ETSI EN 303 645 Working Matrix
Status: DRAFT
| Principle | Current implementation | Gap / evidence | Status |
|---|---|---|---|
| No universal default passwords | production status must be verified | remove any shared default credentials | VERIFY |
| Vulnerability disclosure policy | not documented | create security contact/security.txt | TODO |
| Keep software updated | image/update mechanism exists/planned | signed OTA, support policy, rollback tests | PARTIAL |
| Securely store sensitive security parameters | credentials stored on device | verify permissions; consider secure element | PARTIAL |
| Communicate securely | VPN + NATS | document protocols/configuration | PARTIAL |
| Minimize exposed attack surface | outbound architecture | port scan per release | VERIFY |
| Ensure software integrity | TODO | signed update verification | TODO |
| Protect personal data | backend account/e-mail association | data-flow/privacy review | TODO |
| Make systems resilient to outages | local supervisor | offline/fail-safe tests | PARTIAL |
| Examine telemetry data | telemetry path exists | define integrity/anomaly controls as applicable | TODO |
| Easy deletion of user data | backend-dependent | define account/device unlink/delete process | TODO |
| Easy installation and maintenance | golden image/provisioning | installer/security guide | PARTIAL |
| Validate input data | supervisor should validate commands | add schema/range/Modbus tests | VERIFY |