI EN 304 631 V1.0.0 (2026-07)
Contents
Intellectual Property Rights . 10
Foreword. 10
Modal verbs terminology . 11
Introduction . 11
1 Scope . 12
2 References . 12
2.1 Normative references . 12
2.2 Informative references . 12
3 Definition of terms, symbols and abbreviations . 13
3.1 Terms . 13
3.1.1 Architecture related terms . 13
3.1.2 Asset categories . 14
3.1.3 Communication types . 14
3.1.4 Data assets . 15
3.1.5 Data related terms . 16
3.1.6 Function assets . 17
3.1.7 Function related terms . 18
3.1.8 Interface . 22
3.1.9 Operational environments . 23
3.1.10 Users. 23
3.2 Symbols . 23
3.3 Abbreviations . 24
4 Product context . 26
4.1 Product functions . 26
4.1.1 Function assets . 26
4.1.2 Data assets . 26
4.2 Product architecture . 27
4.3 Operational environment . 28
4.3.1 General description . 28
4.3.2 Physical/Hardware environment . 28
4.3.3 Logical/Software environment . 29
4.3.4 Connectivity aspects . 29
4.4 Distribution of security functions . 29
4.5 Users . 30
4.6 Use cases . 30
5 Technical requirements for products . 30
5.1 Introduction - Applicability of the requirements . 30
5.2 Appropriate level of cybersecurity . 30
5.2.0 Introduction on appropriate level of cybersecurity requirements . 30
5.2.1 [USERNOT-NOSECFUC] User notifications on not available security functions . 30
5.2.2 [USERNOT-SECREL] Language and representation for security-related user notifications . 30
5.2.3 [GUI-SECCONF] Visual representation of security-related configuration via GUIs . 31
5.2.4 [BACKUP-TRANS] Data transfer mechanisms for loss sensitive data . 31
5.2.5 [BACKUP-AUTOTRANS] Automatic data transfer mechanisms for loss sensitive data . 31
5.2.6 [BACKUP-EXPORT] Data export mechanisms for loss sensitive data . 31
5.3 No known exploitable vulnerabilities . 31
5.3.0 Introduction on no known exploitable vulnerabilities . 31
5.3.1 [NKEV-MKAV] No known exploitable vulnerabilities . 31
5.3.2 [NKEV-INIT-UDP] Initial security update before or during first use . 31
5.4 Secure by default configuration . 32
5.4.0 Introduction on secure by default configuration. 32
5.4.1 [SDC-AUM-FH] Default configuration of authentication for functions whose use can cause harm . 32
5.4.2 [SDC-SUM-AUTO] Default configuration of automated security updates . 32
ETSI
4 Draft ETSI EN 304 631 V1.0.0 (2026-07)
5.4.3 [SDC-SUM-NOTIF] Default configuration of update notifications . 32
5.4.4 [SDC-FRM] Factory reset to restore the default state . 32
5.4.5 [SDC-MON-HANDLE] Handling of events by default . 33
5.4.6 [CRY-GENERAL] General requirements related to cryptography . 33
5.4.7 [CRY-CCK-PRE-LEN] Key size of preinstalled long term confidential cryptographic keys . 33
5.4.8 [CRY-CCK-GEN] Default key size of generated long term confidential cryptographic keys . 33
5.4.9 [CRY-PW-PRE-COM] Complexity of preinstalled passwords . 33
5.4.10 [CRY-PW-GEN-COM] Default complexity of generated passwords . 33
5.4.11 [CRY-PW-USR-COM] Recommended complexity of user chosen passwords . 34
5.5 Security updates . 34
5.5.0 Introduction on security updates . 34
5.5.1 [SU-SUPPORT] Secure software update mechanism . 34
5.5.2 [SU-PROVIDE] Secure software update mechanism for core components . 34
5.5.3 [SU-AUTO] Automated security updates . 34
5.5.4 [SU-DISABLE-AUTO] Option to disable automated security updates . 35
5.5.5 [SU-POSTPONE-AUTO] Option to postpone automated security updates. 35
5.5.6 [SU-NOTIF] Update notifications . 35
5.6 Authentication and access control . 35
5.6.0 Introduction on authentication and access control . 35
5.6.1 [ACM-FH] Access control for functions whose use can cause harm . 35
5.6.2 [AUM-FH] Authentication for functions whose use can cause harm . 36
5.6.3 [AUTHZ-LP] Least privilege in authorisation policies . 37
5.6.4 [AUTHZ-R] Revocability of granted permissions . 37
5.7 Confidentiality protection . 37
5.7.0 Introduction on confidentiality protection . 37
5.7.1 [CONF-SSM] Confidentiality protecting persistent storage for confidential data . 37
5.7.2 [CONF-COM] Communication of confidential data . 37
5.7.3 [CONF-MON-HW] Indication of active capture of audio or video data for hardware architectural
component SHGPVA . 38
5.7.4 [CONF-MON-UI] Indication of active capture of audio or video data for software architectural
component SHGPVA with human interfaces . 38
5.7.5 [CONF-MON-API] Indication of active capture of audio or video data for software architectural
component SHGPVA without a human interface. 39
5.7.6 [CONF-CAPT-MUTE] Mechanism to disable capture . 39
5.7.7 [CONF-CAPT-MUTE-DISABLE] Allowing capturing after disabling . 39
5.8 Integrity protection . 39
5.8.0 Introduction on integrity protection . 39
5.8.1 [INT-SSM] Integrity protecting persistent storage for integrity relevant data . 39
5.8.2 [INT-COM] Communication of integrity relevant data . 40
5.8.3 [INT-SWPCK] Software package verification . 41
5.9 Data minimisation . 41
5.9.0 Introduction on data minimisation . 41
5.9.1 [DMIN-DJST] Minimise processed data. 41
5.9.2 [DMIN-USERINFO] User Information about processing of audio- and video data . 41
5.9.3 [DMIN-LOCAL] Local event detection . 42
5.10 Availability protection . 42
5.10.0 Introduction on availability protection . 42
5.10.1 [AVAI-TIME-RECO-POW] Restoration after loss of power . 42
5.10.2 [AVAI-TIME-NETW] Local operation . 42
5.10.3 [AVAI-TIME-RECO-NETW] Restoration after loss of network connection . 42
5.10.4 [AVAI-TIME-OUTA-NOT] Notify non-availability . 42
5.10.5 [AVAI-TIME-PREV-NOT] Notify upcoming limitation . 43
5.10.6 [AVAI-TIME-NET-PRIO] Network prioritisation . 43
5.10.7 [AVAI-TIME-RES-PRIO] Power resource prioritization . 43
5.10.8 [AVAI-TIME-DOS-RATE] Incoming rate limiting . 43
5.10.9 [AVAI-SUM-SCHEDULE] Scheduling of updates . 43
5.11 Non-interference . 43
5.11.0 Introduction on non-interference . 43
5.11.1 [NOINF-AMP] Amplification control . 44
5.12 Attack surface minimisation . 44
5.12.0 Introduction on attack surface minimisation . 44
5.12.1 [LAS-INVAL] Validation of external data input . 44
ETSI
5 Draft ETSI EN 304 631 V1.0.0 (2026-07)
5.12.2 [LAS-INSAN] Sanitisation of external data input . 44
5.12.3 [LAS-PHY-INF] Only necessary physical interfaces . 44
5.12.4 [LAS-LOGIC-INF] Only necessary logical interfaces active by default . 44
5.12.5 [LAS-APP] Only necessary apps by default . 44
5.12.6 [LAS-SBOOT] Secure boot . 45
5.13 Exploit mitigation . 45
5.13.0 Introduction on exploit mitigation . 45
5.13.1 [PRIV-DATA-HIGH] Privileged access on impact class high data assets . 45
5.13.2 [PRIV-FUNC-HIGH] Privileged access on impact class high function assets . 45
5.14 Monitoring . 45
5.14.0 Introduction on monitoring . 45
5.14.1 [MON-LOW] Events to log for low risk SHGPVA . 46
5.14.2 [MON-MEDIUM] Events to log for medium risk SHGPVA . 46
5.14.3 [MON-HIGH] Events to log for high risk SHGPVA . 46
5.14.4 [MON-HANDLE] Handling of events . 47
5.14.5 [LOG-TIME] Timestamps for logs . 47
5.14.6 [LOG-TIME-HIGH] Real-time timestamps for logs . 47
5.14.7 [LOG-STORE-MEDIUM] Logfile persistence for medium risk SHGPVA . 47
5.14.8 [LOG-STORE-HIGH] Logfile persistence for high risk SHGPVA . 47
5.14.9 [LOG-CONFIG] Configuration of logging mechanisms . 48
5.14.10 [LOG-USER-ACC] User access to logs concerning their privacy . 48
5.15 Factory reset and data portability . 48
5.15.0 Introduction on factory reset and data portability . 48
5.15.1 [DLM-PERM] Permanent removal of user-related data . 48
6 Assessment criteria for compliance with technical requirements . 49
6.1 General . 49
6.2 Appropriate level of cybersecurity . 50
6.2.1 Assessment criteria for [USERNOT-NOSECFUC] . 50
6.2.2 Assessment criteria for [USERNOT-SECREL] . 51
6.2.3 Assessment criteria for [GUI-SECCONF] . 52
6.2.4 Assessment criteria for [BACKUP-TRANS] . 53
6.2.5 Assessment criteria for [BACKUP-AUTOTRANS] . 54
6.2.6 Assessment criteria for [BACKUP-EXPORT]. 56
6.3 No known exploitable vulnerabilities . 57
6.3.1 Assessment criteria for [NKEV-MKAV] . 57
6.3.2 Assessment criteria for [NKEV-INIT-UDP] . 58
6.4 Secure by default configuration . 59
6.4.1 Assessment criteria for [SDC-AUM-FH] . 59
6.4.2 Assessment criteria for [SDC-SUM-AUTO] . 60
6.4.3 Assessment criteria for [SDC-SUM-NOTIF] . 62
6.4.4 Assessment criteria for [SDC-FRM] . 63
6.4.5 Assessment criteria for [SDC-MON-HANDLE] . 64
6.4.6 Assessment criteria for [CRY-GENERAL] . 65
6.4.7 Assessment criteria for [CRY-CCK-PRE-LEN] . 65
6.4.8 Assessment criteria for [CRY-CCK-GEN] . 66
6.4.9 Assessment criteria for [CRY-PW-PRE-COM] . 67
6.4.10 Assessment criteria for [CRY-PW-GEN-COM] . 67
6.4.11 Assessment criteria for [CRY-PW-USR-COM]. 68
6.5 Security updates . 70
6.5.1 Assessment criteria for [SU-SUPPORT]. 70
6.5.2 Assessment criteria for [SU-PROVIDE] . 71
6.5.3 Assessment criteria for [SU-AUTO] . 72
6.5.4 Assessment criteria for [SU-DISABLE-AUTO] . 73
6.5.5 Assessment criteria for [SU-POSTPONE-AUTO]. 74
6.5.6 Assessment criteria for [SU-NOTIF] . 75
6.6 Authentication and access control . 77
6.6.1 Assessment criteria for [ACM-FH] . 77
6.6.2 Assessment criteria for [AUM-FH] . 78
6.6.3 Assessment criteria for [AUTHZ-LP] . 79
6.6.4 Assessment criteria for [AUTHZ-R] . 80
6.7 Confidentiality protection . 81
ETSI
6 Draft ETSI EN 304 631 V1.0.0 (2026-07)
6.7.1 Assessment criteria for [CONF-SSM] . 81
6.7.2 Assessment criteria for [CONF-COM] . 82
6.7.3 Assessment criteria for [CONF-MON-HW] . 83
6.7.4 Assessment criteria for [CONF-MON-UI] . 84
6.7.5 Assessment criteria for [CONF-MON-API] . 85
6.7.6 Assessment criteria for [CONF-CAPT-MUTE] . 87
6.7.7 Assessment criteria for [CONF-CAPT-MUTE-DISABLE] . 88
6.8 Integrity protection . 89
6.8.1 Assessment criteria for [INT-SSM] . 89
6.8.2 Assessment criteria for [INT-COM] . 90
6.8.3 Assessment criteria for [INT-SWPCK] . 91
6.9 Data minimisation . 93
6.9.1 Assessment criteria for [DMIN-DJST] . 93
6.9.2 Assessment criteria for [DMIN-USERINFO] . 93
6.9.3 Assessment criteria for [DMIN-LOCAL] . 94
6.10 Availability protection . 96
6.10.1 Assessment criteria for [AVAI-TIME-RECO-POW] . 96
6.10.2 Assessment criteria for [AVAI-TIME-NETW] . 97
6.10.3 Assessment criteria for [AVAI-TIME-RECO-NETW] . 99
6.10.4 Assessment criteria for [AVAI-TIME-OUTA-NOT] . 100
6.10.5 Assessment criteria for [AVAI-TIME-PREV-NOT] . 102
6.10.6 Assessment criteria for [AVAI-TIME-NET-PRIO] . 103
6.10.7 Assessment criteria for [AVAI-TIME-RES-PRIO] . 104
6.10.8 Assessment criteria for [AVAI-TIME-DOS-RATE] . 106
6.10.9 Assessment criteria for [AVAI-SUM-SCHEDULE] . 107
6.11 Non-interference . 108
6.11.1 Assessment criteria for [NOINF-AMP] . 108
6.12 Attack surface minimisation . 109
6.12.1 Assessment criteria for [LAS-INVAL] . 109
6.12.2 Assessment criteria for [LAS-INSAN] . 110
6.12.3 Assessment criteria for [LAS-PHY-INF] . 111
6.12.4 Assessment criteria for [LAS-LOGIC-INF] . 112
6.12.5 Assessment criteria for [LAS-APP] . 113
6.12.6 Assessment criteria for [LAS-SBOOT]. 114
6.13 Exploit mitigation . 115
6.13.1 Assessment criteria for [PRIV-DATA-HIGH] . 115
6.13.2 Assessment criteria for [PRIV-FUNC-HIGH] . 116
6.14 Monitoring . 117
6.14.1 Assessment criteria for [MON-LOW] . 117
6.14.2 Assessment criteria for [MON-MEDIUM] . 118
6.14.3 Assessment criteria for [MON-HIGH] . 119
6.14.4 Assessment criteria for [MON-HANDLE] . 120
6.14.5 Assessment criteria for [LOG-TIME] . 121
6.14.6 Assessment criteria for [LOG-TIME-HIGH] . 122
6.14.7 Assessment criteria for [LOG-STORE-MEDIUM] . 123
6.14.8 Assessment criteria for [LOG-STORE-HIGH] . 124
6.14.9 Assessment criteria for [LOG-CONFIG] . 125
6.14.10 Assessment criteria for [LOG-USER-ACC] . 126
6.15 Factory reset and data portability . 127
6.15.1 Assessment criteria for [DLM-PERM] . 127
Annex A (informative): Relationship between the present document and the essential
cybersecurity requirements of EU Regulation (EU) 2024/2847 . 130
Annex B (informative): Security analysis. 135
B.1 General . 135
B.2 Assets . 135
B.3 Risk factors . 135
B.4 Assumptions . 135
ETSI
7 Draft ETSI EN 304 631 V1.0.0 (2026-07)
B.5 Threats . 136
B.6 Relationship between the present document and the covered/not covered cybersecurity risks . 137
B.7 Guidance for determining impact classes . 141
B.7.1 General . 141
B.7.2 Confidential data . 141
B.7.3 Loss sensitive data . 141
B.7.4 Time sensitive function . 142
B.7.5 Integrity relevant data and integrity relevant function . 142
Annex C: Void . 144
Annex D (normative): Relationship between specific data and functions assets covered by
the present document to impact classes for generic asset categories . 145
D.1 Data assets . 145
D.2 Function assets . 146
Annex E (normative): Protection measures . 148
E.1 Authentication mechanism strength . 148
E.1.1 [AUM-FH] Authentication for functions whose use can cause harm . 148
E.1.1.1 General . 148
E.1.1.2 [AUM-E-I-Basic] AUTH.Basic inherence based SFA . 148
E.1.1.3 [AUM-E-K-Basic] AUTH.Basic knowledge based SFA . 148
E.1.1.4 [AUM-E-I-Normal] AUTH.Normal inherence based SFA . 148
E.1.1.5 [AUM-E-K-Normal] AUTH.Normal knowledge based SFA . 148
E.1.1.6 [AUM-E-P-Normal] AUTH.Normal possession based SFA . 148
E.1.1.7 [AUM-E-MFA-Normal] AUTH.Normal MFA . 149
E.1.1.8 [AUM-E-I-Enhanced] AUTH.Enhanced inherence based SFA . 149
E.1.1.9 [AUM-E-K-Enhanced] AUTH.Enhanced knowledge based SFA . 149
E.1.1.10 [AUM-E-P-Enhanced] AUTH.Enhanced possession based SFA . 149
E.1.1.11 [AUM-E-MFA-Enhanced] AUTH.Enhanced MFA . 149
E.1.1.12 [AUM-E-I-Strong] AUTH.Strong inherence based SFA . 150
E.1.1.13 [AUM-E-P-Strong] AUTH.Strong possession based SFA . 150
E.1.1.14 [AUM-E-MFA-Strong] AUTH.Strong MFA . 150
E.1.1.15 [AUM-E-Replay] AUTH.Normal, AUTH.Enhanced and AUTH.Strong replay protection . 150
E.1.1.16 [AUM-E-PitM] AUTH.Normal, AUTH.Enhanced and AUTH.Strong person in the middle
protection . 151
E.1.2 Assessment for [AUM-FH] authentication mechanism strength . 151
E.1.2.1 General . 151
E.1.2.2 Assessment criteria for [AUM-E-I-Basic] . 151
E.1.2.3 Assessment criteria for [AUM-E-K-Basic] . 152
E.1.2.4 Assessment criteria for [AUM-E-I-Normal] . 153
E.1.2.5 Assessment criteria for [AUM-E-K-Normal] . 154
E.1.2.6 Assessment criteria for [AUM-E-P-Normal] . 154
E.1.2.7 Assessment criteria for [AUM-E-MFA-Normal] . 156
E.1.2.8 Assessment criteria for [AUM-E-I-Enhanced] . 157
E.1.2.9 Assessment criteria for [AUM-E-K-Enhanced] . 158
E.1.2.10 Assessment criteria for [AUM-E-P-Enhanced] . 159
E.1.2.11 Assessment criteria for [AUM-E-MFA-Enhanced] . 161
E.1.2.12 Assessment criteria for [AUM-E-I-Strong] . 162
E.1.2.13 Assessment criteria for [AUM-E-P-Strong] . 163
E.1.2.14 Assessment criteria for [AUM-E-MFA-Strong]. 164
E.1.2.15 Assessment criteria for [AUM-E-Replay] .
...
SLOVENSKI STANDARD
01-september-2026
Kibernetska varnost (CYBER) - CRA - Zahteve za kibernetsko varnost za virtualne
pomočnike splošnega namena v pametnih domovih
Cyber Security (CYBER) - CRA - Cybersecurity requirements for smart home general
purpose virtual assistants
Ta slovenski standard je istoveten z: ETSI EN 304 631 V1.0.0 (2026-07)
ICS:
35.030 Informacijska varnost IT Security
2003-01.Slovenski inštitut za standardizacijo. Razmnoževanje celote ali delov tega standarda ni dovoljeno.
Draft ETSI EN 304 631 V1.0.0 (2026-07)
HARMONISED EUROPEAN STANDARD
Cyber Security (CYBER);
CRA;
Cybersecurity requirements for
smart home general purpose virtual assistants
2 Draft ETSI EN 304 631 V1.0.0 (2026-07)
Reference
DEN/CYBER-EUS-0011
Keywords
CRA, cybersecurity, intelligent homes & buildings
ETSI
650 Route des Lucioles
F-06921 Sophia Antipolis Cedex - FRANCE
Tel.: +33 4 92 94 42 00 Fax: +33 4 93 65 47 16
Siret N° 348 623 562 00017 - APE 7112B
Association à but non lucratif enregistrée à la
Sous-Préfecture de Grasse (06) N° w061004871
Important notice
The present document can be downloaded from the
ETSI Search & Browse Standards application.
The present document may be made available in electronic versions and/or in print. The content of any electronic and/or
print versions of the present document shall not be modified without the prior written authorization of ETSI. In case of any
existing or perceived difference in contents between such versions and/or in print, the prevailing version of an ETSI
deliverable is the one made publicly available in PDF format on ETSI deliver repository.
Users should be aware that the present document may be revised or have its status changed,
this information is available in the Milestones listing.
If you find errors in the present document, please send your comments to
the relevant service listed under Committee Support Staff.
If you find a security vulnerability in the present document, please report it through our
Coordinated Vulnerability Disclosure (CVD) program.
Notice of disclaimer & limitation of liability
The information provided in the present deliverable is directed solely to professionals who have the appropriate degree of
experience to understand and interpret its content in accordance with generally accepted engineering or
other professional standard and applicable regulations.
No recommendation as to products and services or vendors is made or should be implied.
In no event shall ETSI be held liable for loss of profits or any other incidental or consequential damages.
Any software contained in this deliverable is provided "AS IS" with no warranties, express or implied, including but not
limited to, the warranties of merchantability, fitness for a particular purpose and non-infringement of intellectual property
rights and ETSI shall not be held liable in any event for any damages whatsoever (including, without limitation, damages
for loss of profits, business interruption, loss of information, or any other pecuniary loss) arising out of or related to the use
of or inability to use the software.
Copyright Notification
No part of this document may be reproduced in any form, by any means and in any media, without the prior written
authorization of ETSI and except as expressly permitted below.
By way of exception and when the document is a normative deliverable (European Standard (EN),
Technical Specification (TS), Group Specification (GS) or ETSI Standard (ES)), ETSI authorizes to reproduce
and incorporate into products, services and technical documentation only those extracts (e.g. templates) that are strictly
necessary for the technical implementation of the normative deliverable, to ensure compliance with the latter.
Nothing in this notice shall be construed as limiting any mandatory exceptions to copyright provided by applicable law.
© ETSI 2026.
All rights reserved.
ETSI
3 Draft ETSI EN 304 631 V1.0.0 (2026-07)
Contents
Intellectual Property Rights . 10
Foreword. 10
Modal verbs terminology . 11
Introduction . 11
1 Scope . 12
2 References . 12
2.1 Normative references . 12
2.2 Informative references . 12
3 Definition of terms, symbols and abbreviations . 13
3.1 Terms . 13
3.1.1 Architecture related terms . 13
3.1.2 Asset categories . 14
3.1.3 Communication types . 14
3.1.4 Data assets . 15
3.1.5 Data related terms . 16
3.1.6 Function assets . 17
3.1.7 Function related terms . 18
3.1.8 Interface . 22
3.1.9 Operational environments . 23
3.1.10 Users. 23
3.2 Symbols . 23
3.3 Abbreviations . 24
4 Product context . 26
4.1 Product functions . 26
4.1.1 Function assets . 26
4.1.2 Data assets . 26
4.2 Product architecture . 27
4.3 Operational environment . 28
4.3.1 General description . 28
4.3.2 Physical/Hardware environment . 28
4.3.3 Logical/Software environment . 29
4.3.4 Connectivity aspects . 29
4.4 Distribution of security functions . 29
4.5 Users . 30
4.6 Use cases . 30
5 Technical requirements for products . 30
5.1 Introduction - Applicability of the requirements . 30
5.2 Appropriate level of cybersecurity . 30
5.2.0 Introduction on appropriate level of cybersecurity requirements . 30
5.2.1 [USERNOT-NOSECFUC] User notifications on not available security functions . 30
5.2.2 [USERNOT-SECREL] Language and representation for security-related user notifications . 30
5.2.3 [GUI-SECCONF] Visual representation of security-related configuration via GUIs . 31
5.2.4 [BACKUP-TRANS] Data transfer mechanisms for loss sensitive data . 31
5.2.5 [BACKUP-AUTOTRANS] Automatic data transfer mechanisms for loss sensitive data . 31
5.2.6 [BACKUP-EXPORT] Data export mechanisms for loss sensitive data . 31
5.3 No known exploitable vulnerabilities . 31
5.3.0 Introduction on no known exploitable vulnerabilities . 31
5.3.1 [NKEV-MKAV] No known exploitable vulnerabilities . 31
5.3.2 [NKEV-INIT-UDP] Initial security update before or during first use . 31
5.4 Secure by default configuration . 32
5.4.0 Introduction on secure by default configuration. 32
5.4.1 [SDC-AUM-FH] Default configuration of authentication for functions whose use can cause harm . 32
5.4.2 [SDC-SUM-AUTO] Default configuration of automated security updates . 32
ETSI
4 Draft ETSI EN 304 631 V1.0.0 (2026-07)
5.4.3 [SDC-SUM-NOTIF] Default configuration of update notifications . 32
5.4.4 [SDC-FRM] Factory reset to restore the default state . 32
5.4.5 [SDC-MON-HANDLE] Handling of events by default . 33
5.4.6 [CRY-GENERAL] General requirements related to cryptography . 33
5.4.7 [CRY-CCK-PRE-LEN] Key size of preinstalled long term confidential cryptographic keys . 33
5.4.8 [CRY-CCK-GEN] Default key size of generated long term confidential cryptographic keys . 33
5.4.9 [CRY-PW-PRE-COM] Complexity of preinstalled passwords . 33
5.4.10 [CRY-PW-GEN-COM] Default complexity of generated passwords . 33
5.4.11 [CRY-PW-USR-COM] Recommended complexity of user chosen passwords . 34
5.5 Security updates . 34
5.5.0 Introduction on security updates . 34
5.5.1 [SU-SUPPORT] Secure software update mechanism . 34
5.5.2 [SU-PROVIDE] Secure software update mechanism for core components . 34
5.5.3 [SU-AUTO] Automated security updates . 34
5.5.4 [SU-DISABLE-AUTO] Option to disable automated security updates . 35
5.5.5 [SU-POSTPONE-AUTO] Option to postpone automated security updates. 35
5.5.6 [SU-NOTIF] Update notifications . 35
5.6 Authentication and access control . 35
5.6.0 Introduction on authentication and access control . 35
5.6.1 [ACM-FH] Access control for functions whose use can cause harm . 35
5.6.2 [AUM-FH] Authentication for functions whose use can cause harm . 36
5.6.3 [AUTHZ-LP] Least privilege in authorisation policies . 37
5.6.4 [AUTHZ-R] Revocability of granted permissions . 37
5.7 Confidentiality protection . 37
5.7.0 Introduction on confidentiality protection . 37
5.7.1 [CONF-SSM] Confidentiality protecting persistent storage for confidential data . 37
5.7.2 [CONF-COM] Communication of confidential data . 37
5.7.3 [CONF-MON-HW] Indication of active capture of audio or video data for hardware architectural
component SHGPVA . 38
5.7.4 [CONF-MON-UI] Indication of active capture of audio or video data for software architectural
component SHGPVA with human interfaces . 38
5.7.5 [CONF-MON-API] Indication of active capture of audio or video data for software architectural
component SHGPVA without a human interface. 39
5.7.6 [CONF-CAPT-MUTE] Mechanism to disable capture . 39
5.7.7 [CONF-CAPT-MUTE-DISABLE] Allowing capturing after disabling . 39
5.8 Integrity protection . 39
5.8.0 Introduction on integrity protection . 39
5.8.1 [INT-SSM] Integrity protecting persistent storage for integrity relevant data . 39
5.8.2 [INT-COM] Communication of integrity relevant data . 40
5.8.3 [INT-SWPCK] Software package verification . 41
5.9 Data minimisation . 41
5.9.0 Introduction on data minimisation . 41
5.9.1 [DMIN-DJST] Minimise processed data. 41
5.9.2 [DMIN-USERINFO] User Information about processing of audio- and video data . 41
5.9.3 [DMIN-LOCAL] Local event detection . 42
5.10 Availability protection . 42
5.10.0 Introduction on availability protection . 42
5.10.1 [AVAI-TIME-RECO-POW] Restoration after loss of power . 42
5.10.2 [AVAI-TIME-NETW] Local operation . 42
5.10.3 [AVAI-TIME-RECO-NETW] Restoration after loss of network connection . 42
5.10.4 [AVAI-TIME-OUTA-NOT] Notify non-availability . 42
5.10.5 [AVAI-TIME-PREV-NOT] Notify upcoming limitation . 43
5.10.6 [AVAI-TIME-NET-PRIO] Network prioritisation . 43
5.10.7 [AVAI-TIME-RES-PRIO] Power resource prioritization . 43
5.10.8 [AVAI-TIME-DOS-RATE] Incoming rate limiting . 43
5.10.9 [AVAI-SUM-SCHEDULE] Scheduling of updates . 43
5.11 Non-interference . 43
5.11.0 Introduction on non-interference . 43
5.11.1 [NOINF-AMP] Amplification control . 44
5.12 Attack surface minimisation . 44
5.12.0 Introduction on attack surface minimisation . 44
5.12.1 [LAS-INVAL] Validation of external data input . 44
ETSI
5 Draft ETSI EN 304 631 V1.0.0 (2026-07)
5.12.2 [LAS-INSAN] Sanitisation of external data input . 44
5.12.3 [LAS-PHY-INF] Only necessary physical interfaces . 44
5.12.4 [LAS-LOGIC-INF] Only necessary logical interfaces active by default . 44
5.12.5 [LAS-APP] Only necessary apps by default . 44
5.12.6 [LAS-SBOOT] Secure boot . 45
5.13 Exploit mitigation . 45
5.13.0 Introduction on exploit mitigation . 45
5.13.1 [PRIV-DATA-HIGH] Privileged access on impact class high data assets . 45
5.13.2 [PRIV-FUNC-HIGH] Privileged access on impact class high function assets . 45
5.14 Monitoring . 45
5.14.0 Introduction on monitoring . 45
5.14.1 [MON-LOW] Events to log for low risk SHGPVA . 46
5.14.2 [MON-MEDIUM] Events to log for medium risk SHGPVA . 46
5.14.3 [MON-HIGH] Events to log for high risk SHGPVA . 46
5.14.4 [MON-HANDLE] Handling of events . 47
5.14.5 [LOG-TIME] Timestamps for logs . 47
5.14.6 [LOG-TIME-HIGH] Real-time timestamps for logs . 47
5.14.7 [LOG-STORE-MEDIUM] Logfile persistence for medium risk SHGPVA . 47
5.14.8 [LOG-STORE-HIGH] Logfile persistence for high risk SHGPVA . 47
5.14.9 [LOG-CONFIG] Configuration of logging mechanisms . 48
5.14.10 [LOG-USER-ACC] User access to logs concerning their privacy . 48
5.15 Factory reset and data portability . 48
5.15.0 Introduction on factory reset and data portability . 48
5.15.1 [DLM-PERM] Permanent removal of user-related data . 48
6 Assessment criteria for compliance with technical requirements . 49
6.1 General . 49
6.2 Appropriate level of cybersecurity . 50
6.2.1 Assessment criteria for [USERNOT-NOSECFUC] . 50
6.2.2 Assessment criteria for [USERNOT-SECREL] . 51
6.2.3 Assessment criteria for [GUI-SECCONF] . 52
6.2.4 Assessment criteria for [BACKUP-TRANS] . 53
6.2.5 Assessment criteria for [BACKUP-AUTOTRANS] . 54
6.2.6 Assessment criteria for [BACKUP-EXPORT]. 56
6.3 No known exploitable vulnerabilities . 57
6.3.1 Assessment criteria for [NKEV-MKAV] . 57
6.3.2 Assessment criteria for [NKEV-INIT-UDP] . 58
6.4 Secure by default configuration . 59
6.4.1 Assessment criteria for [SDC-AUM-FH] . 59
6.4.2 Assessment criteria for [SDC-SUM-AUTO] . 60
6.4.3 Assessment criteria for [SDC-SUM-NOTIF] . 62
6.4.4 Assessment criteria for [SDC-FRM] . 63
6.4.5 Assessment criteria for [SDC-MON-HANDLE] . 64
6.4.6 Assessment criteria for [CRY-GENERAL] . 65
6.4.7 Assessment criteria for [CRY-CCK-PRE-LEN] . 65
6.4.8 Assessment criteria for [CRY-CCK-GEN] . 66
6.4.9 Assessment criteria for [CRY-PW-PRE-COM] . 67
6.4.10 Assessment criteria for [CRY-PW-GEN-COM] . 67
6.4.11 Assessment criteria for [CRY-PW-USR-COM]. 68
6.5 Security updates . 70
6.5.1 Assessment criteria for [SU-SUPPORT]. 70
6.5.2 Assessment criteria for [SU-PROVIDE] . 71
6.5.3 Assessment criteria for [SU-AUTO] . 72
6.5.4 Assessment criteria for [SU-DISABLE-AUTO] . 73
6.5.5 Assessment criteria for [SU-POSTPONE-AUTO]. 74
6.5.6 Assessment criteria for [SU-NOTIF] . 75
6.6 Authentication and access control . 77
6.6.1 Assessment criteria for [ACM-FH] . 77
6.6.2 Assessment criteria for [AUM-FH] . 78
6.6.3 Assessment criteria for [AUTHZ-LP] . 79
6.6.4 Assessment criteria for [AUTHZ-R] . 80
6.7 Confidentiality protection . 81
ETSI
6 Draft ETSI EN 304 631 V1.0.0 (2026-07)
6.7.1 Assessment criteria for [CONF-SSM] . 81
6.7.2 Assessment criteria for [CONF-COM] . 82
6.7.3 Assessment criteria for [CONF-MON-HW] . 83
6.7.4 Assessment criteria for [CONF-MON-UI] . 84
6.7.5 Assessment criteria for [CONF-MON-API] . 85
6.7.6 Assessment criteria for [CONF-CAPT-MUTE] . 87
6.7.7 Assessment criteria for [CONF-CAPT-MUTE-DISABLE] . 88
6.8 Integrity protection . 89
6.8.1 Assessment criteria for [INT-SSM] . 89
6.8.2 Assessment criteria for [INT-COM] . 90
6.8.3 Assessment criteria for [INT-SWPCK] . 91
6.9 Data minimisation . 93
6.9.1 Assessment criteria for [DMIN-DJST] . 93
6.9.2 Assessment criteria for [DMIN-USERINFO] . 93
6.9.3 Assessment criteria for [DMIN-LOCAL] . 94
6.10 Availability protection . 96
6.10.1 Assessment criteria for [AVAI-TIME-RECO-POW] . 96
6.10.2 Assessment criteria for [AVAI-TIME-NETW] . 97
6.10.3 Assessment criteria for [AVAI-TIME-RECO-NETW] . 99
6.10.4 Assessment criteria for [AVAI-TIME-OUTA-NOT] . 100
6.10.5 Assessment criteria for [AVAI-TIME-PREV-NOT] . 102
6.10.6 Assessment criteria for [AVAI-TIME-NET-PRIO] . 103
6.10.7 Assessment criteria for [AVAI-TIME-RES-PRIO] . 104
6.10.8 Assessment criteria for [AVAI-TIME-DOS-RATE] . 106
6.10.9 Assessment criteria for [AVAI-SUM-SCHEDULE] . 107
6.11 Non-interference . 108
6.11.1 Assessment criteria for [NOINF-AMP] . 108
6.12 Attack surface minimisation . 109
6.12.1 Assessment criteria for [LAS-INVAL] . 109
6.12.2 Assessment criteria for [LAS-INSAN] . 110
6.12.3 Assessment criteria for [LAS-PHY-INF] . 111
6.12.4 Assessment criteria for [LAS-LOGIC-INF] . 112
6.12.5 Assessment criteria for [LAS-APP] . 113
6.12.6 Assessment criteria for [LAS-SBOOT]. 114
6.13 Exploit mitigation . 115
6.13.1 Assessment criteria for [PRIV-DATA-HIGH] . 115
6.13.2 Assessment criteria for [PRIV-FUNC-HIGH] . 116
6.14 Monitoring . 117
6.14.1 Assessment criteria for [MON-LOW] . 117
6.14.2 Assessment criteria for [MON-MEDIUM] . 118
6.14.3 Assessment criteria for [MON-HIGH] . 119
6.14.4 Assessment criteria for [MON-HANDLE] . 120
6.14.5 Assessment criteria for [LOG-TIME] . 121
6.14.6 Assessment criteria for [LOG-TIME-HIGH] . 122
6.14.7 Assessment criteria for [LOG-STORE-MEDIUM] . 123
6.14.8 Assessment criteria for [LOG-STORE-HIGH] . 124
6.14.9 Assessment criteria for [LOG-CONFIG] . 125
6.14.10 Assessment criteria for [LOG-USER-ACC] . 126
6.15 Factory reset and data portability . 127
6.15.1 Assessment criteria for [DLM-PERM] . 127
Annex A (informative): Relationship between the present document and the essential
cybersecurity requirements of EU Regulation (EU) 2024/2847 . 130
Annex B (informative): Security analysis. 135
B.1 General . 135
B.2 Assets . 135
B.3 Risk factors . 135
B.4 Assumptions . 135
ETSI
7 Draft ETSI EN 304 631 V1.0.0 (2026-07)
B.5 Threats . 136
B.6 Relationship between the present document and the covered/not covered cybersecurity risks . 137
B.7 Guidance for determining impact classes . 141
B.7.1 General . 141
B.7.2 Confidential data . 141
B.7.3 Loss sensitive data . 141
B.7.4 Time sensitive function . 142
B.7.5 Integrity relevant data and integrity relevant function . 142
Annex C: Void . 144
Annex D (normative): Relationship between specific data and functions assets covered by
the present document to impact classes for generic asset categories . 145
D.1 Data assets . 145
D.2 Function assets . 146
Annex E (normative): Protection measures . 148
E.1 Authentication mechanism strength . 148
E.1.1 [AUM-FH] Authentication for functions whose use can cause harm . 148
E.1.1.1 General . 148
E.1.1.2 [AUM-E-I-Basic] AUTH.Basic inherence based SFA . 148
E.1.1.3 [AUM-E-K-Basic] AUTH.Basic knowledge based SFA . 148
E.1.1.4 [AUM-E-I-Normal] AUTH.Normal inherence based SFA . 148
E.1.1.5 [AUM-E-K-Normal] AUTH.Normal knowledge based SFA . 148
E.1.1.6 [AUM-E-P-Normal] AUTH.Normal possession based SFA . 148
E.1.1.7 [AUM-E-MFA-Normal] AUTH.Normal MFA . 149
E.1.1.8 [AUM-E-I-Enhanced] AUTH.Enhanced inherence based SFA . 149
E.1.1.9 [AUM-E-K-Enhanced] AUTH.Enhanced knowledge based SFA . 149
E.1.1.10 [AUM-E-P-Enhanced] AUTH.Enhanced possession based SFA . 149
E.1.1.11 [AUM-E-MFA-Enhanced] AUTH.Enhanced MFA . 149
E.1.1.12 [AUM-E-I-Strong] AUTH.Strong inherence based SFA . 150
E.1.1.13 [AUM-E-P-Strong] AUTH.Strong possession based SFA . 150
E.1.1.14 [AUM-E-MFA-Strong] AUTH.Strong MFA . 150
E.1.1.15 [AUM-E-Replay] AUTH.Normal, AUTH.Enhanced and AUTH.Strong replay protection . 150
E.1.1.16 [AUM-E-PitM] AUTH.Normal, AUTH.Enhanced and AUTH.Strong person in the middle
protection . 151
E.1.2 Assessment for [AUM-FH] authentication mechanism strength . 151
E.1.2.1 General . 151
E.1.2.2 Assessment criteria for [AUM-E-I-Basic] . 151
E.1.2.3 Assessment criteria for [AUM-E-K-Basic] . 152
E.1.2.4 Assessment criteria for [AUM-E-I-Normal] . 153
E.1.2.5 Assessment criteria for [AUM-E-K-Normal] . 154
E.1.2.6 Assessment criteria for [AUM-E-P-Normal] . 154
E.1.2.7 Assessment criteria for [AUM-E-MFA-Normal] . 156
E.1.2.8 Assessment criteria for [AUM-E-I-Enhanced] . 157
E.1.2.9 Assessment criteria for [AUM-E-K-Enha
...