4  SEPP-specific security requirements and related test cases  Word‑p. 7

4.1  Introduction

4.2  SEPP-specific adaptations of security functional requirements and related test cases

4.2.1  Introduction

4.2.2  Security functional requirements on the SEPP deriving from 3GPP specifications and related test cases

4.2.2.1  Security functional requirements on the SEPP deriving from 3GPP specifications - general approach

4.2.2.2  Correct handling of cryptographic material of peer SEPPs and IPX providers

4.2.2.3  Connection-specific scope of cryptographic material by IPX-providers  Word‑p. 8

4.2.2.4  Correct handling of serving PLMN ID mismatch  Word‑p. 10

4.2.2.5  Replacing confidential IEs with NULL in original N32-f message

4.2.2.6  Correct handling of protection policy mismatch  Word‑p. 11

4.2.2.7  JWS profile restriction  Word‑p. 12

4.2.2.8  No misplacement of encrypted IEs in JSON object by IPX  Word‑p. 13

4.2.3  Technical Baseline  Word‑p. 15

4.2.3.1  Introduction

4.2.3.2  Protecting data and information

4.2.3.2.1  Protecting data and information - general

4.2.3.2.2  Protecting data and information - unauthorized viewing

4.2.3.2.3  Protecting data and information in storage

4.2.3.2.4  Protecting data and information in transfer

4.2.3.2.5  Logging access to personal data

4.2.3.3  Protecting availability and integrity

4.2.3.4  Authentication and authorization

4.2.3.5  Protecting sessions

4.2.3.6  Logging

4.2.4  Operating Systems

4.2.5  Web Servers

4.2.6  Network Devices

4.3  SEPP-specific adaptations of hardening requirements and related test cases  Word‑p. 16

4.3.1  Introduction

4.3.2  Technical baseline

4.3.3  Operating systems

4.3.4  Web servers

4.3.5  Network devices

4.3.6  Network functions in service-based architecture

4.4  SEPP-specific adaptations of basic vulnerability testing requirements and related test cases

$  Change History  Word‑p. 17

---