Several SFRs may be able to be combined with other SFRs that describe similar behavior or recast as Part 2 SFRs to follow ACE_ECD.1 guidance to use existing components where possible instead of defining extended ones. Specifically:
-
FDP_SEL_EXT.1 describes how the TSF will handle complex objects, embedded objects, and graphic images. FDP_DID_EXT.1.3 describes how the TSF will handle graphic images where the visible representation of the image is different from that stored in the file format. This is technically a subset of "graphic images" defined in FDP_SEL_EXT.1. It seems as if FDP_SEL_EXT.1 could be rolled into FDP_DID_EXT.1 where "complex objects, embedded objects, and graphic images" are additional data types that the TSF must identify according to the SFR.
-
FDP_RIP_EXT.1 could be written as a refinement of Part 2 FDP_RIP.1.
-
FAU_ALR_EXT.1 could potentially be written as a refinement of Part 2 FAU_ARP.1 (though possibly not if the TSF behavior being reported upon isn't technically an auditable even per FAU_GEN.1 - and if it was changed to FAU_ARP.1 we would need FAU_SAA.1 or justify the missing dependency).
-
FAU_REP_EXT.1 could potentially be written as a refinement of Part 2 FAU_GEN.1 (though possibly not since it does not currently cover "startup and shutdown of the audit function" which FAU_GEN.1.1 requires).
-
FAU_SAR_EXT.1 could potentially be written as a refinement of Part 2 FAU_SAR.1 (though possibly not if we are not sayin gthe generated reports count as "audit records" as defined by FAU_GEN.1).
Several SFRs may be able to be combined with other SFRs that describe similar behavior or recast as Part 2 SFRs to follow ACE_ECD.1 guidance to use existing components where possible instead of defining extended ones. Specifically:
FDP_SEL_EXT.1 describes how the TSF will handle complex objects, embedded objects, and graphic images. FDP_DID_EXT.1.3 describes how the TSF will handle graphic images where the visible representation of the image is different from that stored in the file format. This is technically a subset of "graphic images" defined in FDP_SEL_EXT.1. It seems as if FDP_SEL_EXT.1 could be rolled into FDP_DID_EXT.1 where "complex objects, embedded objects, and graphic images" are additional data types that the TSF must identify according to the SFR.
FDP_RIP_EXT.1 could be written as a refinement of Part 2 FDP_RIP.1.
FAU_ALR_EXT.1 could potentially be written as a refinement of Part 2 FAU_ARP.1 (though possibly not if the TSF behavior being reported upon isn't technically an auditable even per FAU_GEN.1 - and if it was changed to FAU_ARP.1 we would need FAU_SAA.1 or justify the missing dependency).
FAU_REP_EXT.1 could potentially be written as a refinement of Part 2 FAU_GEN.1 (though possibly not since it does not currently cover "startup and shutdown of the audit function" which FAU_GEN.1.1 requires).
FAU_SAR_EXT.1 could potentially be written as a refinement of Part 2 FAU_SAR.1 (though possibly not if we are not sayin gthe generated reports count as "audit records" as defined by FAU_GEN.1).