NL-CS-WSCA conditions requirements

This page lists every requirement of NL-CS-WSCA conditions (Conditions for the Underlying Platform Supporting AVA_VAN.5 Evaluation, version RC1.1) as published on 6 November 2026. The PDF is authoritative: each requirement links to the page it is on. You can also read the full text or search all requirements.

110 entries: 6 conditions, 13 security principles, 91 platform requirements. Obligation: 110 mandatory.

Legal basis of the document: CIR 2024/2981.

2 Security requirements Operational Environment

Read section 2 in the full text

ENV-DEDICATED_PLATFROM

The WSCA operates on a dedicated underlying hardened platform and hardware that forms part of its trusted operational environment. This platform is responsible for providing the security mechanisms necessary to protect the WSCA against unauthorised access, modification, interference and exploitation (see detailed requirements in section 5). No applications, services, workloads or processing functions unrelated to the WSCA shall be installed or operated on the hardened platforms and on top dedicated hardware. Consequently, deployment of the WSCA as a shared cloud application is not permitted.

Condition · obligation: mandatory · PDF page 8

ENV-TRUSTED-ADMIN

Administrators are appropriately trained, follow established policies and guidance, and are trusted to act without malicious intent. They ensure that passwords and credentials have sufficient strength and entropy. The platform enforces dual control for administrative tasks to prevent a single administrator from performing sensitive or potentially malicious actions alone.

Condition · obligation: mandatory · PDF page 9

ENV-GATEWAY

The WSCA platform shall not be directly exposed to the Internet. External communication is mediated through a gateway platform positioned between the WSCA platform and the Internet. This provides an additional security boundary for network communication and reduces the direct exposure of the WSCA execution environment. The gateway implements at least DDoS protection, intrusion detection, antivirus functionality and firewall functionality.

Condition · obligation: mandatory · PDF page 9

ENV-DATABASE

The WSCD and security-relevant databases supporting the WSCA shall be located within the same protected operational environment as the WSCA platform and shall not be directly accessible from untrusted networks.

Condition · obligation: mandatory · PDF page 9

ENV-WSCD-CHANNEL

Communication channels between the WSCA and the WSCD and the WSCA the gateway platform shall be authenticated and encrypted. The communication mechanism shall protect the confidentiality and integrity of all exchanged security-relevant data and cryptographic commands, and shall prevent unauthorised interception, modification, replay, or impersonation of communicating parties. The communication channel between the WSCA and the WSCD shall use a dedicated physical connection, isolated from all other computer systems.

Condition · obligation: mandatory · PDF page 9

ENV-ENVIRONMENT

The TOE and its underlying platform shall be located in a physically secured environment that protects against unauthorised physical access, tampering, theft, and physical interference. Access shall be restricted to authorised personnel through appropriate physical access controls. Physical security measures shall protect the WSCA, WSCD the databases and the gateway against attacks that could compromise their integrity, confidentiality, or availability, including attacks within the scope of the AVA_VAN.5 vulnerability assessment.

Condition · obligation: mandatory · PDF page 9

4 Security Principles for the Underlying Platform

Read section 4 in the full text

01 — Minimal Configuration

The underlying platform shall be configured with only those operating system components, services, drivers, interfaces and functions that are required for the secure operation of the WSCA. Unnecessary functionality shall be disabled or removed.

Security principle · obligation: mandatory · PDF page 12

02 — Limited Execution

The underlying platform shall restrict execution to authorised software, processes and services required for the operation of the WSCA. Execution of unauthorised software shall be prevented.

Security principle · obligation: mandatory · PDF page 12

03 — Least Privilege

The underlying platform shall ensure that the WSCA and its supporting processes operate with only the privileges necessary to perform their specified functions.

Security principle · obligation: mandatory · PDF page 12

04 — Process Isolation

The underlying platform shall provide isolation between the WSCA and other processes such that an unauthorised process cannot access, modify or interfere with the WSCA or its security-relevant data.

Security principle · obligation: mandatory · PDF page 12

05 — Memory Protection

The underlying platform shall protect memory allocated to the WSCA against unauthorised reading, modification and execution by other processes or users.

Security principle · obligation: mandatory · PDF page 12

06 — Controlled Interfaces

The underlying platform shall restrict access to system interfaces, devices, files, inter-process communication mechanisms and other resources to those required for the operation of the WSCA.

Security principle · obligation: mandatory · PDF page 12

07 — Platform Integrity

The underlying platform shall provide mechanisms to prevent or detect unauthorised modification of platform components that could affect the security of the WSCA.

Security principle · obligation: mandatory · PDF page 12

08 — Network Protection

The underlying platform shall expose only the network services, protocols and ports required for the operation of the WSCA. Direct network access from the WSCA to untrusted networks shall be prevented where it is not required for the WSCA's specified operation.

Security principle · obligation: mandatory · PDF page 12

09 — WSCA Data Protection

The underlying platform shall protect WSCA security-relevant data, including configuration data, credentials and other sensitive information, against unauthorised disclosure, modification or deletion.

Security principle · obligation: mandatory · PDF page 12

10 — Privilege Escalation Protection

The underlying platform shall prevent a process or user operating with limited privileges from obtaining privileges that could be used to compromise or interfere with the WSCA.

Security principle · obligation: mandatory · PDF page 12

11 — Security-Relevant Logging

The underlying platform shall provide logging of security-relevant events necessary to support the detection and investigation of events that could affect the security of the WSCA.

Security principle · obligation: mandatory · PDF page 12

12 — Vulnerability Management

The underlying platform shall be maintained using a defined vulnerability and security-update management process to ensure that known vulnerabilities that could affect the WSCA are assessed and appropriately remediated.

Security principle · obligation: mandatory · PDF page 13

13 — Cyber Security Monitoring

The underlying platform shall be continuously monitored for security-relevant events, anomalous behaviour, and indicators of compromise that could affect the security of the WSCA. Detected events shall be analysed and, where necessary, trigger appropriate alerts and incident response measures.

Security principle · obligation: mandatory · PDF page 13

5.1 Hardware Requirements

Read section 5.1 in the full text

HW-01

The host system shall be configured with only the hardware components required for the operation of the WSCA platform. Unnecessary hardware devices and interfaces shall be disabled or removed where technically possible.

Platform requirement · obligation: mandatory · PDF page 14

Security principle: Minimal Configuration

HW-02

The hardware shall support the platform's mechanisms for restricting execution to authorised platform and WSCA software. Hardware mechanisms that could allow unauthorised code execution or bypass platform controls shall be disabled or appropriately controlled.

Platform requirement · obligation: mandatory · PDF page 14

Security principle: Limited Execution

HW-03

Hardware resources and privileged hardware functions shall only be accessible through authorised platform mechanisms and to components requiring such access for their specified functions.

Platform requirement · obligation: mandatory · PDF page 14

Security principle: Least Privilege

HW-04

The host hardware shall provide, where supported, hardware-assisted mechanisms for isolating processes and execution environments, including processor privilege levels and virtual memory protection.

Platform requirement · obligation: mandatory · PDF page 14

Security principle: Process Isolation

HW-05

The processor and memory subsystem shall support hardware-assisted memory protection mechanisms. These mechanisms shall be enabled and configured to prevent unauthorised access to memory allocated to the WSCA.

Platform requirement · obligation: mandatory · PDF page 14

Security principle: Memory Protection

HW-06

Physical interfaces and peripheral devices shall be limited to those required for the operation and administration of the WSCA platform. Unnecessary interfaces, such as unused USB, storage or peripheral interfaces, shall be disabled or physically restricted where possible.

Platform requirement · obligation: mandatory · PDF page 14

Security principle: Controlled Interfaces

HW-07

Where supported by the hardware, mechanisms such as a hardware root of trust, Trusted Platform Module (TPM), measured boot or Secure Boot shall be used to support verification of the integrity of the platform during system initialisation.

Platform requirement · obligation: mandatory · PDF page 14

Security principle: Platform Integrity

HW-08

Network interfaces shall be limited to those required for WSCA operation and platform administration. Unused network interfaces shall be disabled, and the hardware configuration shall not provide an uncontrolled path to untrusted networks.

Platform requirement · obligation: mandatory · PDF page 15

Security principle: Network Protection

HW-09

Hardware resources used to store or process WSCA security-relevant data shall be protected against unauthorised physical and logical access. Where hardware security mechanisms are available, they shall be used where required to protect sensitive data.

Platform requirement · obligation: mandatory · PDF page 15

Security principle: WSCA Data Protection

HW-10

The hardware shall support processor and platform security mechanisms that prevent lower-privileged software from directly accessing privileged hardware resources or bypassing the access-control mechanisms of the underlying platform.

Platform requirement · obligation: mandatory · PDF page 15

Security principle: Privilege Escalation Protection

HW-11

Where hardware security events are relevant to the security of the WSCA, the platform shall provide mechanisms to capture or expose such events to the platform logging and monitoring functions.

Platform requirement · obligation: mandatory · PDF page 15

Security principle: Security-Relevant Logging

HW-12

The hardware platform, including firmware and microcode, shall be subject to a defined vulnerability-management process. Security updates addressing vulnerabilities that could affect the WSCA shall be assessed and applied in accordance with the applicable security-update policy.

Platform requirement · obligation: mandatory · PDF page 15

Security principle: Vulnerability Management

HW-13

The hardware platform shall support the collection and reporting of security-relevant hardware events, where technically available, including hardware faults, integrity violations, and indicators of unauthorised physical or logical access. Such events shall be made available to the platform's security monitoring mechanisms for analysis and, where necessary, trigger appropriate alerts.

Platform requirement · obligation: mandatory · PDF page 15

Security principle: Cyber Security Monitoring

5.2 Boot and Initialisation Layer Requirements

Read section 5.2 in the full text

BOOT-01

The boot and initialisation environment shall be configured with only the firmware, boot components and configuration required to initialise the platform and start the authorised operating system. Unnecessary boot functionality shall be disabled where technically possible.

Platform requirement · obligation: mandatory · PDF page 15

Security principle: Minimal Configuration

BOOT-02

The boot process shall permit execution only of authorised firmware, bootloader components and operating system components. Unauthorised code shall not be permitted to execute during platform initialisation.

Platform requirement · obligation: mandatory · PDF page 15

Security principle: Limited Execution

BOOT-03

Boot and initialisation components shall operate with only the privileges and access to hardware resources necessary to perform platform initialisation and start the authorised operating system.

Platform requirement · obligation: mandatory · PDF page 15

Security principle: Least Privilege

BOOT-04

The boot environment shall prevent unauthorised or untrusted components from gaining access to or interfering with security-relevant boot processes and initialisation components.

Platform requirement · obligation: mandatory · PDF page 15

Security principle: Process Isolation

BOOT-05

The boot environment shall use available hardware and firmware mechanisms to protect memory used during initialisation against unauthorised access or modification.

Platform requirement · obligation: mandatory · PDF page 16

Security principle: Memory Protection

BOOT-06

Access to firmware configuration, boot interfaces and hardware configuration functions shall be restricted to authorised personnel or authorised management mechanisms. Unnecessary boot interfaces shall be disabled or otherwise restricted.

Platform requirement · obligation: mandatory · PDF page 16

Security principle: Controlled Interfaces

BOOT-07

The boot process shall provide mechanisms to verify the authenticity and/or integrity of firmware, bootloader and operating system components before they are executed. Where supported, Secure Boot, measured boot or equivalent integrity mechanisms shall be enabled and appropriately configured.

Platform requirement · obligation: mandatory · PDF page 16

Security principle: Platform Integrity

BOOT-08

Network functionality during the boot and initialisation process shall be disabled unless required for a defined platform function. Where network boot or other pre-OS network functionality is required, it shall be restricted to authorised sources and protected against unauthorised modification or execution.

Platform requirement · obligation: mandatory · PDF page 16

Security principle: Network Protection

BOOT-09

The boot and initialisation process shall not expose or provide unauthorised access to WSCA security-relevant data stored on the platform. Access to storage containing WSCA data during boot shall be restricted to authorised platform components.

Platform requirement · obligation: mandatory · PDF page 16

Security principle: WSCA Data Protection

BOOT-10

The boot and initialisation mechanisms shall prevent lower-trust or unauthorised components from obtaining privileged execution through manipulation of the boot process, boot configuration or firmware interfaces.

Platform requirement · obligation: mandatory · PDF page 16

Security principle: Privilege Escalation Protection

BOOT-11

Where supported, security-relevant boot and integrity events, including failed integrity checks and unauthorised boot attempts, shall be recorded and made available to the platform's security monitoring mechanisms.

Platform requirement · obligation: mandatory · PDF page 16

Security principle: Security-Relevant Logging

BOOT-12

Firmware, bootloader and other boot components shall be subject to a defined vulnerability-management process. Security vulnerabilities affecting the integrity or security of the WSCA platform shall be assessed and appropriately remediated.

Platform requirement · obligation: mandatory · PDF page 16

Security principle: Vulnerability Management

BOOT-13

The boot and initialisation process shall support the detection of security-relevant anomalies, including unexpected boot configurations, failed integrity verification, and unauthorised changes to boot components. Detected events shall be reported to the platform's security monitoring mechanisms to enable timely investigation and response.

Platform requirement · obligation: mandatory · PDF page 16

Security principle: Cyber Security Monitoring

5.3 Operating System Kernel Requirements

Read section 5.3 in the full text

KERN-01

The kernel shall be configured with only the functionality, drivers, modules and interfaces required for the secure operation of the WSCA platform. Unnecessary kernel functionality shall be disabled or removed where technically possible.

Platform requirement · obligation: mandatory · PDF page 16

Security principle: Minimal Configuration

KERN-02

The kernel shall prevent unauthorised kernel modules, drivers or other privileged code from being loaded or executed. Only authorised and trusted kernel components shall be permitted.

Platform requirement · obligation: mandatory · PDF page 17

Security principle: Limited Execution

KERN-03

The kernel shall provide mechanisms to enforce separation between privileged and non-privileged execution and shall ensure that the WSCA operates with only the privileges required for its specified functions.

Platform requirement · obligation: mandatory · PDF page 17

Security principle: Least Privilege

KERN-04

The kernel shall provide process isolation mechanisms that prevent one process from accessing, modifying or interfering with another process unless explicitly authorised.

Platform requirement · obligation: mandatory · PDF page 17

Security principle: Process Isolation

KERN-05

The kernel shall enforce memory isolation and shall prevent unauthorised processes from reading, modifying or executing memory allocated to the WSCA. Hardware-assisted memory protection mechanisms shall be enabled where available.

Platform requirement · obligation: mandatory · PDF page 17

Security principle: Memory Protection

KERN-06

Access to kernel interfaces, system calls, devices, IPC mechanisms and other kernel-managed resources shall be restricted according to the privileges and functions of the requesting process.

Platform requirement · obligation: mandatory · PDF page 17

Security principle: Controlled Interfaces

KERN-07

The kernel shall provide mechanisms to protect the integrity of its own code, security configuration and security-relevant data during operation.

Platform requirement · obligation: mandatory · PDF page 17

Security principle: Platform Integrity

KERN-08

The kernel network stack shall be configured to expose only the network functionality required by the WSCA environment. Unnecessary network protocols, interfaces and services shall be disabled.

Platform requirement · obligation: mandatory · PDF page 17

Security principle: Network Protection

KERN-09

The kernel shall enforce access controls preventing unauthorised processes or users from accessing WSCA security-relevant files, memory, devices and other resources.

Platform requirement · obligation: mandatory · PDF page 17

Security principle: WSCA Data Protection

KERN-10

The kernel shall provide mechanisms to prevent processes operating with limited privileges from obtaining unauthorised higher privileges or bypassing kernel access-control mechanisms.

Platform requirement · obligation: mandatory · PDF page 17

Security principle: Privilege Escalation Protection

KERN-11

The kernel shall provide logging or security event mechanisms for security-relevant events that could indicate an attempt to bypass kernel security controls or compromise the WSCA.

Platform requirement · obligation: mandatory · PDF page 17

Security principle: Security-Relevant Logging

KERN-12

The kernel and its security-relevant modules and drivers shall be subject to vulnerability management. Known vulnerabilities that could affect the WSCA shall be assessed and appropriately remediated.

Platform requirement · obligation: mandatory · PDF page 17

Security principle: Vulnerability Management

KERN-13

The operating system kernel shall support the detection and reporting of security-relevant anomalies, including unauthorised privilege escalation, unexpected kernel module loading, violations of access controls, and attempts to exploit kernel vulnerabilities. Detected events shall be made available to the platform's security monitoring mechanisms for analysis and incident response.

Platform requirement · obligation: mandatory · PDF page 17

Security principle: Cyber Security Monitoring

5.4 Operating System / System Services Requirements

Read section 5.4 in the full text

OS-01

Only operating system services required for the secure operation, administration and maintenance of the WSCA shall be installed and enabled.

Platform requirement · obligation: mandatory · PDF page 18

Security principle: Minimal Configuration

OS-02

System services shall execute only authorised binaries and components. Unauthorised modification or replacement of service executables shall be prevented or detected.

Platform requirement · obligation: mandatory · PDF page 18

Security principle: Limited Execution

OS-03

Each system service required by the WSCA shall operate using the minimum privileges and system resources necessary for its function.

Platform requirement · obligation: mandatory · PDF page 18

Security principle: Least Privilege

OS-04

System services shall be isolated from the WSCA and from each other to the extent necessary to prevent compromise of one service from directly compromising the WSCA.

Platform requirement · obligation: mandatory · PDF page 18

Security principle: Process Isolation

OS-05

System services shall operate using the platform's available memory protection mechanisms so that they cannot access or modify WSCA memory without authorisation.

Platform requirement · obligation: mandatory · PDF page 18

Security principle: Memory Protection

OS-06

Access to system services shall be restricted to authorised users, processes and network endpoints. Unused service interfaces shall be disabled.

Platform requirement · obligation: mandatory · PDF page 18

Security principle: Controlled Interfaces

OS-07 — System service configuration and security policies shall be protected against unauthorised modification.

System service configuration and security policies shall be protected against unauthorised modification.

Platform requirement · obligation: mandatory · PDF page 18

Security principle: Platform Integrity

OS-08

Network-facing services shall be limited to those required by the WSCA environment. Services that are not required shall be disabled and their associated ports shall not be exposed.

Platform requirement · obligation: mandatory · PDF page 18

Security principle: Network Protection

OS-09

System services shall not provide unauthorised access to WSCA files, configuration, credentials or other security-relevant data.

Platform requirement · obligation: mandatory · PDF page 18

Security principle: WSCA Data Protection

OS-10

System services shall be configured to prevent their interfaces or vulnerabilities from being used to obtain privileges that could compromise the WSCA.

Platform requirement · obligation: mandatory · PDF page 18

Security principle: Privilege Escalation Protection

OS-11

Security-relevant events generated by system services shall be logged where required to detect or investigate activity that could affect WSCA security.

Platform requirement · obligation: mandatory · PDF page 18

Security principle: Security-Relevant Logging

OS-12

System services and associated components shall be regularly assessed for vulnerabilities and security updates shall be applied where required.

Platform requirement · obligation: mandatory · PDF page 18

Security principle: Vulnerability Management

OS-13

The operating system shall continuously monitor system services for security-relevant anomalies, including unexpected service behaviour, unauthorised configuration changes, suspicious process activity, and indicators of compromise. Detected events shall be reported to the platform's security monitoring mechanisms for analysis, alerting, and incident response.

Platform requirement · obligation: mandatory · PDF page 18

Security principle: Cyber Security Monitoring

5.5 Application Space Requirements

Read section 5.5 in the full text

APP-01

Only applications and utilities required for the operation, administration and maintenance of the WSCA environment shall be installed.

Platform requirement · obligation: mandatory · PDF page 18

Security principle: Minimal Configuration

APP-02

Execution of applications, scripts and utilities shall be restricted to authorised software. Application allow-listing or equivalent controls shall be applied where technically feasible.