baseline-data.json

{
    "baseLines": [
        {
            "baselineOrg": "NIST",
            "baselineName": "8529A",
	    "baselineURL":"https://nvlpubs.nist.gov/nistpubs/ir/2020/NIST.IR.8259.pdf",
	    "baselineGraph":"False",
            "baselineCategories": [
                {
                    "categoryName": "Device Identification",
                    "categoryNumber": "1",
                    "subCategories": [
                        {
                            "ocfMatchSpecification": "OCF Security Specification 2.1.2",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification_v2.1.2.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "7.1.1",
                                    "ocfMatchNotes": "Device IDs shall be unique within the scope of operation of the corresponding OCF Security Domain, and should be universally unique.",
                                    "ocfMatchFlag":"Yes"
                                }
                            ],
                            "subCategoryDescription": "A unique logical identifier",
                            "subCategoryName": "1",
                            "subCategoryNumber": "1"
                        },
                        {
                            "subCategoryDescription": "A unique physical identifier at an external or internal location on the device authorized entities can access",
                            "subCategoryName": "2",
                            "subCategoryNumber": "2",
                            "ocfMatchSpecification": "",
                            "ocfMatchSpecificationURL": "",
                            "ocfMatches": [
				    {
                                    "ocfMatchClause": "None",
                                    "ocfMatchNotes": "Physical Identifiers are out of scope of the OCF specification.",
                                    "ocfMatchFlag":"Not Applicable"
				    }
			    ]
                        }
                    ]
                },
                {
                    "categoryName": "Device Configuration",
                    "categoryNumber": "2",
                    "subCategories": [
                        {
                            "subCategoryDescription": "The ability to change the device\u2019s software and firmware configuration settings",
                            "subCategoryNumber": "1",
                            "ocfMatchSpecification": "OCF Security Specification 2.1.2",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification_v2.1.2.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "5.3.3",
                                    "ocfMatchNotes": "Prior to operational state, device must be onboarded and configured with either symmetric or asymmetric credentials based on certificates or shared keys  Once operational devices, implement role-based and/or subject based access control for each resource they present to the network.",
                                    "ocfMatchFlag":"Yes"

                                }
                            ]
                        },
                        {
                            "subCategoryDescription": "The ability to restrict configuration changes to authorized entities only",
                            "subCategoryNumber": "2",
                            "ocfMatchSpecification": "OCF Security Specification 2.1.2",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification_v2.1.2.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "12",
                                    "ocfMatchNotes":"Access control is enforced over all Resources.",
                                    "ocfMatchFlag":"Yes"

				},
				{
                                    "ocfMatchClause": "13.3.1",
                                    "ocfMatchNotes": "Stored Credentials used to authenticate server to clients.",
                                    "ocfMatchFlag":"Yes"
                                }
                            ]
                        },
                        {
                            "subCategoryDescription": "The ability for authorized entities to restore the device to a secure default configuration defined by an authorized entity",
                            "subCategoryNumber": "3",
                            "ocfMatchSpecification": "OCF Security Specification 2.1.2",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification_v2.1.2.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "8.2",
                                    "ocfMatchNotes": "Describes the Resources and properties that are restored to manufacturer settings.",
                                    "ocfMatchFlag":"Yes"

                                }
                            ]
                        }
                    ]
                },
                {
                    "categoryName": "Data Protection",
                    "categoryNumber": "3",
                    "subCategories": [
                        {
                            "subCategoryDescription": "The ability to use accepted cryptographic algorithms (e.g., encryption with authentication, cryptographic hashes, digital signature validation) to prevent the confidentiality and integrity of the device\u2019s stored and transmitted data from being compromised",
                            "subCategoryNumber": "1",
                            "ocfMatchSpecification": "OCF Security Specification 2.1.2",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification_v2.1.2.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "11.2.1",
                                    "ocfMatchNotes": " Devices must support TLS/DTLS version 1.2 or greater for all unicast sessions.",
                                    "ocfMatchFlag":"Yes"
                                },
                                {
                                    "ocfMatchClause": "11.3",
                                    "ocfMatchNotes": "Cipher Suites: All heavily reviewed and IETF approved or greater.",
                                    "ocfMatchFlag":"Yes"
                                },
                                {
                                    "ocfMatchClause": "14.2.2",
                                    "ocfMatchNotes": "Secure storage for credentials is strongly recommended.",
                                    "ocfMatchFlag":"Yes"
                                }
                            ]
                        },
                        {
                            "subCategoryDescription": "The ability for authorized entities to configure the cryptography use itself when applicable, such as choosing a key length",
                            "subCategoryNumber": "2",
                            "ocfMatchSpecification": "",
                            "ocfMatchSpecificationURL": "",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "5.4.3",
                                  "ocfMatchNotes": "Credentials are proactively monitored and can be updated.",
                                    "ocfMatchFlag":"Yes"
				},
                                {
                                  "ocfMatchClause":"5.6",
                                  "ocfMatchNotes":"Credential Overview, credentials can be pairwise symmetric keys, certificates, or raw asymmetric keys.",
                                    "ocfMatchFlag":"Yes"
                                }
                            ]
                        },
                        {
                            "subCategoryDescription": "The ability for authorized entities to render all data on the device inaccessible by all entities, whether previously authorized or not (e.g., through a wipe of internal storage, destruction of cryptographic keys for encrypted data)",
                            "subCategoryNumber": "3",
                            "ocfMatchSpecification": "OCF Security Specification 2.1.2",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification_v2.1.2.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "8.2",
                                    "ocfMatchNotes": "Describes the Resources and properties that are restored to manufacturer settings during device reset.",
                                    "ocfMatchFlag":"Yes"
                                }
                            ]
                        }
                    ]
                },
                {
                    "categoryName": "Logical Access to Interfaces",
                    "categoryNumber": "4",
                    "subCategories": [
                        {
                            "subCategoryDescription": "The ability to logically or physically disable any local and network interfaces that are not necessary for the core functionality of the device.",
                            "subCategoryNumber": "1",
                            "ocfMatchSpecification": "OCF Security Specification 2.1.2",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification_v2.1.2.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "12",
                                    "ocfMatchNotes": "Describes access control and policy management for both local and network resources.",
                                    "ocfMatchFlag":"Yes"
                                }
                            ]
                        },
                        {
                            "subCategoryDescription": "The ability to logically restrict access to each network interface (e.g., device authentication, user authentication)",
                            "subCategoryNumber": "2",
                            "ocfMatchSpecification": "OCF Security Specification 2.1.2",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification_v2.1.2.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "5",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Figure 3 shows security enforcement points"
                                },
                                {
                                    "ocfMatchClause": "12",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Describes access control and policy management for both local and network resources."
                                }
                            ]
                        },
                        {
                            "subCategoryDescription": "The ability to enable, disable, and adjust thresholds for any ability the device might have to lock or disable an account or to delay additional authentication attempts after too many failed authentication attempts. ",
                            "subCategoryNumber": "3",
                            "ocfMatchSpecification": "",
                            "ocfMatchSpecificationURL": "",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "None",
                                    "ocfMatchFlag":"Not Implemented",
                                    "ocfMatchNotes": "There is currently no provision for limiting authentication attempts"
				}
                            ]
                        }
                    ]
                },
                {
                    "categoryName": "Software and Firmware Update",
                    "categoryNumber": "5",
                    "subCategories": [
                        {
                            "subCategoryDescription": "The ability to update all the device\u2019s software and firmware through remote <e.g., network download> and/or local means (e.g., removable media)",
                            "subCategoryNumber": "1",
                            "ocfMatchSpecification": "OCF Security Specification 2.1.2",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification_v2.1.2.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "14.5",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "The aspects of the software [update] include, but are not limited to, firmware, operating system, networking stack, application code, drivers, etc."
                                }
                            ]
                        },
                        {
                            "subCategoryDescription": "The ability to confirm the validity of any update before installing it",
                            "subCategoryNumber": "2",
                            "ocfMatchSpecification": "OCF Security Specification 2.1.2",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification_v2.1.2.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "14.5.3",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": " Process where device validates the software version against a trusted source."
                                }
                            ]
                        },
                        {
                            "subCategoryDescription": "The ability to restrict updating actions to authorized entities only",
                            "subCategoryNumber": "3",
                            "ocfMatchSpecification": "OCF Security Specification 2.1.2",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification_v2.1.2.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "14.5.4",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "A client with the correct authorization can initiate a software update process by setting a software update bit to true or false.  This software update bit enables or disables the update process."
                                }
                            ]
                        },
                        {
                            "subCategoryDescription": "The ability to enable or disable updating",
                            "subCategoryNumber": "4",
                            "ocfMatchSpecification": "OCF Security Specification 2.1.2",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification_v2.1.2.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "14.5.4",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "A client with the correct authorization can initiate a software update process by setting a software update bit to true or false.  This software update bit enables or disables the update process."
                                }
                            ]
                        },
                        {
                            "subCategoryDescription": "The ability to set remote update mechanisms to be either automatically or manually initiated for update downloads and installations",
                            "subCategoryNumber": "5",
                            "ocfMatchSpecification": "OCF Security Specification 2.1.2",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification_v2.1.2.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "14.5.4",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Describes the use of a combination of software update bits that inform the device to look to a valid update."
                                }
                            ]
                        },
                        {
                            "subCategoryDescription": "The ability to enable or disable notification when an update is available and specify who or what is to be notified",
                            "subCategoryNumber": "6",
                            "ocfMatchSpecification": "",
                            "ocfMatchSpecificationURL": "",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "None",
                                    "ocfMatchFlag":"Not Implemented",
                                    "ocfMatchNotes": "Notifications for software updates not currently in OCF specification."
				}
                            ]
                        }
                    ]
                },
                {
                    "categoryName": "Cybersecurity State Awareness",
                    "categoryNumber": "6",
                    "subCategories": [
                        {
                            "subCategoryDescription": "The ability to report the device\u2019s cybersecurity state",
                            "subCategoryNumber": "1",
                            "ocfMatchSpecification": "OCF Security Specification 2.1.2",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification_v2.1.2.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "5.7",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "An OCF Platform can generate various kinds of Auditable Events. These Auditable Events can be used for log analysis or for real-time understanding of a system condition"
                                }
                            ]
                        },
                        {
                            "subCategoryDescription": "The ability to differentiate between when a device will likely operate as expected from when it may be in a degraded cybersecurity state",
                            "subCategoryNumber": "2",
                            "ocfMatchSpecification": "OCF Security Specification 2.1.2",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification_v2.1.2.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "8.6",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Device transitions to a self-recovery state SRESET if certain conditions of the device are corrupt."
                                }
                            ]
                        },
                        {
                            "subCategoryDescription": "The ability to restrict access to the state indicator so only authorized entities can view it",
                            "subCategoryNumber": "3",
                            "ocfMatchSpecification": "OCF Security Specification 2.1.2",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification_v2.1.2.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "13.16",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Definition of pstat state resource.  Pstat resource is an SVR and has protected access."
                                },
                                {
                                    "ocfMatchClause": "5.1",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Describes access control architecture and the access based on state of device."
                                },
                                {
                                    "ocfMatchClause": "13.8",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Definition of pstat state resource.  Pstat resource is an SVR and has protected access."
                                }
                            ]
                        },
                        {
                            "subCategoryDescription": "The ability to prevent any entities (authorized or unauthorized) from editing the state except for the device\u2019s monitor",
                            "subCategoryNumber": "4",
                            "ocfMatchSpecification": "OCF Security Specification 2.1.2",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification_v2.1.2.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "13.8",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Definition of pstat state resource.  Pstat resource is an SVR and has protected access."
                                }
                            ]
                        },
                        {
                            "subCategoryDescription": "The ability to make the state information available to a service on another device, such as an event/state log server",
                            "subCategoryNumber": "5",
                            "ocfMatchSpecification": "",
                            "ocfMatchSpecificationURL": "",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "None",
                                    "ocfMatchFlag":"Not Implemented",
                                    "ocfMatchNotes": "Work in Progress for remote event logging."
				}
                            ]
                        }
                    ]
                }
            ]
        },
        {
            "baselineOrg": "CTAC2",
            "baselineName": "Conveners",
	    "baselineURL":"https://securingdigitaleconomy.org/wp-content/uploads/2019/09/CSDE_IoT-C2-Consensus-Report_FINAL.pdf",
	    "baselineGraph":"True",
            "baselineCategories": [
                {
                    "categoryName": "Device Identifiers",
                    "categoryNumber": "5.1.1",
                    "subCategories": [
                        {
                            "subCategoryDescription": "A unique value associated with the endpoint <or values associated with the functional entities within the endpoint> that exists in a namespace to allow it to be referenced without ambiguity. This value is distinct and distinguishes a device from all other devices.",
                            "subCategoryNumber": "1",
                            "ocfMatchSpecification": "OCF Security Specification 2.1.2",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification_v2.1.2.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "7.1.1",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Device IDs shall be unique within the scope of operation of the corresponding OCF Security Domain, and should be universally unique."
                                }
                            ]
                        }
                    ]
                },
                {
                    "categoryName": "Secured Access",
                    "categoryNumber": "5.1.2",
                    "subCategories": [
                        {
                            "subCategoryDescription": "Protection of device operational and management capabilities by requiring user authentication to read or modify the software, firmware and configuration, including means to ensure device-unique credentials for administrative access, and by protecting access to interfaces. ",
                            "subCategoryNumber": "2",
                            "ocfMatchSpecification": "OCF Security Specification 2.1.2",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification_v2.1.2.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "5.3.3",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Prior to operational state, device must be onboarded and configured with either symmetric or asymmetric credentials based on certificates or shared keys  Once operational devices implement role-based and/or subject based access control for each resource they present to the network."
                                }
                            ]
                        }
                    ]
                },
		{
                    "categoryName": "Data In Transit Is Protected",
                    "categoryNumber": "5.1.3",
                    "subCategories":
		    [
                        {
                            "subCategoryDescription": "Protection of the confidentiality and integrity of selected categories of transmitted data via sound cryptographic means, e.g., HMACs, TLS/DTLS, IPsec, or SSH.",
                            "subCategoryNumber": "3",
                            "ocfMatchSpecification": "OCF Security Specification 2.1.2",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification_v2.1.2.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "11.2.1",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Data in transit devices must support TLS/DTLS version 1.2 or greater for all unicast sessions."
                                },
                                {
                                    "ocfMatchClause": "11.3",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Cipher Suites: All heavily reviewed and IETF approved or greater."
                                }
                            ]
			}
		    ]

		},
		{
                    "categoryName": "Data At Rest Is Protected",
                    "categoryNumber": "5.1.4",
                    "subCategories":
		    [
                        {
                            "subCategoryDescription": "Protection of the confidentiality and integrity of selected categories of stored data via sound cryptographic means.",
                            "subCategoryNumber": "4",
                            "ocfMatchSpecification": "OCF Security Specification 2.1.2",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification_v2.1.2.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "14.2.2",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Secure storage for credentials is strongly recommended."
                                }
                            ]
			}
		    ]

		},
		{
                    "categoryName": "Industry Accepted Protocols are Used for Communications",
                    "categoryNumber": "5.1.5",
                    "subCategories":
		    [
                        {
                            "subCategoryDescription": "Use of secure, widely used protocols, excluding deprecated and replaced versions and protocols, for communications to and from the device.",
                            "subCategoryNumber": "5",
                            "ocfMatchSpecification": "OCF Security Specification 2.1.2",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification_v2.1.2.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "5",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Shows transport, session and application layer standards."
                                },
                                {
                                    "ocfMatchClause": "11.2.1",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Devices must support CoAP, and CoAP over DTLS."
                                },
                                {
                                    "ocfMatchClause": "11.3",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Cipher Suites: All heavily reviewed and IETF approved or greater."
                                }
                            ]
			}
		    ]

		},
		{
                    "categoryName": "Data Validation",
                    "categoryNumber": "5.1.6",
                    "subCategories":
		    [
                        {
                            "subCategoryDescription": ": Parsing and limiting input data to prevent it from being used directly as code, commands, or other execution flow inputs; and encoding output data in a form appropriate to and limited to its intended usage.",
                            "subCategoryNumber": "6",
                            "ocfMatchSpecification": "OCF Core Specification ISO/IEC 30118-1:2018]",
                            "ocfMatchSpecificationURL": "https://standards.iso.org/ittf/PubliclyAvailableStandards/c053238_ISO_IEC_30118-1_2018.zip",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "7",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Data model enforcement of encoding, type and length.  IoT devices often don't have user input fields but data model enforcement occurs on data inbound and outbound to the system. "
                                }
                            ]
			}
		    ]

		},
		{
                    "categoryName": "Event Logging",
                    "categoryNumber": "5.1.7",
                    "subCategories":
		    [
                        {
                            "subCategoryDescription": "A limited persistent record in the device of relevant events, secured and available to authorized users.",
                            "subCategoryNumber": "7",
                            "ocfMatchSpecification": "OCF Security Specification 2.1.2",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification_v2.1.2.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "5.7",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "An OCF Platform can generate various kinds of Auditable Events. These Auditable Events can be used for log analysis or for real-time understanding of a system condition."
                                }
                            ]
			}
		    ]

		},
		{
                    "categoryName": "Cryptography",
                    "categoryNumber": "5.1.8",
                    "subCategories":
		    [
                        {
                            "subCategoryDescription": "Where cryptography is used, use open, published, proven, and peer-reviewed cryptographic methods with appropriate parameter, algorithm and option selections.",
                            "subCategoryNumber": "8",
                            "ocfMatchSpecification": "OCF Security Specification 2.1.2",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification_v2.1.2.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "11.3.1",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Cipher Suites: All heavily reviewed and IETF approved or greater."
                                }
                            ]
			}
		    ]

		},
		{
                    "categoryName": "Patchability",
                    "categoryNumber": "5.1.9",
                    "subCategories":
		    [
                        {
                            "subCategoryDescription": "The ability to verifiably update a device’s software and firmware, post-market, with patches that are authenticated to ensure that they have been deployed by an authorized entity as well as to verify the integrity of the patch.",
                            "subCategoryNumber": "9",
                            "ocfMatchSpecification": "OCF Security Specification 2.1.2",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification_v2.1.2.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "14.5.3",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Process where device validates the software version against a trusted source."
                                },
                                {
                                    "ocfMatchClause": "14.5.4",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "A client with the correct authorization can initiate a software update process."
                                }
                            ]
			}
		    ]

		},
		{
                    "categoryName": "Reprovisioning",
                    "categoryNumber": "5.1.10",
                    "subCategories":
		    [
                        {
                            "subCategoryDescription": "The ability for authorized users to securely reconfigure and redeploy a device post-market, especially to return the product to factory defaults or an authorized restore point, and securely remove data collected by the device <that is not essential to its operation>, within a defined period established by the organization.",
                            "subCategoryNumber": "10",
                            "ocfMatchSpecification": "OCF Security Specification 2.1.2",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification_v2.1.2.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "8.2",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Defines how resources on the device are returned to the manufacturer's default values."
                                }
                            ]
			}
		    ]

		}

            ]
        },
        {
            "baselineOrg": "ENISA",
            "baselineName": "IoT",
	    "baselineURL":"https://www.enisa.europa.eu/publications/baseline-security-recommendations-for-iot/at_download/fullReport",
	    "baselineGraph":"False",
            "baselineCategories": [
                {
                    "categoryName": "Hardware security",
                    "categoryNumber": "4.3.1",
                    "subCategories":
		    [
                        {
                            "subCategoryDescription": "Employ a hardware-based immutable root of trust.",
                            "subCategoryNumber": "GP-TM-01",
                            "ocfMatchSpecification": "OCF Security Specification 2.1.2",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification_v2.1.2.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "14.2.2.2",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Hardware Secure storage is recommended for symmetric and asymmetric keys, access credentials and personal private data."
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Use hardware that incorporates security features to strengthen the protection and integrity of the device ",
                            "subCategoryNumber": "GP-TM-02",
                            "ocfMatchSpecification": "OCF Security Specification 2.1.2",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification_v2.1.2.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "14.2.7",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Defines levels of Hardware Tamper Protection for cryptographic module."
                                }
                            ]
			}
		    ]
		},
                {
                    "categoryName": "Trust and Integrity Management",
                    "categoryNumber": "4.3.2",
                    "subCategories":
		    [
                        {
                            "subCategoryDescription": "Trust must be established in the boot environment before any trust in any other software or executable program can be claimed.",
                            "subCategoryNumber": "GP-TM-03",
                            "ocfMatchSpecification": "OCF Security Specification 2.1.2",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification_v2.1.2.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "14.8.3.6",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Security Profile Purple: secure boot, hardware backed secure storage"
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Sign code cryptographically to ensure it has not been tampered with after signing it as safe for the device, and implement run-time protection and secure execution monitoring to make sure malicious attacks do not overwrite code after it is loaded.",
                            "subCategoryNumber": "GP-TM-04",
                            "ocfMatchSpecification": "",
                            "ocfMatchSpecificationURL": "",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "None",
                                    "ocfMatchFlag":"Not Applicable",
                                    "ocfMatchNotes": "This is platform specific."
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Control the installation of software in operating systems, to prevent unauthenticated software and files from being loaded onto it.",
                            "subCategoryNumber": "GP-TM-05",
                            "ocfMatchSpecification": "OCF Security Specification 2.1.2",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification_v2.1.2.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "14.5.3",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "A the process whereby the Device validates the software (including firmware, operating system, Device drivers, networking stack, etc.) against a trusted source"
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Enable a system to return to a state that was known to be secure, after a security breach has occurred or if an upgrade has not been successful.",
                            "subCategoryNumber": "GP-TM-06",
                            "ocfMatchSpecification": "OCF Security Specification 2.1.2",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification_v2.1.2.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "8.6",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Device transitions to a self-recovery state SRESET if certain conditions of the device are corrupt."
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Use protocols and mechanisms able to represent and manage trust and trust relationships.",
                            "subCategoryNumber": "GP-TM-07",
                            "ocfMatchSpecification": "OCF Security Specification 2.1.2",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification_v2.1.2.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "9.4",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Certificate based key management based on public key infrastructure (PKI)."
                                }
                            ]
			}
		    ]
		},
                {
                    "categoryName": "Strong default security and privacy",
                    "categoryNumber": "4.3.3",
                    "subCategories":
		    [
                        {
                            "subCategoryDescription": "Any applicable security features should be enabled by default, and any unused or insecure functionalities should be disabled by default.",
                            "subCategoryNumber": "GP-TM-08",
                            "ocfMatchSpecification": "OCF Security Specification 2.1.2",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification_v2.1.2.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "12",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Describes access control and policy management for both local and network resources."
                                },
                                {
                                    "ocfMatchClause": "13.16",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "All implemented discoverable SVRs shall expose a Secure OCF Endpoint"
                                },
                                {
                                    "ocfMatchClause": "11.3",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Cipher Suites: All heavily reviewed and IETF approved or greater, no insecure ciphers are enabled."
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Establish hard to crack, device-individual default passwords.",
                            "subCategoryNumber": "GP-TM-09",
                            "ocfMatchSpecification": "OCF Security Specification 2.1.2",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification_v2.1.2.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "7.3.2",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Length of symmetric keys"
                                },
                                {
                                    "ocfMatchClause": "7.3.3",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Certificate Credential Generation: The Certificate Credential will be used by Devices for secure bidirectional communication."
                                },
                                {
                                    "ocfMatchClause": "9.3",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Shows pair-wise, group symmetrical credentials, symmetric credentials, and certificate credentials"
                                }
                            ]
			}
		    ]
		},
                {
                    "categoryName": "Data protection and compliance",
                    "categoryNumber": "4.3.4",
                    "subCategories":
		    [
                        {
                            "subCategoryDescription": "Personal data must be collected and processed fairly and lawfully, it should never be collected and processed without the data subject’s consent.",
                            "subCategoryNumber": "GP-TM-10",
                            "ocfMatchSpecification": "",
                            "ocfMatchSpecificationURL": "",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "None",
                                    "ocfMatchFlag":"Not Applicable",
                                    "ocfMatchNotes": "Applies to Vendor"
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Make sure that personal data is used for the specified purposes for which they were collected, and that any further processing of personal data is compatible and that the data subjects are well informed.",
                            "subCategoryNumber": "GP-TM-11",
                            "ocfMatchSpecification": "",
                            "ocfMatchSpecificationURL": "",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "None",
                                    "ocfMatchFlag":"Not Applicable",
                                    "ocfMatchNotes": "Applies to Vendor"
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Minimise the data collected and retained.",
                            "subCategoryNumber": "GP-TM-12",
                            "ocfMatchSpecification": "",
                            "ocfMatchSpecificationURL": "",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "None",
                                    "ocfMatchFlag":"Not Applicable",
                                    "ocfMatchNotes": "Applies to Vendor"
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "IoT stakeholders must be compliant with the EU General Data Protection Regulation (GDPR).",
                            "subCategoryNumber": "GP-TM-13",
                            "ocfMatchSpecification": "",
                            "ocfMatchSpecificationURL": "",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "None",
                                    "ocfMatchFlag":"Not Applicable",
                                    "ocfMatchNotes": "Applies to Vendor"
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Users of IoT products and services must be able to exercise their rights to information, access, erasure, rectification, data portability, restriction of processing, objection to processing, and their right not to be evaluated on the basis of automated processing.",
                            "subCategoryNumber": "GP-TM-14",
                            "ocfMatchSpecification": "",
                            "ocfMatchSpecificationURL": "",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "None",
                                    "ocfMatchFlag":"Not Applicable",
                                    "ocfMatchNotes": "Out of scope for device specification"
                                }
                            ]
			}
		    ]
		},
                {
                    "categoryName": "System safety and reliability",
                    "categoryNumber": "4.3.5",
                    "subCategories":
		    [
                        {
                            "subCategoryDescription": "Design with system and operational disruption in mind, preventing the system from causing an unacceptable risk of injury or physical damage.",
                            "subCategoryNumber": "GP-TM-15",
                            "ocfMatchSpecification": "",
                            "ocfMatchSpecificationURL": "",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "None",
                                    "ocfMatchFlag":"Not Applicable",
                                    "ocfMatchNotes": "Out of Scope, applies to Vendor"
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Mechanisms for self-diagnosis and self-repair/healing to recover from failure, malfunction or a compromised state.",
                            "subCategoryNumber": "GP-TM-16",
                            "ocfMatchSpecification": "OCF Security Specification 2.1.2",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification_v2.1.2.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "8.6",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Device transitions to a self-recovery state SRESET if certain conditions of the device are corrupt."
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Ensure standalone operation - essential features should continue to work with a loss of communications and chronicle negative impacts from compromised devices or cloud-based systems.",
                            "subCategoryNumber": "GP-TM-17",
                            "ocfMatchSpecification": "OCF Security Specification 2.1.2",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification_v2.1.2.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "5.1",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Shows the layers of connectivity and access control all remain proximally functional by default. "
                                }
                            ]
			}
		    ]
		},
                {
                    "categoryName": "Secure Software / Firmware updates",
                    "categoryNumber": "4.3.6",
                    "subCategories":
		    [
                        {
                            "subCategoryDescription": "Ensure that the device software/firmware, its configuration and its applications have the ability to update Over-The-Air (OTA), that the update server is secure, that the update file is transmitted via a secure connection, that it does not contain sensitive data (e.g. hardcoded credentials), that it is signed by an authorised trust entity and encrypted using accepted encryption methods, and that the update package has its digital signature, signing certificate and signing certificate chain, verified by the device before the update process begins.",
                            "subCategoryNumber": "GP-TM-18",
                            "ocfMatchSpecification": "OCF Security Specification 2.1.2",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification_v2.1.2.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "14.5.4.1",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Indicates a request to initiate the process to check if new software is available.  Note: Security of channel is out of scope, vendor responsibility."
                                },
                                {
                                    "ocfMatchClause": "14.2.2.4-2",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "It is recommended to use Secure Download and Secure Boot methods and that  authentication of a binary’s source as well as verification of its contents be used."
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Offer an automatic firmware update mechanism.",
                            "subCategoryNumber": "GP-TM-19",
                            "ocfMatchSpecification": "OCF Security Specification 2.1.2",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification_v2.1.2.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "14.5.2.1",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Once the Device has determined if an newer software version is available, it sets the Initiate Software Availability Check bit in the '/oic/sec/pstat.cmr' Property to 1 (TRUE), indicating that new software is available"
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Backward compatibility of firmware updates. Automatic firmware updates should not modify user-configured preferences, security, and/or privacy settings without user notification.",
                            "subCategoryNumber": "GP-TM-20",
                            "ocfMatchSpecification": "OCF Security Specification 2.1.2",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification_v2.1.2.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "15.5.2.1",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "The state of all resources implemented in the Device should be the same as after boot, meaning that the software update is not resetting user data and retaining a correct state."
                                }
                            ]
			}
		    ]
		},
                {
                    "categoryName": "Authentication",
                    "categoryNumber": "4.3.7",
                    "subCategories":
		    [
                        {
                            "subCategoryDescription": "Design the authentication and authorisation schemes (unique per device) based on the ",
                            "subCategoryNumber": "GP-TM-21",
                            "ocfMatchSpecification": "OCF Security Specification 2.1.2",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification_v2.1.2.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "12",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Describes access control and policy management for both local and network resources, is unique per SVR per device."
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Ensure that default passwords and even default usernames are changed during the initial setup, and that weak, null or blank passwords are not allowed.",
                            "subCategoryNumber": "GP-TM-22",
                            "ocfMatchSpecification": "OCF Security Specification 2.1.2",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification_v2.1.2.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "5.3.3",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Prior to operational state, device must be onboarded and configured with either symmetric or asymmetric credentials based on certificates or shared keys  Once operational devices implement role-based and/or subject based access control for each resource they present to the network."
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Authentication mechanisms must use strong passwords or personal identification numbers (PINs), and should consider using two-factor authentication (2FA) or multi-factor authentication (MFA) like Smartphones, Biometrics, etc., on top of certificates.",
                            "subCategoryNumber": "GP-TM-23",
                            "ocfMatchSpecification": "OCF Security Specification 2.1.2",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification_v2.1.2.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "7.3.5.3",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "It is recommended that the entropy of the Random PIN be enough to withstand an online brute-force attack, 40 bits or more. 2fA/ MFA is out of scope."
                                },
                                {
                                    "ocfMatchClause": "7.3.2",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Shared Key Credential Calculation, length depends on the cipher suite."
                                },
                                {
                                    "ocfMatchClause": "13.3.1",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Stored Credentials used to mutually authenticate servers and clients."
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Authentication credentials shall be salted, hashed and/or encrypted.",
                            "subCategoryNumber": "GP-TM-24",
                            "ocfMatchSpecification": "OCF Security Specification 2.1.2",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification_v2.1.2.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "14.2.2.2",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Hardware Secure storage is recommended for symmetric and asymmetric keys, access credentials and personal private data."
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Protect against ‘brute force’ and/or other abusive login attempts. This protection should also consider keys stored in devices.",
                            "subCategoryNumber": "GP-TM-25",
                            "ocfMatchSpecification": "",
                            "ocfMatchSpecificationURL": "",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "None",
                                    "ocfMatchFlag":"Not Implemented",
                                    "ocfMatchNotes": "Not currently in OCF specification."
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Ensure password recovery or reset mechanism is robust and does not supply an attacker with information indicating a valid account. The same applies to key update and recovery mechanisms.",
                            "subCategoryNumber": "GP-TM-26",
                            "ocfMatchSpecification": "",
                            "ocfMatchSpecificationURL": "",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "None",
                                    "ocfMatchFlag":"Not Implemented",
                                    "ocfMatchNotes": "Out of scope, vendor requirements"
                                }
                            ]
			}
		    ]
		},
                {
                    "categoryName": "Authorisation",
                    "categoryNumber": "4.3.8",
                    "subCategories":
		    [
                        {
                            "subCategoryDescription": "Limit the actions allowed for a given system by Implementing fine-grained authorisation mechanisms and using the Principle of least privilege (POLP): applications must operate at the lowest privilege level possible.",
                            "subCategoryNumber": "GP-TM-27",
                            "ocfMatchSpecification": "OCF Security Specification 2.1.2",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification_v2.1.2.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "12",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Access control is enforced over all Resources."
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Device firmware should be designed to isolate privileged code, processes and data from portions of the firmware that do not need access to them. Device hardware should provide isolation concepts to prevent unprivileged from accessing security sensitive code.",
                            "subCategoryNumber": "GP-TM-28",
                            "ocfMatchSpecification": "",
                            "ocfMatchSpecificationURL": "",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "None",
				    "ocfMatchFlag":"Not Applicable",
                                    "ocfMatchNotes": "Firmare is vendor dependant"
                                }
                            ]
			}
		    ]
		},
                {
                    "categoryName": "Access Control - Physical and Environmental security",
                    "categoryNumber": "4.3.9",
                    "subCategories":
		    [
                        {
                            "subCategoryDescription": "Data integrity and confidentiality must be enforced by access controls. When the subject requesting access has been authorised to access particular processes, it is necessary to enforce the defined security policy.",
                            "subCategoryNumber": "GP-TM-29",
                            "ocfMatchSpecification": "OCF Security Specification 2.1.2",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification_v2.1.2.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "13.10",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Security Virtual Resources (SVRs) and Access Policy, All SVRs can be accessed by the authorized entity"
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Ensure a context-based security and privacy that reflects different levels of importance.",
                            "subCategoryNumber": "GP-TM-30",
                            "ocfMatchSpecification": "OCF Security Specification 2.1.2",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification_v2.1.2.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "12.2.6",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Access control is asserted for established roles."
                                },
                                {
                                    "ocfMatchClause": "13.10",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Describes the Roles resource."
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Measures for tamper protection and detection. Detection and reaction to hardware tampering should not rely on network connectivity.",
                            "subCategoryNumber": "GP-TM-31",
                            "ocfMatchSpecification": "",
                            "ocfMatchSpecificationURL": "",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "None",
				    "ocfMatchFlag":"Not Applicable",
                                    "ocfMatchNotes": "Hardware tampering is out of scope for device specification"
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Ensure that the device cannot be easily disassembled and that the data storage medium is encrypted at rest and cannot be easily removed.",
                            "subCategoryNumber": "GP-TM-32",
                            "ocfMatchSpecification": "OCF Security Specification 2.1.2",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification_v2.1.2.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "14.2.2.2",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Hardware Secure storage is recommended for symmetric and asymmetric keys, access credentials and personal private data."
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Ensure that devices only feature the essential physical external ports (such as USB) necessary for them to function and that the test/debug modes are secure, so they cannot be used to maliciously access the devices. In general, lock down physical ports to only trusted connections.",
                            "subCategoryNumber": "GP-TM-33",
                            "ocfMatchSpecification": "",
                            "ocfMatchSpecificationURL": "",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "None",
                                    "ocfMatchFlag":"not Applicable",
                                    "ocfMatchNotes": "Out of scope, vendor dependant"
                                }
                            ]
			}
		    ]
		},
                {
                    "categoryName": "Cryptography",
                    "categoryNumber": "4.3.10",
                    "subCategories":
		    [
                        {
                            "subCategoryDescription": "Ensure a proper and effective use of cryptography to protect the confidentiality, authenticity and/or integrity of data and information (including control messages), in transit and in rest. Ensure the proper selection of standard and strong encryption algorithms and strong keys, and disable insecure protocols. Verify the robustness of the implementation.",
                            "subCategoryNumber": "GP-TM-34",
                            "ocfMatchSpecification": "OCF Security Specification 2.1.2",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification_v2.1.2.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "11.2.1",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Devices must support TLS/DTLS version 1.2 or greater for all unicast sessions."
                                },
                                {
                                    "ocfMatchClause": "11.3",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Cipher Suites: All heavily reviewed and IETF approved or greater."
                                },
                                {
                                    "ocfMatchClause": "14.2.2",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Secure storage for credentials is strongly recommended."
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Cryptographic keys must be securely managed.",
                            "subCategoryNumber": "GP-TM-35",
                            "ocfMatchSpecification": "OCF Security Specification 2.1.2",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification_v2.1.2.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "9.4",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Device certificates and private keys are kept in 'cred' secure virtual resource"
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Build devices to be compatible with lightweight encryption and security techniques.",
                            "subCategoryNumber": "GP-TM-36",
                            "ocfMatchSpecification": "OCF Security Specification 2.1.2",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification_v2.1.2.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "9.4.2.1",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Digital certificate profile, showing OCF approved cipher suites."
                                },
                                {
                                    "ocfMatchClause": "11.3.1",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "General cipher suites defined for both ownership transfer and normal operation."
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Support scalable key management schemes.",
                            "subCategoryNumber": "GP-TM-37",
                            "ocfMatchSpecification": "OCF Security Specification 2.1.2",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification_v2.1.2.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "9.4",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Certificate based key management based on public key infrastructure (PKI)."
                                }
                            ]
			}
		    ]
		},
                {
                    "categoryName": "Secure and trusted communications",
                    "categoryNumber": "4.3.11",
                    "subCategories":
		    [
                        {
                            "subCategoryDescription": "Guarantee the different security aspects -confidentiality (privacy), integrity, availability and authenticity- of the information in transit on the networks or stored in the IoT application or in the Cloud.",
                            "subCategoryNumber": "GP-TM-38",
                            "ocfMatchSpecification": "OCF Cloud Security Specification",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Cloud_Security_Specification_v2.1.2.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "7.2",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Device connection with the OCF Cloud.  The Device should establish the TLS connection using the certificate based credential. Note: Availability is out of scope"
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Ensure that communication security is provided using state-of-the-art, standardised security protocols, such as TLS for encryption.",
                            "subCategoryNumber": "GP-TM-39",
                            "ocfMatchSpecification": "OCF Security Specification 2.1.2",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification_v2.1.2.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "11.2.1",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Devices must support TLS/DTLS version 1.2 or greater for all unicast sessions."
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Ensure credentials are not exposed in internal or external network traffic.",
                            "subCategoryNumber": "GP-TM-40",
                            "ocfMatchSpecification": "OCF Security Specification 2.1.2",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification_v2.1.2.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "13.16",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "All implemented discoverable SVRs shall expose a Secure OCF Endpoint"
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Guarantee data authenticity to enable reliable exchanges from data emission to data reception. Data should always be signed whenever and wherever it is captured and stored.",
                            "subCategoryNumber": "GP-TM-41",
                            "ocfMatchSpecification": "OCF Security Specification 2.1.2",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification_v2.1.2.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "11.2.1",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Devices must support TLS/DTLS version 1.2 or greater for all unicast sessions. Data authenticity is provided by certificate authentication in DTLS handshake"
                                },
                                {
                                    "ocfMatchClause": "14.2.2",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Secure storage for credentials is strongly recommended."
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Do not trust data received and always verify any interconnections. Discover, identify and verify/authenticate the devices connected to the network before trust can be established, and preserve their integrity for reliable solutions and services.",
                            "subCategoryNumber": "GP-TM-42",
                            "ocfMatchSpecification": "OCF Security Specification 2.1.2",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification_v2.1.2.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "11.2.1",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Devices must support TLS/DTLS version 1.2 or greater for all unicast sessions.  This includes proximal and non-proximal traffic.  All TLS/DTLS traffic is verified by device credential which forms the basis for trust."
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "IoT devices should be restrictive rather than permissive in communicating.",
                            "subCategoryNumber": "GP-TM-43",
                            "ocfMatchSpecification": "OCF Security Specification 2.1.2",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification_v2.1.2.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "12",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Access control is enforced over all Resources.Employs a deny-all, permit-by-exception policy to allow access to Resources (data and actuators) for Read/Write/Create/Delete/Notify.  Access control can be updated dynamically at the location of deployment to limit access (to a role, Device, or implementation)"
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Make intentional connections. Prevent unauthorised connections to it or other devices the product is connected to, at all levels of the protocols.",
                            "subCategoryNumber": "GP-TM-44",
                            "ocfMatchSpecification": "OCF Security Specification 2.1.2",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification_v2.1.2.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "13.3.1",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Stored Credentials used to authenticate server to clients."
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Disable specific ports and/or network connections for selective connectivity.",
                            "subCategoryNumber": "GP-TM-45",
                            "ocfMatchSpecification": "OCF Security Specification 2.1.2",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification_v2.1.2.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "12",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Access control is enforced over all Resources."
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Rate limiting. Controlling the traffic sent or received by a network to reduce the risk of automated attacks.",
                            "subCategoryNumber": "GP-TM-46",
                            "ocfMatchSpecification": "",
                            "ocfMatchSpecificationURL": "",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "None",
                                    "ocfMatchFlag":"Not Applicable",
                                    "ocfMatchNotes": "Out of scope for a device specification requires the network to account for traffic"
                                }
                            ]
			}
		    ]
		},
                {
                    "categoryName": "Secure Interfaces and network services",
                    "categoryNumber": "4.3.12",
                    "subCategories":
		    [
                        {
                            "subCategoryDescription": "Risk Segmentation. Splitting network elements into separate components to help isolate security breaches and minimise the overall risk.",
                            "subCategoryNumber": "GP-TM-47",
                            "ocfMatchSpecification": "",
                            "ocfMatchSpecificationURL": "",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "None", 
                                    "ocfMatchFlag":"Not Applicable",
                                    "ocfMatchNotes": "Out of scope for a device specification"
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Protocols should be designed to ensure that, if a single device is compromised, it does not affect the whole set.",
                            "subCategoryNumber": "GP-TM-48",
                            "ocfMatchSpecification": "OCF Security Specification 2.1.2",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification_v2.1.2.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "12",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Access control is enforced over all Resources.  If asymmetric credentials are used compromising a single device would not increase the risk to other devices."
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Avoid provisioning the same secret key in an entire product family, since compromising a single device would be enough to expose the rest of the product family.",
                            "subCategoryNumber": "GP-TM-49",
                            "ocfMatchSpecification": "OCF Security Specification 2.1.2",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification_v2.1.2.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "7.3.2",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "SharedKey credential is derived using a pseudo-random function that accepts the key_block value resulting from the DTLS handshake used for onboarding."
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Ensure only necessary ports are exposed and available.",
                            "subCategoryNumber": "GP-TM-50",
                            "ocfMatchSpecification": "OCF Security Specification 2.1.2",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification_v2.1.2.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "13.16",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "All implemented discoverable SVRs shall expose a Secure OCF Endpoint"
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Implement a DDoS-resistant and Load-Balancing infrastructure.",
                            "subCategoryNumber": "GP-TM-51",
                            "ocfMatchSpecification": "",
                            "ocfMatchSpecificationURL": "",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "None",
                                    "ocfMatchFlag":"Not Applicable",
                                    "ocfMatchNotes": "Out of scope for a device specifcation"
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Ensure web interfaces fully encrypt the user session, from the device to the backend services, and that they are not susceptible to XSS, CSRF, SQL injection, etc.",
                            "subCategoryNumber": "GP-TM-52",
                            "ocfMatchSpecification": "OCF Security Specification 2.1.2",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification_v2.1.2.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "13.16",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "All implemented discoverable SVRs shall expose a Secure OCF Endpoint.  These are COAPS rather than https."
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Avoid security issues when designing error messages.",
                            "subCategoryNumber": "GP-TM-53",
                            "ocfMatchSpecification": "OCF Cloud API for Cloud Services DRAFT",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/draftspecs/Gaborone-1/OCF%20Cloud%20API%20for%20Cloud%20Services.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "5.2",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "The OCF Cloud API for Cloud Services is a RESTful API over HTTPS (IETF RFC 2818)."
                                }
                            ]
			}
		    ]
		},
                {
                    "categoryName": "Secure input and output handling",
                    "categoryNumber": "4.3.13",
                    "subCategories":
		    [
                        {
                            "subCategoryDescription": "Data input validation (ensuring that data is safe prior to use) and output filtering.",
                            "subCategoryNumber": "GP-TM-54",
                            "ocfMatchSpecification": "OCF Core Specification ISO/IEC 30118-1:2018",
                            "ocfMatchSpecificationURL": "https://standards.iso.org/ittf/PubliclyAvailableStandards/c053238_ISO_IEC_30118-1_2018.zip",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "7",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Data model enforcement of encoding, type and length.  IoT devices often don't have user input fields but data model enforcement occurs on data inbound and outbound to the system. "
                                }
                            ]
			}
		    ]
		},
                {
                    "categoryName": "Logging",
                    "categoryNumber": "4.3.14",
                    "subCategories":
		    [
                        {
                            "subCategoryDescription": "Implement a logging system that records events relating to user authentication, management of accounts and access rights, modifications to security rules, and the functioning of the system. Logs must be preserved on durable storage and retrievable via authenticated connections.",
                            "subCategoryNumber": "GP-TM-55",
                            "ocfMatchSpecification": "OCF Security Specification 2.1.2",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification_v2.1.2.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "5.7",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "An OCF Platform can generate various kinds of Auditable Events. These Auditable Events can be used for log analysis or for real-time understanding of a system condition."
                                }
                            ]
			}
		    ]
		},
                {
                    "categoryName": "Monitoring and Auditing",
                    "categoryNumber": "4.3.15",
                    "subCategories":
		    [
                        {
                            "subCategoryDescription": "Implement regular monitoring to verify the device behaviour, to detect malware and to discover integrity errors.",
                            "subCategoryNumber": "GP-TM-56",
                            "ocfMatchSpecification": "",
                            "ocfMatchSpecificationURL": "",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "None",
                                    "ocfMatchFlag":"Not Applicable",
                                    "ocfMatchNotes": "Out of scope.  Logic is present but is vendor responsibility"
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Conduct periodic audits and reviews of security controls to ensure that the controls are effective. Perform penetration tests at least biannually.",
                            "subCategoryNumber": "GP-TM-57",
                            "ocfMatchSpecification": "",
                            "ocfMatchSpecificationURL": "",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "None",
                                    "ocfMatchFlag":"Not Applicable",
                                    "ocfMatchNotes": "Vendor dependant"
                                }
                            ]
			}
		    ]
		}
	    ]
	},
        {

            "baselineOrg": "UK",
            "baselineName": "Iot Requirements",
	    "baselineURL":"https://www.gov.uk/government/publications/code-of-practice-for-consumer-iot-security/code-of-practice-for-consumer-iot-security",
	    "baselineGraph":"True",
            "baselineCategories":
	    [
                {
                    "categoryName": "No default passwords",
                    "categoryNumber": "1",
                    "subCategories":
		    [
                        {
                            "subCategoryDescription": "All IoT device passwords shall be unique and not resettable to any universal factory default value.",
                            "subCategoryNumber": "1",
                            "ocfMatchSpecification": "OCF Security Specification ISO/IEC 30118-2:2018]",
                            "ocfMatchSpecificationURL": "https://standards.iso.org/ittf/PubliclyAvailableStandards/c074239_ISO_IEC_30118-2_2018.zip",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "5.3.3",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Prior to operational state, device must be onboarded and configured with either symmetric or asymmetric credentials based on certificates or shared keys  Once operational devices implement role-based and/or subject based access control for each resource they present to the network."
                                }
                            ]
			}
		    ]
		},
                {
                    "categoryName": "Implement a vulnerability disclosure policy",
                    "categoryNumber": "2",
                    "subCategories":
		    [
                        {
                            "subCategoryDescription": "All companies that provide internet-connected devices and services shall provide a public point of contact as part of a vulnerability disclosure policy in order that security researchers and others are able to report issues. Disclosed vulnerabilities should be acted on in a timely manner.",
                            "subCategoryNumber": "1",
                            "ocfMatchSpecification": "OCF Security Incident Response Plan",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/contact-us/report-an-issue",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "1",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Single point of contact and guidelines for member companies to report security issues, including vulnerability reporting.  Vulnerabilities are triaged and addressed in a timely manner"
                                }
                            ]
			}
		    ]
		},
                {
                    "categoryName": "Keep software updated",
                    "categoryNumber": "3",
                    "subCategories":
		    [
                        {
                            "subCategoryDescription": "Software components in internet-connected devices should be securely updateable. Updates shall be timely and should not impact on the functioning of the device. An end-of-life policy shall be published for end-point devices which explicitly states the minimum length of time for which a device will receive software updates and the reasons for the length of the support period. The need for each update should be made clear to consumers and an update should be easy to implement. For constrained devices that cannot physically be updated, the product should be isolatable and replaceable.",
                            "subCategoryNumber": "1",
                            "ocfMatchSpecification": "OCF Security Specification ISO/IEC 30118-2:2018]",
                            "ocfMatchSpecificationURL": "https://standards.iso.org/ittf/PubliclyAvailableStandards/c074239_ISO_IEC_30118-2_2018.zip",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "14.5.3",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Process where device validates the software version against a trusted source."
                                },
                                {
                                    "ocfMatchClause": "14.5.4",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "A client with the correct authorization can initiate a software update process"
                                }
                            ]
			}
		    ]
		},
                {
                    "categoryName": "Securely store credentials and security-sensitive data",
                    "categoryNumber": "4",
                    "subCategories":
		    [
                        {
                            "subCategoryDescription": "Any credentials shall be stored securely within services and on devices. Hard-coded credentials in device software are not acceptable.",
                            "subCategoryNumber": "1",
                            "ocfMatchSpecification": "OCF Security Specification ISO/IEC 30118-2:2018]",
                            "ocfMatchSpecificationURL": "https://standards.iso.org/ittf/PubliclyAvailableStandards/c074239_ISO_IEC_30118-2_2018.zip",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "14.2.2",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Secure storage for credentials is strongly recommended."
                                },
                                {
                                    "ocfMatchClause": "5.3.3",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Prior to operational state, device must be onboarded and configured with either symmetric or asymmetric credentials based on certificates or shared keys  Once operational devices implement role-based and/or subject based access control for each resource they present to the network."
                                }
                            ]
			}
		    ]
		},
                {
                    "categoryName": "Communicate securely",
                    "categoryNumber": "5",
                    "subCategories":
		    [
                        {
                            "subCategoryDescription": "Security-sensitive data, including any remote management and control, should be encrypted in transit, appropriate to the properties of the technology and usage. All keys should be managed securely.",
                            "subCategoryNumber": "1",
                            "ocfMatchSpecification": "OCF Security Specification ISO/IEC 30118-2:2018]",
                            "ocfMatchSpecificationURL": "https://standards.iso.org/ittf/PubliclyAvailableStandards/c074239_ISO_IEC_30118-2_2018.zip",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "11.2.1",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Data in transit devices must support TLS/DTLS version 1.2 or greater for all unicast sessions."
                                },
                                {
                                    "ocfMatchClause": "11.3.1",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "This clause lists the cipher suites allowed during ownership transfer and normal operation.  All cipher suites are recognized IETF RFCs and most are IANA supported ciphers.  Strong, proven, updateable cryptography using open, peer-reviewed methods and algorithms."
                                }
                            ]
			}
		    ]
		},
                {
                    "categoryName": "Minimise exposed attack surfaces",
                    "categoryNumber": "6",
                    "subCategories":
		    [
                        {
                            "subCategoryDescription": "All devices and services should operate on the ‘principle of least privilege’; unused ports should be closed, hardware should not unnecessarily expose access, services should not be available if they are not used and code should be minimised to the functionality necessary for the service to operate. Software should run with appropriate privileges, taking account of both security and functionality.",
                            "subCategoryNumber": "1",
                            "ocfMatchSpecification": "OCF Security Specification ISO/IEC 30118-2:2018]",
                            "ocfMatchSpecificationURL": "https://standards.iso.org/ittf/PubliclyAvailableStandards/c074239_ISO_IEC_30118-2_2018.zip",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "12",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Describes access control and policy management for both local and network resources."
                                },
                                {
                                    "ocfMatchClause": "5",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Figure 3:  Shows security enforcement points."
                                }
                            ]
			}
		    ]
		},
                {
                    "categoryName": "Ensure software integrity",
                    "categoryNumber": "7",
                    "subCategories":
		    [
                        {
                            "subCategoryDescription": "Software on IoT devices should be verified using secure boot mechanisms. If an unauthorised change is detected, the device should alert the consumer/administrator to an issue and should not connect to wider networks than those necessary to perform the alerting function.",
                            "subCategoryNumber": "1",
                            "ocfMatchSpecification": "OCF Security Specification ISO/IEC 30118-2:2018]",
                            "ocfMatchSpecificationURL": "https://standards.iso.org/ittf/PubliclyAvailableStandards/c074239_ISO_IEC_30118-2_2018.zip",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "14.2.2.4-2",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "It is recommended to use Secure Download and Secure Boot methods and that  authentication of a binary’s source as well as verification of its contents be used."
                                }
                            ]
			}
		    ]
		},
                {
                    "categoryName": "Ensure that personal data is protected",
                    "categoryNumber": "8",
                    "subCategories":
		    [
                        {
                            "subCategoryDescription": "Where devices and/or services process personal data, they shall do so in accordance with applicable data protection law, such as the General Data Protection Regulation (GDPR) and the Data Protection Act 2018. Device manufacturers and IoT service providers shall provide consumers with clear and transparent information about how their data is being used, by whom, and for what purposes, for each device and service. This also applies to any third parties that may be involved (including advertisers). Where personal data is processed on the basis of consumers’ consent, this shall be validly and lawfully obtained, with those consumers being given the opportunity to withdraw it at any time.",
                            "subCategoryNumber": "1",
                            "ocfMatchSpecification": "",
                            "ocfMatchSpecificationURL": "",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "None",
                                    "ocfMatchFlag":"Not Applicable",
                                    "ocfMatchNotes": "Out of scope for device spec.  This is provider dependant"
                                }
                            ]
			}
		    ]
		},
                {
                    "categoryName": "Make systems resilient to outages",
                    "categoryNumber": "9",
                    "subCategories":
		    [
                        {
                            "subCategoryDescription": "Resilience should be built in to IoT devices and services where required by their usage or by other relying systems, taking into account the possibility of outages of data networks and power. As far as reasonably possible, IoT services should remain operating and locally functional in the case of a loss of network and should recover cleanly in the case of restoration of a loss of power. Devices should be able to return to a network in a sensible state and in an orderly fashion, rather than in a massive scale reconnect.",
                            "subCategoryNumber": "1",
                            "ocfMatchSpecification": "OCF Security Specification ISO/IEC 30118-2:2018]",
                            "ocfMatchSpecificationURL": "https://standards.iso.org/ittf/PubliclyAvailableStandards/c074239_ISO_IEC_30118-2_2018.zip",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "5.1",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Shows the layers of connectivity and access control all remain proximally functional by default."
                                }
                            ]
			}
		    ]
		},
                {
                    "categoryName": "Monitor system telemetry data",
                    "categoryNumber": "10",
                    "subCategories":
		    [
                        {
                            "subCategoryDescription": "If telemetry data is collected from IoT devices and services, such as usage and measurement data, it should be monitored for security anomalies.",
                            "subCategoryNumber": "1",
                            "ocfMatchSpecification": "",
                            "ocfMatchSpecificationURL": "",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "None",
                                    "ocfMatchFlag":"Not Applicable",
                                    "ocfMatchNotes": "Out of scope for OCF Spec.  Requirement targets IoT service providers"
                                }
                            ]
			}
		    ]
		},
                {
                    "categoryName": "Make it easy for consumers to delete personal data",
                    "categoryNumber": "11",
                    "subCategories":
		    [
                        {
                            "subCategoryDescription": "Devices and services should be configured such that personal data can easily be removed from them when there is a transfer of ownership, when the consumer wishes to delete it and/or when the consumer wishes to dispose of the device. Consumers should be given clear instructions on how to delete their personal data.",
                            "subCategoryNumber": "1",
                            "ocfMatchSpecification": "OCF Security Specification ISO/IEC 30118-2:2018]",
                            "ocfMatchSpecificationURL": "https://standards.iso.org/ittf/PubliclyAvailableStandards/c074239_ISO_IEC_30118-2_2018.zip",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "8.2",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Defines how resources on the device are returned to the manufacturer's default values."
                                }
                            ]
			}
		    ]
		},
                {
                    "categoryName": "Make installation and maintenance of devices easy",
                    "categoryNumber": "12",
                    "subCategories":
		    [
                        {
                            "subCategoryDescription": "Installation and maintenance of IoT devices should employ minimal steps and should follow security best practice on usability. Consumers should also be provided with guidance on how to securely set up their device.",
                            "subCategoryNumber": "1",
                            "ocfMatchSpecification": "OCF Security Specification ISO/IEC 30118-2:2018]",
                            "ocfMatchSpecificationURL": "https://standards.iso.org/ittf/PubliclyAvailableStandards/c074239_ISO_IEC_30118-2_2018.zip",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "3.1.31",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Includes the WiFi Easy Setup Resources, and the other transport-level onboarding (e.g. Bluetooth) are defined in other specification documents for OCF."
                                },
                                {
                                    "ocfMatchClause": "5.3",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "For non-transport onboarding, the process is specified in great detail as far as establishment of trust, authentication, verification, authorization, local credential issuance, etc."
                                }
                            ]
			}
		    ]
		},
                {
                    "categoryName": "Validate input data",
                    "categoryNumber": "13",
                    "subCategories":
		    [
                        {
                            "subCategoryDescription": "Data input via user interfaces and transferred via application programming interfaces <APIs> or between networks in services and devices shall be validated.",
                            "subCategoryNumber": "1",
                            "ocfMatchSpecification": "OCF Core Specification ISO/IEC 30118-1:2018]",
                            "ocfMatchSpecificationURL": "https://standards.iso.org/ittf/PubliclyAvailableStandards/c053238_ISO_IEC_30118-1_2018.zip",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "4.3",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "All data inputs are validated against JSON Schemas."
                                },
                                {
                                    "ocfMatchClause": "5",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Baseline Model Constructs"
                                }
                            ]
			}
		    ]
		}
	    ]
	},
        {
            "baselineOrg": "European Telecommunications Standards Institute (ETSI)",
            "baselineName": "ETSI",
	    "baselineURL":"https://www.etsi.org/deliver/etsi_en/303600_303699/303645/02.01.01_60/en_303645v020101p.pdf",
	    "baselineGraph":"True",
            "baselineCategories":
	    [
                {
                    "categoryName": "No universal default passwords",
                    "categoryNumber": "5.1",
                    "subCategories":
		    [
                        {
                            "subCategoryDescription": "Where passwords are used and in any state other than the factory default, all consumer IoT device passwords shall be unique per device or defined by the user. ",
                            "subCategoryNumber": "5.1.1",
                            "ocfMatchSpecification": "OCF Security Specification ISO/IEC 30118-2:2018]",
                            "ocfMatchSpecificationURL": "https://standards.iso.org/ittf/PubliclyAvailableStandards/c074239_ISO_IEC_30118-2_2018.zip",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "5.3.3",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Prior to operational state, device must be onboarded and configured with either symmetric or asymmetric credentials based on certificates or shared keys  Once operational devices implement role-based and/or subject based access control for each resource they present to the network."
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Where pre-installed unique per device passwords are used, these shall be generated with a mechanism that reduces the risk of automated attacks against a class or type of device.",
                            "subCategoryNumber": "5.1.2",
                            "ocfMatchSpecification": "OCF Security Specification ISO/IEC 30118-2:2018]",
                            "ocfMatchSpecificationURL": "https://standards.iso.org/ittf/PubliclyAvailableStandards/c074239_ISO_IEC_30118-2_2018.zip",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "7.3.5.3",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "It is recommended that the entropy of the Random PIN be enough to withstand an online brute-force attack, 40 bits or more.  This is only used for transferring ownership, afterward replaced with locally generated credential."
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Authentication mechanisms used to authenticate users against a device shall use best practice cryptography, appropriate to the properties of the technology, risk and usage.",
                            "subCategoryNumber": "5.1.3",
                            "ocfMatchSpecification": "OCF Security Specification ISO/IEC 30118-2:2018]",
                            "ocfMatchSpecificationURL": "https://standards.iso.org/ittf/PubliclyAvailableStandards/c074239_ISO_IEC_30118-2_2018.zip",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "11.3",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Cipher Suites: All heavily reviewed and compliant with IETF standards.  Aligns with NIST recommendations 800-52 Rev 2."
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Where a user can authenticate against a device, the device shall provide to the user or an administrator a simple mechanism to change the authentication value used.",
                            "subCategoryNumber": "5.1.4",
                            "ocfMatchSpecification": "OCF Onboarding Tool Specification",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Onboarding_Tool_Specification_v2.1.2.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "5.4",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Describes methods to provision credentials on a device."
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "When the device is not a constrained device, it shall have a mechanism available which makes brute- force attacks on authentication mechanisms via network interfaces impracticable.",
                            "subCategoryNumber": "5.1.5",
                            "ocfMatchSpecification": "",
                            "ocfMatchSpecificationURL": "",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "None",
                                    "ocfMatchFlag":"Not Implemented",
                                    "ocfMatchNotes": "This is not currently specificied in OCF"
                                }
                            ]
			}
		    ]
		},
                {
                    "categoryName": "Implement a means to manage reports of vulnerabilities",
                    "categoryNumber": "5.2",
                    "subCategories":
		    [
                        {
                            "subCategoryDescription": "The manufacturer shall make a vulnerability disclosure policy publicly available. This policy shall include, at a minimum:contact information for the reporting of issues and information on timelines for: 1 initial acknowledgement of receipt and 2  status updates until the resolution of the reported issues.",
                            "subCategoryNumber": "5.2.1",
                            "ocfMatchSpecification": "OCF Security Incident Response Plan",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/contact-us/report-an-issue",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "1",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Vulnerabilities are triaged and acted on in a timely manner"
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Disclosed vulnerabilities should be acted on in a timely manner. A 'timely manner' for acting on vulnerabilities varies considerably and is incident-specific; however, conventionally, the vulnerability process is completed within 90 days for a software solution",
                            "subCategoryNumber": "5.2.2",
                            "ocfMatchSpecification": "OCF Security Incident Response Plan",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/contact-us/report-an-issue",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "1",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Vulnerabilities are triaged and acted on in a timely manner"
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Manufacturers should continually monitor for, identify and rectify security vulnerabilities within products and services they sell, produce, have produced and services they operate during the defined support period.",
                            "subCategoryNumber": "5.2.3",
                            "ocfMatchSpecification": "OCF Security Specification ISO/IEC 30118-2:2018]",
                            "ocfMatchSpecificationURL": "https://standards.iso.org/ittf/PubliclyAvailableStandards/c074239_ISO_IEC_30118-2_2018.zip",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "14.2.2.4",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Device vendor expects to support security updates to the software, operating system, drivers, networking, firmware and hardware of the device."
                                }
                            ]
			}
		    ]
		},
                {
                    "categoryName": "Keep software updated",
                    "categoryNumber": "5.3",
                    "subCategories":
		    [
                        {
                            "subCategoryDescription": "All software components in consumer IoT devices should be securely updateable.",
                            "subCategoryNumber": "5.3.01",
                            "ocfMatchSpecification": "OCF Security Specification ISO/IEC 30118-2:2018]",
                            "ocfMatchSpecificationURL": "https://standards.iso.org/ittf/PubliclyAvailableStandards/c074239_ISO_IEC_30118-2_2018.zip",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "14.2.2.4",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "It is recommended to use Secure Download and Secure Boot methods and that authentication of a binary’s source as well as verification of its contents be used."
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "When the device is not a constrained device, it shall have an update mechanism for the secure installation of updates.",
                            "subCategoryNumber": "5.3.02",
                            "ocfMatchSpecification": "OCF Security Specification ISO/IEC 30118-2:2018]",
                            "ocfMatchSpecificationURL": "https://standards.iso.org/ittf/PubliclyAvailableStandards/c074239_ISO_IEC_30118-2_2018.zip",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "14.2.2.4",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "It is recommended to use Secure Download and Secure Boot methods and that authentication of a binary’s source as well as verification of its contents be used."
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "An update shall be simple for the user to apply.",
                            "subCategoryNumber": "5.3.03",
                            "ocfMatchSpecification": "",
                            "ocfMatchSpecificationURL": "",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "None",
                                    "ocfMatchFlag":"Not Applicable",
                                    "ocfMatchNotes": "User experience is out of scope for device specification"
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Automatic mechanisms should be used for software updates.",
                            "subCategoryNumber": "5.3.04",
                            "ocfMatchSpecification": "OCF Security Specification ISO/IEC 30118-2:2018]",
                            "ocfMatchSpecificationURL": "https://standards.iso.org/ittf/PubliclyAvailableStandards/c074239_ISO_IEC_30118-2_2018.zip",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "14.5.4",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Software Update Setting the Initiate Secure Software Update bit in the '/oic/sec/pstat.tm' Property (see Table 37 of clause 13.8) indicates a request to initiate the software update process."
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "The device should check after initialization, and then periodically, whether security updates are available.  For some products, it can be more appropriate for the associated service, rather than the device, to perform such checks.",
                            "subCategoryNumber": "5.3.05",
                            "ocfMatchSpecification": "OCF Security Specification ISO/IEC 30118-2:2018]",
                            "ocfMatchSpecificationURL": "https://standards.iso.org/ittf/PubliclyAvailableStandards/c074239_ISO_IEC_30118-2_2018.zip",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "14.5.4",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Software Update Setting the Initiate Secure Software Update bit in the '/oic/sec/pstat.tm' Property (see Table 37 of clause 13.8) indicates a request to initiate the software update process."
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "If the device supports automatic updates and/or update notifications, these should be enabled in the initialized state and configurable so that the user can enable, disable, or postpone installation of security updates and/or update notifications.",
                            "subCategoryNumber": "5.3.06",
                            "ocfMatchSpecification": "OCF Security Specification ISO/IEC 30118-2:2018]",
                            "ocfMatchSpecificationURL": "https://standards.iso.org/ittf/PubliclyAvailableStandards/c074239_ISO_IEC_30118-2_2018.zip",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "14.5.2.1",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Once the Device has determined if an newer software version is available, it sets the Initiate Software Availability Check bit in the '/oic/sec/pstat.cm' Property to 1 (TRUE), indicating that new software is available.  Update notifications are not currenly implemented "
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "The device shall use best practice cryptography to facilitate secure update mechanisms.",
                            "subCategoryNumber": "5.3.07",
                            "ocfMatchSpecification": "OCF Security Specification ISO/IEC 30118-2:2018]",
                            "ocfMatchSpecificationURL": "https://standards.iso.org/ittf/PubliclyAvailableStandards/c074239_ISO_IEC_30118-2_2018.zip",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "14.2.2.4-2",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "It is recommended to use Secure Download and Secure Boot methods and that  authentication of a binary’s source as well as verification of its contents be used."
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Security updates shall be timely.",
                            "subCategoryNumber": "5.3.08",
                            "ocfMatchSpecification": "OCF Security Incident Response Plan",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/contact-us/report-an-issue",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "1",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Vulnerabilities are triaged and acted on in a timely manner"
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "The device should verify the authenticity and integrity of software updates.",
                            "subCategoryNumber": "5.3.09",
                            "ocfMatchSpecification": "OCF Security Specification ISO/IEC 30118-2:2018]",
                            "ocfMatchSpecificationURL": "https://standards.iso.org/ittf/PubliclyAvailableStandards/c074239_ISO_IEC_30118-2_2018.zip",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "14.2.2.4-2",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "It is recommended to use Secure Download and Secure Boot methods and that  authentication of a binary’s source as well as verification of its contents be used."
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Where updates are delivered over a network interface, the device shall verify the authenticity and integrity of each update via a trust relationship.",
                            "subCategoryNumber": "5.3.10",
                            "ocfMatchSpecification": "OCF Security Specification ISO/IEC 30118-2:2018]",
                            "ocfMatchSpecificationURL": "https://standards.iso.org/ittf/PubliclyAvailableStandards/c074239_ISO_IEC_30118-2_2018.zip",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "14.2.2.4-2",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "It is recommended to use Secure Download and Secure Boot methods and that  authentication of a binary’s source as well as verification of its contents be used."
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "The manufacturer should inform the user in a recognizable and apparent manner that a security update is required together with information on the risks mitigated by that update.",
                            "subCategoryNumber": "5.3.11",
                            "ocfMatchSpecification": "",
                            "ocfMatchSpecificationURL": "",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "None",
                                    "ocfMatchFlag":"Not Applicable",
                                    "ocfMatchNotes": "This is vendor dependant"
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "The device should notify the user when the application of a software update will disrupt the basic functioning of the device.",
                            "subCategoryNumber": "5.3.12",
                            "ocfMatchSpecification": "",
                            "ocfMatchSpecificationURL": "",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "None",
                                    "ocfMatchFlag":"Not Applicable",
                                    "ocfMatchNotes": "basic functioning clause is device and   vendor dependent. This is user experience.  Protocol level support for this."
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "The manufacturer shall publish, in an accessible way that is clear and transparent to the user, the defined support period.",
                            "subCategoryNumber": "5.3.13",
                            "ocfMatchSpecification": "OCF Certified Product List",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/certified-products",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "1",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "manufacturers should notify OCF that device is End of Life (EoL)."
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "For constrained devices that cannot have their software updated, the rationale for the absence of software updates, the period and method of hardware replacement support and a defined support period should be published by the manufacturer in an accessible way that is clear and transparent to the user.",
                            "subCategoryNumber": "5.3.14",
                            "ocfMatchSpecification": "",
                            "ocfMatchSpecificationURL": "",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "None",
                                    "ocfMatchFlag":"Not Applicable",
                                    "ocfMatchNotes": "This is device and vendor dependent"
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "For constrained devices that cannot have their software updated, the product should be isolable and the hardware replaceable.",
                            "subCategoryNumber": "5.3.15",
                            "ocfMatchSpecification": "",
                            "ocfMatchSpecificationURL": "",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "None",
                                    "ocfMatchFlag":"Not Applicable",
                                    "ocfMatchNotes": "This is device and vendor dependent"
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "The model designation of the consumer IoT device shall be clearly recognizable, either by labelling on the device or via a physical interface.",
                            "subCategoryNumber": "5.3.16",
                            "ocfMatchSpecification": "",
                            "ocfMatchSpecificationURL": "",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "None",
                                    "ocfMatchFlag":"Not Applicable",
                                    "ocfMatchNotes": "Vendor and implementation dependant"
                                }
                            ]
			}
		    ]
		},
                {
                    "categoryName": "Securely store sensitive security parameters",
                    "categoryNumber": "5.4",
                    "subCategories":
		    [
                        {
                            "subCategoryDescription": "Sensitive security parameters in persistent storage shall be stored securely by the device.",
                            "subCategoryNumber": "5.4.1",
                            "ocfMatchSpecification": "OCF Security Specification ISO/IEC 30118-2:2018]",
                            "ocfMatchSpecificationURL": "https://standards.iso.org/ittf/PubliclyAvailableStandards/c074239_ISO_IEC_30118-2_2018.zip",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "14.2.2.2",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Hardware Secure storage is recommended for symmetric and asymmetric keys, access credentials and personal private data."
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Where a hard-coded unique per device identity is used in a device for security purposes, it shall be implemented in such a way that it resists tampering by means such as physical, electrical or software.",
                            "subCategoryNumber": "5.4.2",
                            "ocfMatchSpecification": "OCF Security Specification ISO/IEC 30118-2:2018]",
                            "ocfMatchSpecificationURL": "https://standards.iso.org/ittf/PubliclyAvailableStandards/c074239_ISO_IEC_30118-2_2018.zip",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "7.1.1",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": " Device IDs shall be unique within the scope of operation of the corresponding OCF Security Domain, and should be universally unique."
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Hard-coded critical security parameters in device software source code shall not be used.",
                            "subCategoryNumber": "5.4.3",
                            "ocfMatchSpecification": "",
                            "ocfMatchSpecificationURL": "",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "None",
                                    "ocfMatchFlag":"Not Applicable",
                                    "ocfMatchNotes": "This is vendor implementation specific."
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Any critical security parameters used for integrity and authenticity checks of software updates and for protection of communication with associated services in device software shall be unique per device and shall be produced with a mechanism that reduces the risk of automated attacks against classes of devices.",
                            "subCategoryNumber": "5.4.4",
                            "ocfMatchSpecification": "OCF Security Specification ISO/IEC 30118-2:2018]",
                            "ocfMatchSpecificationURL": "https://standards.iso.org/ittf/PubliclyAvailableStandards/c074239_ISO_IEC_30118-2_2018.zip",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "12",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Describes access control and policy management for both local and network resources"
                                }
                            ]
			}
		    ]
		},
                {
                    "categoryName": "Communicate securely",
                    "categoryNumber": "5.5",
                    "subCategories":
		    [
                        {
                            "subCategoryDescription": "The consumer IoT device shall use best practice cryptography to communicate securely.",
                            "subCategoryNumber": "5.5.1",
                            "ocfMatchSpecification": "OCF Security Specification ISO/IEC 30118-2:2018]",
                            "ocfMatchSpecificationURL": "https://standards.iso.org/ittf/PubliclyAvailableStandards/c074239_ISO_IEC_30118-2_2018.zip",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "11.3",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": " Cipher Suites: All heavily reviewed and compliant with IETF standards.  Aligns with NIST recommendations 800-52 Rev 2."
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "The consumer IoT device should use reviewed or evaluated implementations to deliver network and security functionalities, particularly in the field of cryptography.",
                            "subCategoryNumber": "5.5.2",
                            "ocfMatchSpecification": "OCF Security Specification ISO/IEC 30118-2:2018]",
                            "ocfMatchSpecificationURL": "https://standards.iso.org/ittf/PubliclyAvailableStandards/c074239_ISO_IEC_30118-2_2018.zip",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "11.3",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": " Cipher Suites: All heavily reviewed and compliant with IETF standards.  Aligns with NIST recommendations 800-52 Rev 2."
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Cryptographic algorithms and primitives should be updateable.",
                            "subCategoryNumber": "5.5.3",
                            "ocfMatchSpecification": "OCF Security Specification Draft: CR3275",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/draftspecs/Hollywood/CR%203275%20-%20Device_Software_Update.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "CR 3275",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "This is met by the draft specification requireing software update for devices."
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Access to device functionality via a network interface in the initialized state should only be possible after authentication on that interface.",
                            "subCategoryNumber": "5.5.4",
                            "ocfMatchSpecification": "OCF Security Specification ISO/IEC 30118-2:2018]",
                            "ocfMatchSpecificationURL": "https://standards.iso.org/ittf/PubliclyAvailableStandards/c074239_ISO_IEC_30118-2_2018.zip",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "12",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Describes access control and policy management for both local and network resources"
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Device functionality that allows security-relevant changes in configuration via a network interface shall only be accessible after authentication. The exception is for network service protocols that are relied upon by the device and where the manufacturer cannot guarantee what configuration will be required for the device to operate.",
                            "subCategoryNumber": "5.5.5",
                            "ocfMatchSpecification": "OCF Security Specification ISO/IEC 30118-2:2018]",
                            "ocfMatchSpecificationURL": "https://standards.iso.org/ittf/PubliclyAvailableStandards/c074239_ISO_IEC_30118-2_2018.zip",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "5.3.3",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Prior to operational state, device must be onboarded and configured with either symmetric or asymmetric credentials based on certificates or shared keys  Once operational devices implement role-based and/or subject based access control for each resource they present to the network."
                                },
                                {
                                    "ocfMatchClause": "12",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Access control is enforced over all Resources."
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Critical security parameters should be encrypted in transit, with such encryption appropriate to the properties of the technology, risk and usage.",
                            "subCategoryNumber": "5.5.6",
                            "ocfMatchSpecification": "OCF Security Specification ISO/IEC 30118-2:2018]",
                            "ocfMatchSpecificationURL": "https://standards.iso.org/ittf/PubliclyAvailableStandards/c074239_ISO_IEC_30118-2_2018.zip",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "11.2.1",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Devices shall support DTLS for secured communications as defined in IETF RFC 6347. Devices using TCP shall support TLS v1.2 for secured communications as defined in IETF RFC 5246."
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "The consumer IoT device shall protect the confidentiality of critical security parameters that are communicated via remotely accessible network interfaces.",
                            "subCategoryNumber": "5.5.7",
                            "ocfMatchSpecification": "OCF Security Specification ISO/IEC 30118-2:2018]",
                            "ocfMatchSpecificationURL": "https://standards.iso.org/ittf/PubliclyAvailableStandards/c074239_ISO_IEC_30118-2_2018.zip",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "11.2.1",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Devices shall support DTLS for secured communications as defined in IETF RFC 6347. Devices using TCP shall support TLS v1.2 for secured communications as defined in IETF RFC 5246."
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "The manufacturer shall follow secure management processes for critical security parameters that relate to the device.",
                            "subCategoryNumber": "5.5.8",
                            "ocfMatchSpecification": "OCF Security Specification ISO/IEC 30118-2:2018]",
                            "ocfMatchSpecificationURL": "https://standards.iso.org/ittf/PubliclyAvailableStandards/c074239_ISO_IEC_30118-2_2018.zip",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "14.2.2.2",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Hardware Secure storage is recommended for symmetric and asymmetric keys, access credentials and personal private data."
                                }
                            ]
			}
		    ]
		},
                {
                    "categoryName": "Minimize exposed attack surfaces",
                    "categoryNumber": "5.6",
                    "subCategories":
		    [
                        {
                            "subCategoryDescription": "All unused network and logical interfaces shall be disabled.",
                            "subCategoryNumber": "5.6.1",
                            "ocfMatchSpecification": "",
                            "ocfMatchSpecificationURL": "",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "None",
                                    "ocfMatchFlag":"Not Implemented",
                                    "ocfMatchNotes": "This is not currently met in the OCF specification"
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "In the initialized state, the network interfaces of the device shall minimize the unauthenticated disclosure of security-relevant information.",
                            "subCategoryNumber": "5.6.2",
                            "ocfMatchSpecification": "OCF Security Specification ISO/IEC 30118-2:2018]",
                            "ocfMatchSpecificationURL": "https://standards.iso.org/ittf/PubliclyAvailableStandards/c074239_ISO_IEC_30118-2_2018.zip",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "5.3.3",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Once operational devices implement role-based and/or subject based access control for each resource they present to the network."
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Device hardware should not unnecessarily expose physical interfaces to attack.",
                            "subCategoryNumber": "5.6.3",
                            "ocfMatchSpecification": "",
                            "ocfMatchSpecificationURL": "",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "None",
                                    "ocfMatchFlag":"Not Applicable",
                                    "ocfMatchNotes": "Specific hardware implementations are out of scope for device specification."
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Where a debug interface is physically accessible, it shall be disabled in software.",
                            "subCategoryNumber": "5.6.4",
                            "ocfMatchSpecification": "",
                            "ocfMatchSpecificationURL": "",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "None",
                                    "ocfMatchFlag":"Not Applicable",
                                    "ocfMatchNotes": "Hardware specific"
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "The manufacturer should only enable software services that are used or required for the intended use or operation of the device.",
                            "subCategoryNumber": "5.6.5",
                            "ocfMatchSpecification": "",
                            "ocfMatchSpecificationURL": "",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "None",
                                    "ocfMatchFlag":"Not Applicable",
                                    "ocfMatchNotes": "Out of scope for device specification."
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Code should be minimized to the functionality necessary for the service/device to operate.",
                            "subCategoryNumber": "5.6.6",
                            "ocfMatchSpecification": "",
                            "ocfMatchSpecificationURL": "",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "None",
                                    "ocfMatchFlag":"Not Applicable",
                                    "ocfMatchNotes": "Vendor Dependant:  Note: Reference implementation IoTitivy implements this."
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Software should run with least necessary privileges, taking account of both security and functionality.",
                            "subCategoryNumber": "5.6.7",
                            "ocfMatchSpecification": "",
                            "ocfMatchSpecificationURL": "",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "None",
                                    "ocfMatchFlag":"Not Applicable",
                                    "ocfMatchNotes": "Vendor Dependant"
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "The device should include a hardware-level access control mechanism for memory.",
                            "subCategoryNumber": "5.6.8",
                            "ocfMatchSpecification": "",
                            "ocfMatchSpecificationURL": "",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "None",
                                    "ocfMatchFlag":"Not Applicable",
                                    "ocfMatchNotes": "Hardware implementation dependant"
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "The manufacturer should follow secure development processes for software deployed on the device.",
                            "subCategoryNumber": "5.6.9",
                            "ocfMatchSpecification": "",
                            "ocfMatchSpecificationURL": "",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "None",
                                    "ocfMatchFlag":"Not Applicable",
                                    "ocfMatchNotes": "Vendor Specific"
                                }
                            ]
			}
		    ]
		},
                {
                    "categoryName": "Ensure software integrity",
                    "categoryNumber": "5.7",
                    "subCategories":
		    [
                        {
                            "subCategoryDescription": "The consumer IoT device should verify its software using secure boot mechanisms.",
                            "subCategoryNumber": "5.7.1",
                            "ocfMatchSpecification": "OCF Security Specification ISO/IEC 30118-2:2018]",
                            "ocfMatchSpecificationURL": "https://standards.iso.org/ittf/PubliclyAvailableStandards/c074239_ISO_IEC_30118-2_2018.zip",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "14.3",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "When performing a secure boot, it is required that the integrity of each boot loader is verified before executing the boot loader stage. As mentioned, while the signature and verification key for the lowest level bootloader is typically stored in tamper-proof memory, the signature and verification key for higher levels" 
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "If an unauthorized change is detected to the software, the device should alert the user and/or administrator to the issue and should not connect to wider networks than those necessary to perform the alerting function.",
                            "subCategoryNumber": "5.7.2",
                            "ocfMatchSpecification": "",
                            "ocfMatchSpecificationURL": "",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "None",
                                    "ocfMatchFlag":"Not Implemented",
                                    "ocfMatchNotes": "This will be covered in update to auditable events."
                                }
                            ]
			}
		    ]
		},
                {
                    "categoryName": "Ensure that personal data is secure",
                    "categoryNumber": "5.8",
                    "subCategories":
		    [
                        {
                            "subCategoryDescription": "The confidentiality of personal data transiting between a device and a service, especially associated services, should be protected, with best practice cryptography.",
                            "subCategoryNumber": "5.8.1",
                            "ocfMatchSpecification": "OCF Security Specification ISO/IEC 30118-2:2018]",
                            "ocfMatchSpecificationURL": "https://standards.iso.org/ittf/PubliclyAvailableStandards/c074239_ISO_IEC_30118-2_2018.zip",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "11.3",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Cipher Suites: All heavily reviewed and IETF approved or greater."
                                },
                                {
                                    "ocfMatchClause": "11.2.1",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Devices shall support DTLS for secured communications as defined in IETF RFC 6347. DTLS supplies replay detection as per RFC6347 4.1.2.6"
                                },
                                {
                                    "ocfMatchClause": "7.2",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Device connection with the OCF Cloud.  The Device should establish the TLS connection using the certificate based credential."
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "The confidentiality of sensitive personal data communicated between the device and associated services shall be protected, with cryptography appropriate to the properties of the technology and usage.",
                            "subCategoryNumber": "5.8.2",
                            "ocfMatchSpecification": "OCF Security Specification ISO/IEC 30118-2:2018]",
                            "ocfMatchSpecificationURL": "https://standards.iso.org/ittf/PubliclyAvailableStandards/c074239_ISO_IEC_30118-2_2018.zip",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "11.2.1",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": " Devices shall support DTLS for secured communications as defined in IETF RFC 6347. DTLS supplies replay detection as per RFC6347 4.1.2.6"
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "All external sensing capabilities of the device shall be documented in an accessible way that is clear and transparent for the user.",
                            "subCategoryNumber": "5.8.3",
                            "ocfMatchSpecification": "",
                            "ocfMatchSpecificationURL": "",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "None",
                                    "ocfMatchFlag":"Not Applicable",
                                    "ocfMatchNotes": "Out of scope, vendor and device dependent"
                                }
                            ]
			}
		    ]
		},
                {
                    "categoryName": "Make systems resilient to outages",
                    "categoryNumber": "5.9",
                    "subCategories":
		    [
                        {
                            "subCategoryDescription": "Resilience should be built in to consumer IoT devices and services, taking into account the possibility of outages of data networks and power.",
                            "subCategoryNumber": "5.9.1",
                            "ocfMatchSpecification": "OCF Security Specification ISO/IEC 30118-2:2018]",
                            "ocfMatchSpecificationURL": "https://standards.iso.org/ittf/PubliclyAvailableStandards/c074239_ISO_IEC_30118-2_2018.zip",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "5.1",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Shows the layers of connectivity and access control all remain proximally functional by default."
                                },
                                {
                                    "ocfMatchClause": "14.2.2.2",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "SVRs (Secure Virtual Resource) are stored in non-volatile storage."
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Consumer IoT devices should remain operating and locally functional in the case of a loss of network access and should recover cleanly in the case of restoration of a loss of power.",
                            "subCategoryNumber": "5.9.2",
                            "ocfMatchSpecification": "OCF Security Specification ISO/IEC 30118-2:2018]",
                            "ocfMatchSpecificationURL": "https://standards.iso.org/ittf/PubliclyAvailableStandards/c074239_ISO_IEC_30118-2_2018.zip",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "5.1",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Shows the layers of connectivity and access control all remain proximally functional by default."
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "The consumer IoT device should connect to networks in an expected, operational and stable state and in an orderly fashion, taking the capability of the infrastructure into consideration.",
                            "subCategoryNumber": "5.9.3",
                            "ocfMatchSpecification": "OCF Security Specification ISO/IEC 30118-2:2018]",
                            "ocfMatchSpecificationURL": "https://standards.iso.org/ittf/PubliclyAvailableStandards/c074239_ISO_IEC_30118-2_2018.zip",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "5.1",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Describes the purpose of the onboarding tool (OBT) in establishing ownership and credentials."
                                }
                            ]
			}
		    ]
		},
                {
                    "categoryName": "Examine system telemetry data",
                    "categoryNumber": "5.10",
                    "subCategories":
		    [
                        {
                            "subCategoryDescription": "",
                            "subCategoryNumber": "5.10.1",
                            "ocfMatchSpecification": "",
                            "ocfMatchSpecificationURL": "",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "None",
                                    "ocfMatchFlag":"Not Applicable",
                                    "ocfMatchNotes": "Out of scope for device specification"
                                }
                            ]
			}
		    ]
		},
                {
                    "categoryName": "Make it easy for users to delete user data",
                    "categoryNumber": "5.11",
                    "subCategories":
		    [
                        {
                            "subCategoryDescription": "The user shall be provided with functionality such that user data can be erased from the device in a simple manner.",
                            "subCategoryNumber": "5.11.1",
                            "ocfMatchSpecification": "OCF Security Specification ISO/IEC 30118-2:2018]",
                            "ocfMatchSpecificationURL": "https://standards.iso.org/ittf/PubliclyAvailableStandards/c074239_ISO_IEC_30118-2_2018.zip",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "8.2",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Device Onboarding-Reset State Definition The Platform manufacturer should provide a physical mechanism (e.g. button) that forces Platform reset. All Devices hosted on the same Platform transition their Device states to RESET when the Platform reset is asserted."
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "The consumer should be provided with functionality on the device such that personal data can be removed from associated services in a simple manner.",
                            "subCategoryNumber": "5.11.2",
                            "ocfMatchSpecification": "OCF Security Specification ISO/IEC 30118-2:2018]",
                            "ocfMatchSpecificationURL": "https://standards.iso.org/ittf/PubliclyAvailableStandards/c074239_ISO_IEC_30118-2_2018.zip",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "8.2",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Device Onboarding-Reset State Definition The Platform manufacturer should provide a physical mechanism (e.g. button) that forces Platform reset. All Devices hosted on the same Platform transition their Device states to RESET when the Platform reset is asserted."
                                },
                                {
                                    "ocfMatchClause": "8.2",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Defines how resources on the device are returned to the manufacturer's default values."
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Users should be given clear instructions on how to delete their personal data.",
                            "subCategoryNumber": "5.11.3",
                            "ocfMatchSpecification": "",
                            "ocfMatchSpecificationURL": "",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "None",
                                    "ocfMatchFlag":"Not Applicable",
                                    "ocfMatchNotes": "Device instructions are vendor dependent"
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Users should be provided with clear confirmation that personal data has been deleted from services, devices and applications.",
                            "subCategoryNumber": "5.11.4",
                            "ocfMatchSpecification": "",
                            "ocfMatchSpecificationURL": "",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "None",
                                    "ocfMatchFlag":"Not Applicable",
                                    "ocfMatchNotes": "Confirmation of deletion of data is UI and vendor dependent"
                                }
                            ]
			}
		    ]
		},
                {
                    "categoryName": "Make installation and maintenance of devices easy",
                    "categoryNumber": "5.12",
                    "subCategories":
		    [
                        {
                            "subCategoryDescription": "Installation and maintenance of consumer IoT should involve minimal decisions by the user and should follow security best practice on usability.",
                            "subCategoryNumber": "5.12.1",
                            "ocfMatchSpecification": "OCF Security Specification ISO/IEC 30118-2:2018]",
                            "ocfMatchSpecificationURL": "https://standards.iso.org/ittf/PubliclyAvailableStandards/c074239_ISO_IEC_30118-2_2018.zip",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "3.1.31",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Includes the WiFi Easy Setup Resources, and the other transport-level onboarding (e.g. Bluetooth) are defined in other specification documents for OCF"
                                },
                                {
                                    "ocfMatchClause": "5.3",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "For non-transport onboarding, the process is specified in great detail as far as establishment of trust, authentication, verification, authorization, local credential issuance, etc."
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "The manufacturer should provide users with guidance on how to securely set up their device.",
                            "subCategoryNumber": "5.12.2",
                            "ocfMatchSpecification": "OCF Security Specification ISO/IEC 30118-2:2018]",
                            "ocfMatchSpecificationURL": "https://standards.iso.org/ittf/PubliclyAvailableStandards/c074239_ISO_IEC_30118-2_2018.zip",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "5.3.1",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Assuming ownership of device.  OCF does not allow for setting up insecure devices."
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "The manufacturer should provide users with guidance on how to check whether their device is securely set up.",
                            "subCategoryNumber": "5.12.3",
                            "ocfMatchSpecification": "OCF Security Specification ISO/IEC 30118-2:2018]",
                            "ocfMatchSpecificationURL": "https://standards.iso.org/ittf/PubliclyAvailableStandards/c074239_ISO_IEC_30118-2_2018.zip",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "5.3.1",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Assuming ownership of device.  OCF does not allow for setting up insecure devices."
                                }
                            ]
			}
		    ]
		},
                {
                    "categoryName": "Validate input data",
                    "categoryNumber": "5.13",
                    "subCategories":
		    [
                        {
                            "subCategoryDescription": "The consumer IoT device software shall validate data input via user interfaces or transferred via Application Programming Interfaces (APIs) or between networks in services and devices.",
                            "subCategoryNumber": "5.13.1",
                            "ocfMatchSpecification": "OCF Core Specification ISO/IEC 30118-1:2018]",
                            "ocfMatchSpecificationURL": "https://standards.iso.org/ittf/PubliclyAvailableStandards/c074239_ISO_IEC_30118-1_2018.zip",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "4.3",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "All data inputs are validated against JSON Schemas"
                                }
                            ]
			}
		    ]
		},
                {
                    "categoryName": "Data protection provisions for consumer IoT",
                    "categoryNumber": "6",
                    "subCategories":
		    [
                        {
                            "subCategoryDescription": "The manufacturer shall provide consumers with clear and transparent information about what personal data is processed, how it is being used, by whom, and for what purposes, for each device and service. This also applies to third parties that can be involved, including advertisers.",
                            "subCategoryNumber": "6.1",
                            "ocfMatchSpecification": "",
                            "ocfMatchSpecificationURL": "",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "None",
                                    "ocfMatchFlag":"Not Applicable",
                                    "ocfMatchNotes": "Personal Data policies are vendor specific"
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Where personal data is processed on the basis of consumers' consent, this consent shall be obtained in a valid way.",
                            "subCategoryNumber": "6.2",
                            "ocfMatchSpecification": "",
                            "ocfMatchSpecificationURL": "",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "None",
                                    "ocfMatchFlag":"Not Applicable",
                                    "ocfMatchNotes": "Personal Data policies are vendor specific"
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Consumers who gave consent for the processing of their personal data shall have the capability to withdraw it at any time.",
                            "subCategoryNumber": "6.3",
                            "ocfMatchSpecification": "",
                            "ocfMatchSpecificationURL": "",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "None",
                                    "ocfMatchFlag":"Not Applicable",
                                    "ocfMatchNotes": "Personal Data policies are vendor specific"
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "If telemetry data is collected from consumer IoT devices and services, the processing of personal data should be kept to the minimum necessary for the intended functionality.",
                            "subCategoryNumber": "6.4",
                            "ocfMatchSpecification": "",
                            "ocfMatchSpecificationURL": "",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "None",
                                    "ocfMatchFlag":"Not Applicable",
                                    "ocfMatchNotes": "Personal Data policies are vendor specific"
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "If telemetry data is collected from consumer IoT devices and services, consumers shall be provided with information on what telemetry data is collected, how it is being used, by whom, and for what purposes.",
                            "subCategoryNumber": "6.5",
                            "ocfMatchSpecification": "",
                            "ocfMatchSpecificationURL": "",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "None",
                                    "ocfMatchFlag":"Not Applicable",
                                    "ocfMatchNotes": "Telemetry Data policies are vendor specific"
                                }
                            ]
			}
		    ]
		}
	  ]
	},
        {
            "baselineOrg": "IASME",
            "baselineName": "Requirements",
	    "baselineURL":"IASME",
	    "baselineGraph":"True",
            "baselineCategories":
	    [
                {
                    "categoryName": "About The Device",
                    "categoryNumber": "C2",
                    "subCategories":
		    [
                        {
                            "subCategoryDescription": "Clear instructions to customers make it more likely that your device will be setup correctly which can improve its security. ",
                            "subCategoryNumber": "C2.4",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://standards.iso.org/ittf/PubliclyAvailableStandards/c074239_ISO_IEC_30118-2_2018.zip",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "None",
                                    "ocfMatchFlag":"Not Applicable",
                                    "ocfMatchNotes": "Out of Scope for device centric specification"
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Do you provide guidance for users to check whether their device has been set up in a secure way? ",
                            "subCategoryNumber": "C2.5",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://standards.iso.org/ittf/PubliclyAvailableStandards/c074239_ISO_IEC_30118-2_2018.zip",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "None",
                                    "ocfMatchFlag":"Not Applicable",
                                    "ocfMatchNotes": "Onboarding process establishes credetials and access control for every client and server device.  Guidance is manufacturer dependant."
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Do you make it simple for users to identify the model of the product, either through a label on the device or via a hardware interface (after authentication)?",
                            "subCategoryNumber": "C2.6",
                            "ocfMatchSpecification": "OCF Resource Type Secification Specification",
                            "ocfMatchSpecificationURL": "https://standards.iso.org/ittf/PubliclyAvailableStandards/c074239_ISO_IEC_30118-2_2018.zip",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "5.4.1",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "All resources are identified by type and name and are available during discovery"
                                }
                            ]
			}
	           ]
		},
                {
                    "categoryName": "Passwords and credentials",
                    "categoryNumber": "C3",
                    "subCategories":
		    [
                        {
                            "subCategoryDescription": "Do you ensure that all device passwords are unique-per device or user defined and that no default passwords are in use?",
                            "subCategoryNumber": "C3.1",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "5.3.3",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": ""
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "If you provide a unique per-device password, do you ensure that the method of generating this password is not predictable so that the device is not at risk of automated attacks? Explain how you achieve this.",
                            "subCategoryNumber": "C3.2",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "7.3.2",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "It is recommended that the entropy of the Random PIN be enough to withstand an online brute-force attack, 40 bits or more.  This is only used for transferring ownership, afterward replaced with locally generated credential."
                                },
                                {
                                    "ocfMatchClause": "7.3.5",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "It is recommended that the entropy of the Random PIN be enough to withstand an online brute-force attack, 40 bits or more.  This is only used for transferring ownership, afterward replaced with locally generated credential."
                                },
                                {
                                    "ocfMatchClause": "11.3.4",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Operational Credentials: Shared Key Credential Calculation: Length of symmetric keys 32 bits.   Assymetric 128-256 bit depending on the ciphersuite."
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Does your device / service use any hard-coded passwords or credentials, including those used from communications or verifying security updates?",
                            "subCategoryNumber": "C3.3",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "5.3.3",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Prior to operational state, device must be onboarded and configured with either symmetric or asymmetric credentials based on certificates or shared keys  Once operational devices implement role-based and/or subject based access control for each resource they present to the network. "
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Do you provide a simple and clear method for the user to change their password or security credentials?",
                            "subCategoryNumber": "C3.4",
                            "ocfMatchSpecification": "OCF Onboarding Tool Specification",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Onboarding_Tool_Specification.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "5.4",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Describes methods to provision credentials on a device."
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Are security credentials for your device / service stored using industry-standard secure methods? Please describe the methods used.",
                            "subCategoryNumber": "C3.5",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "14.2.2.2",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Hardware Secure storage is recommended for symmetric and asymmetric keys, access credentials and personal private data."
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "How do you ensure that if the device is tampered with or has an error it still maintains the security of stored passwords or credentials? ",
                            "subCategoryNumber": "C3.6",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "8.6",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Device transitions to a self-recovery state if certain conditions of the device are corrupt"
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Do you authenticate users using best-practice encryption which is suitable for the type of device and its usage, and is your authentication protected from brute-force attacks? Describe how you achieve this",
                            "subCategoryNumber": "C3.7",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "11.3",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Cipher Suites: All heavily reviewed and compliant with IETF standards.  Aligns with NIST recommendations 800-52 Rev 2."
                                }
                            ]
			}
		    ]
		},
                {
                    "categoryName": "Vulnerabilities and anomalies",
                    "categoryNumber": "C4",
                    "subCategories":
		    [
                        {
                            "subCategoryDescription": "Do you have a vulnerability disclosure policy that covers the device and that is publicly available, ideally on your website?  Please provide details of your policy and how it is made available.",
                            "subCategoryNumber": "C4.1",
                            "ocfMatchSpecification": "OCF Incident Response Plan",
                            "ocfMatchSpecificationURL": "",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "1.4",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Single point of contact and guidelines for member companies to report security issues, including vulnerability reporting. Vulnerabilities are triaged and acted on in a timely manner  Vulnerbilities reports through: Contact: https://openconnectivity.org/contact-us/report-an-issue "
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Do you have a process to discover and address vulnerabilities in your device / service during its lifetime? ",
                            "subCategoryNumber": "C4.2",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://standards.iso.org/ittf/PubliclyAvailableStandards/c074239_ISO_IEC_30118-2_2018.zip",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "14.2.2.4-7",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Device vendor expected to support security updates to the software, operating system, drivers, networking, firmware and hardware of the device. "
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "How quickly do you act on any vulnerabilities that are discovered in your device / service? Please provide details and recent examples.",
                            "subCategoryNumber": "C4.3",
                            "ocfMatchSpecification": "OCF Incident Response Plan",
                            "ocfMatchSpecificationURL": "https://standards.iso.org/ittf/PubliclyAvailableStandards/c074239_ISO_IEC_30118-2_2018.zip",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "2",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Incidents are immediately assigned to the Security Oversight Working Group.  Urgency on resolving the issue is based on the severity of the incident."
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Do you report vulnerabilities to customers? Describe how you do this.",
                            "subCategoryNumber": "C4.4",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://standards.iso.org/ittf/PubliclyAvailableStandards/c074239_ISO_IEC_30118-2_2018.zip",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "14.2.2.4-7",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Device vendor expected to support security updates to the software, operating system, drivers, networking, firmware and hardware of the device."
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Do you report vulnerabilities to other organisations? Describe how you do this.",
                            "subCategoryNumber": "C4.5",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://standards.iso.org/ittf/PubliclyAvailableStandards/c074239_ISO_IEC_30118-2_2018.zip",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "None",
                                    "ocfMatchFlag":"Not Applicable",
                                    "ocfMatchNotes": "OCF is the organisation"
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "If Yes to C4.5, to which organisations do you report them?",
                            "subCategoryNumber": "C4.6",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://standards.iso.org/ittf/PubliclyAvailableStandards/c074239_ISO_IEC_30118-2_2018.zip",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "None",
                                    "ocfMatchFlag":"Not Applicable",
                                    "ocfMatchNotes": "OCF is the organisation"
                                }
                            ]
			}
		    ]
		},
                {
                    "categoryName": "Software",
                    "categoryNumber": "C5",
                    "subCategories":
		    [
                        {
                            "subCategoryDescription": "Do you provide security updates to software and firmware on your device via an update mechanism during its lifespan? Please provide details.",
                            "subCategoryNumber": "C5.1",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://standards.iso.org/ittf/PubliclyAvailableStandards/c074239_ISO_IEC_30118-2_2018.zip",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "14.5.4",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "The software of a Device shall be updatable."
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "If Yes to C5.1, does your device verify that the updates it receives are from an authorised and trusted source? ",
                            "subCategoryNumber": "C5.2",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://standards.iso.org/ittf/PubliclyAvailableStandards/c074239_ISO_IEC_30118-2_2018.zip",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "14.2.2.4.2",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "It is recommended to use Secure Download and Secure Boot methods and that  authentication of a binary’s source as well as verification of its contents be used."
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "If Yes to C5.1, are the updates transferred to the device in a secure manner using best practice encryption? Provide details of how you achieve this.",
                            "subCategoryNumber": "C5.3",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://standards.iso.org/ittf/PubliclyAvailableStandards/c074239_ISO_IEC_30118-2_2018.zip",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "14.3.1",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Clause 14.3.1:  Describes how to securely boot, inlcuding varification of software modules."
                                },
                                {
                                    "ocfMatchClause": "14.5",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Clasue 14.5.1:  describes the software update process.  The combination of these two clauses describes how updates can be done in a secure manner."
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "If Yes to C5.1, do you ensure your device uses a unique per-device key or other unique security parameter to verify the integrity of security updates? How do you achieve this?",
                            "subCategoryNumber": "C5.4",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://standards.iso.org/ittf/PubliclyAvailableStandards/c074239_ISO_IEC_30118-2_2018.zip",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "12",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Describes access control and policy management for both local and network resources"
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "If Yes to C5.1, do you use an automatic method to apply software updates where the device regularly checks if new updates are available?",
                            "subCategoryNumber": "C5.5",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://standards.iso.org/ittf/PubliclyAvailableStandards/c074239_ISO_IEC_30118-2_2018.zip",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "14.5.2.1",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Once the Device has determined if an newer software version is available, it sets the Initiate Software Availability Check bit in the '/oic/sec/pstat.cm' Property to 1 (TRUE), indicating that new software is available.  Update notifications are not currently implemented."
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "If yes to C5.1, if  your device uses automatic updates, is this turned on by default and can the user change the update settings?",
                            "subCategoryNumber": "C5.6",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://standards.iso.org/ittf/PubliclyAvailableStandards/c074239_ISO_IEC_30118-2_2018.zip",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "14.5.2.2",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Once the Device has determined if an newer software version is available, it sets the Initiate Software Availability Check bit in the '/oic/sec/pstat.cm' Property to 1 (TRUE), indicating that new software is available.  Update notifications are not currently implemented."
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "If yes to C5.1, if  your device uses automatic updates, is this turned on by default and can the user change the update settings?",
                            "subCategoryNumber": "C5.7",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://standards.iso.org/ittf/PubliclyAvailableStandards/c074239_ISO_IEC_30118-2_2018.zip",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "14.5.4",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "A client with the correct authorization can initiate or query for a software update process by setting a software update bit to true or false.  This software update bit enables or disables the update process. "
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "If yes to C5.1, are your updates simple to apply for someone with limited technical knowledge? Explain how you achieve this",
                            "subCategoryNumber": "C5.8",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://standards.iso.org/ittf/PubliclyAvailableStandards/c074239_ISO_IEC_30118-2_2018.zip",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "None",
                                    "ocfMatchFlag":"Not Applicable",
                                    "ocfMatchNotes": "Manufacturer Dependant"
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "If yes to C5.1, do you follow secure development processes for all software and updates deployed on the device? How do you do this?",
                            "subCategoryNumber": "C5.9",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://standards.iso.org/ittf/PubliclyAvailableStandards/c074239_ISO_IEC_30118-2_2018.zip",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "OCF Certification",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "The open source implementation IoTivity must pass certification tests.  This includes hundreds of checks for proper security alignment."
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "If yes to C5.1, if the core functions of your device will be affected by an update, does your device notify the user about this when performing an update? ",
                            "subCategoryNumber": "C5.10",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://standards.iso.org/ittf/PubliclyAvailableStandards/c074239_ISO_IEC_30118-2_2018.zip",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "None",
                                    "ocfMatchFlag":"Not Applicable",
                                    "ocfMatchNotes": "Manufacturer Dependant"
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "If Yes to C5.1, what is the time period between finding a vulnerability and sending out a software update? What is the reason for this time period?",
                            "subCategoryNumber": "C5.11",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://standards.iso.org/ittf/PubliclyAvailableStandards/c074239_ISO_IEC_30118-2_2018.zip",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "None",
                                    "ocfMatchFlag":"Not Applicable",
                                    "ocfMatchNotes": "Manufacturer Dependant"
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "If No to C5.1, is this because the nature of your device means that it is not able to be updated?",
                            "subCategoryNumber": "C5.12",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://standards.iso.org/ittf/PubliclyAvailableStandards/c074239_ISO_IEC_30118-2_2018.zip",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "None",
                                    "ocfMatchFlag":"Not Applicable",
                                    "ocfMatchNotes": "Manufacturer Dependant"
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "If No to C5.1, is the hardware easy to disconnect from the network and simple to replace by a person with a limited technical background?",
                            "subCategoryNumber": "C5.13",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://standards.iso.org/ittf/PubliclyAvailableStandards/c074239_ISO_IEC_30118-2_2018.zip",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "None",
                                    "ocfMatchFlag":"Not Applicable",
                                    "ocfMatchNotes": "Out of scope:  OCF is a session based protocol"
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "If No to C5.1, do you provide the user the reason for the absence of software updates together with details of the period and method of hardware replacement support?",
                            "subCategoryNumber": "C5.14",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://standards.iso.org/ittf/PubliclyAvailableStandards/c074239_ISO_IEC_30118-2_2018.zip",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "None",
                                    "ocfMatchFlag":"Not Applicable",
                                    "ocfMatchNotes": "Out of scope:  OCF is a session based protocol"
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Do you publish in a clear and transparent manner details of the defined support period for your device? How do you achieve this?",
                            "subCategoryNumber": "C5.15",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://standards.iso.org/ittf/PubliclyAvailableStandards/c074239_ISO_IEC_30118-2_2018.zip",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "OCF Certified Product List",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "https://openconnectivity.org/certified-products/"
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Do you ensure that software on your device is genuine? Explain how you achieve this.",
                            "subCategoryNumber": "C5.16",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://standards.iso.org/ittf/PubliclyAvailableStandards/c074239_ISO_IEC_30118-2_2018.zip",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "14.3",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "When performing a secure boot, it is required that the integrity of each boot loader is verified before executing the boot loader stage. As mentioned, while the signature and verification key for the lowest level bootloader is typically stored in tamper-proof memory, the signature and verification key for higher levels "
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Do you alert customers if the software on their devices has been changed and is not genuine and limit network access to only that required to issue the alert?",
                            "subCategoryNumber": "C5.17",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://standards.iso.org/ittf/PubliclyAvailableStandards/c074239_ISO_IEC_30118-2_2018.zip",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "14.5.3",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Process where device validates the software version against a trusted source."
                                }
                            ]
			}
		    ]
		},
                {
                    "categoryName": "Secure configuration",
                    "categoryNumber": "C6",
                    "subCategories":
		    [
                        {
                            "subCategoryDescription": "Have you ensured that only the minimal, necessary physical and logical data access methods are enabled on the device / service? Please detail how you have achieved this.",
                            "subCategoryNumber": "C6.1",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://standards.iso.org/ittf/PubliclyAvailableStandards/c074239_ISO_IEC_30118-2_2018.zip",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "14.2.4",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Platform implementations should only expose information, network interfaces, ports and other functions that are necessary for the correct functioning of the Platform. It is also strongly recommended that Vendors configure a Platform to expose only a fixed set of explicitly documented open network ports and/or port ranges."
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Do you ensure that the network interfaces of the device only give out minimal and necessary information about device configuration and software/firmware versions to unauthenticated users? How do you achieve this?",
                            "subCategoryNumber": "C6.2",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://standards.iso.org/ittf/PubliclyAvailableStandards/c074239_ISO_IEC_30118-2_2018.zip",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "5.3.3",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Once operational devices implement role-based and/or subject based access control for each resource they present to the network."
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Are any debug interfaces on the device disabled by default?",
                            "subCategoryNumber": "C6.3",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://standards.iso.org/ittf/PubliclyAvailableStandards/c074239_ISO_IEC_30118-2_2018.zip",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "14.2.2.4",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Device vendor has not implemented test or debug interfaces on the Device which are operable  or which can be enabled which might present an attack vector"
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Do you have to authenticate with the device before it will give you access to functionality such as configuration and security settings? How do you achieve this? ",
                            "subCategoryNumber": "C6.4",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://standards.iso.org/ittf/PubliclyAvailableStandards/c074239_ISO_IEC_30118-2_2018.zip",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "12",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Describes access control and policy management for both local and network resources"
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Do you ensure that only necessary software functionality is enabled in your device / service? ",
                            "subCategoryNumber": "C6.5",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://standards.iso.org/ittf/PubliclyAvailableStandards/c074239_ISO_IEC_30118-2_2018.zip",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "5.3.3",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Prior to operational state, device must be onboarded and configured with either symmetric or asymmetric credentials based on certificates or shared keys  Once operational devices implement role-based and/or subject based access control for each resource they present to the network."
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Does your device / service assist the user to disable any unused or unnecessary functionality on an ongoing basis? How is this achieved?",
                            "subCategoryNumber": "C6.6",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://standards.iso.org/ittf/PubliclyAvailableStandards/c074239_ISO_IEC_30118-2_2018.zip",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "None",
                                    "ocfMatchFlag":"Not Applicable",
                                    "ocfMatchNotes": "Prior to operational state, device must be onboarded and configured with either symmetric or asymmetric credentials based on certificates or shared keys  Once operational devices implement role-based and/or subject based access control for each resource they present to the network."
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Do you ensure that all software code runs with the minimal necessary privileges and functionality required to operate the device? How do you achieve this?",
                            "subCategoryNumber": "C6.7",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://standards.iso.org/ittf/PubliclyAvailableStandards/c074239_ISO_IEC_30118-2_2018.zip",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "None",
                                    "ocfMatchFlag":"Not Implemented",
                                    "ocfMatchNotes": "Note:  The specificaton does not denote privilege for the software stack"
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Does your device include hardware level access control for memory? How do you achieve this?",
                            "subCategoryNumber": "C6.8",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://standards.iso.org/ittf/PubliclyAvailableStandards/c074239_ISO_IEC_30118-2_2018.zip",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "None",
                                    "ocfMatchFlag":"Not Applicable",
                                    "ocfMatchNotes": "Implementation Specific"
                                }
                            ]
			}
		    ]
		},
                {
                    "categoryName": "Communications",
                    "categoryNumber": "C7",
                    "subCategories":
		    [
                        {
                            "subCategoryDescription": "Does your device / service communicate sensitive data (such as personal information or usage data) across the internet or local network?",
                            "subCategoryNumber": "C7.1",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://standards.iso.org/ittf/PubliclyAvailableStandards/c074239_ISO_IEC_30118-2_2018.zip",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "None",
                                    "ocfMatchFlag":"Not Applicable",
                                    "ocfMatchNotes": "This is out of scope for a device specification."
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "If Yes to C7.1, is this through an encrypted communication method which has been independently reviewed? Which method do you use?",
                            "subCategoryNumber": "C7.2",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://standards.iso.org/ittf/PubliclyAvailableStandards/c074239_ISO_IEC_30118-2_2018.zip",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "11.3",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Cipher Suites: All heavily reviewed and IETF approved or greater."
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Can the method of encryption used by your device be updated during the lifetime of the device to ensure it stays secure? How do you achieve this?",
                            "subCategoryNumber": "C7.3",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://standards.iso.org/ittf/PubliclyAvailableStandards/c074239_ISO_IEC_30118-2_2018.zip",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "14.5.4",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Cryptography can be uopdated via firmware update."
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Do you encrypt critical security parameters such as passwords and keys when they are transmitted over your devices network interface?",
                            "subCategoryNumber": "C7.4",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://standards.iso.org/ittf/PubliclyAvailableStandards/c074239_ISO_IEC_30118-2_2018.zip",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "11.2.1",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Devices shall support DTLS for secured communications as defined in IETF RFC 6347. Devices using TCP shall support TLS v1.2 for secured communications as defined in IETF RFC 5246."
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Do you follow secure management processes for critical security parameters such as passwords and keys that relate to your devices? How do you achieve this?",
                            "subCategoryNumber": "C7.5",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://standards.iso.org/ittf/PubliclyAvailableStandards/c074239_ISO_IEC_30118-2_2018.zip",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "14.2.2.2",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Hardware Secure storage is recommended for symmetric and asymmetric keys, access credentials and personal private data."
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Do you securely remotely monitor your device/ service for unusual activity and take actions to investigate such instances? How do you achieve this?",
                            "subCategoryNumber": "C7.6",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://standards.iso.org/ittf/PubliclyAvailableStandards/c074239_ISO_IEC_30118-2_2018.zip",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "5.7",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "An OCF Platform can generate various kinds of Auditable Events. These Auditable Events can be used for log analysis or for real-time understanding of a system condition. "
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "If Yes to C7.6, how do you ensure only minimal and necessary personal data is collected or stored during such monitoring?",
                            "subCategoryNumber": "C7.7",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://standards.iso.org/ittf/PubliclyAvailableStandards/c074239_ISO_IEC_30118-2_2018.zip",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "None",
                                    "ocfMatchFlag":"Not Applicable",
                                    "ocfMatchNotes": "Monitoring is not part of a device centric specification"
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "If Yes to C7.6, do you make it clear to customers what monitoring information is collected and why it is needed?",
                            "subCategoryNumber": "C7.8",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://standards.iso.org/ittf/PubliclyAvailableStandards/c074239_ISO_IEC_30118-2_2018.zip",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "None",
                                    "ocfMatchFlag":"Not Applicable",
                                    "ocfMatchNotes": "Monitoring is not part of a device centric specification"
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Does your device / service validate the data it receives and highlight to the user any data which is invalid? How is this achieved?",
                            "subCategoryNumber": "C7.9",
                            "ocfMatchSpecification": "OCF Core Specification",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Core_Specification.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "4.3",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "All data inputs are validated against JSON schemas"
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Does your device / service still provide basic functions in a network outage or communication failure?",
                            "subCategoryNumber": "C7.10",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://standards.iso.org/ittf/PubliclyAvailableStandards/c074239_ISO_IEC_30118-2_2018.zip",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "5.1",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Clause 5.1: Shows the layers of connectivity and access control all remain proximally functional by default."
                                },
                                {
                                    "ocfMatchClause": "14.2.2.2",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Clause 14.2.2.2:  SVRs (Secure Virtual Resource) are stored in non-volatile storage"
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Does your device return to a normal, usable state when network access or power is restored is restored?",
                            "subCategoryNumber": "C7.11",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://standards.iso.org/ittf/PubliclyAvailableStandards/c074239_ISO_IEC_30118-2_2018.zip",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "5.1",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Shows the layers of connectivity and access control all remain proximally functional by default"
                                }
                            ]
			}
		    ]
		},
                {
                    "categoryName": "Usage of data",
                    "categoryNumber": "C8",
                    "subCategories":
		    [
                        {
                            "subCategoryDescription": "Does your device, your service or any suppliers you have engaged store or process any personal data?",
                            "subCategoryNumber": "C8.1",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://standards.iso.org/ittf/PubliclyAvailableStandards/c074239_ISO_IEC_30118-2_2018.zip",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "None",
                                    "ocfMatchFlag":"Not Applicable",
                                    "ocfMatchNotes": " OCF this data data is not stored on the device."
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "If Yes to C8.1, do you provide customers with clear and transparent information about how their data is being used, by whom, where it is stored and for which purposes?",
                            "subCategoryNumber": "C8.2",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://standards.iso.org/ittf/PubliclyAvailableStandards/c074239_ISO_IEC_30118-2_2018.zip",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "None",
                                    "ocfMatchFlag":"Not Applicable",
                                    "ocfMatchNotes": "Out of scope for device specification"
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "If yes to C8.1, do you provide customers with clear and transparent information about capabilities of the product, such as cameras and microphones, that could collect personal data?",
                            "subCategoryNumber": "C8.3",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://standards.iso.org/ittf/PubliclyAvailableStandards/c074239_ISO_IEC_30118-2_2018.zip",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "None",
                                    "ocfMatchFlag":"Not Applicable",
                                    "ocfMatchNotes": "Out of scope for device specification"
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "If yes to C8.1, how do you obtain consent for using personal data?",
                            "subCategoryNumber": "C8.4",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://standards.iso.org/ittf/PubliclyAvailableStandards/c074239_ISO_IEC_30118-2_2018.zip",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "None",
                                    "ocfMatchFlag":"Not Applicable",
                                    "ocfMatchNotes": "Out of scope for device specification"
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "If yes to C8.1, how can a customer withdraw their consent for the use of personal data?",
                            "subCategoryNumber": "C8.5",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://standards.iso.org/ittf/PubliclyAvailableStandards/c074239_ISO_IEC_30118-2_2018.zip",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "None",
                                    "ocfMatchFlag":"Not Applicable",
                                    "ocfMatchNotes": "Out of scope for device specification"
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "If yes to C8.1, is it simple for customers to permanently delete any personal data from the device, service and any suppliers who have access to the data?",
                            "subCategoryNumber": "C8.6",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://standards.iso.org/ittf/PubliclyAvailableStandards/c074239_ISO_IEC_30118-2_2018.zip",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "8.2",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Device Onboarding-Reset State Definition The Platform manufacturer should provide a physical mechanism (e.g. button) that forces Platform reset. All Devices hosted on the same Platform transition their Device states to RESET when the Platform reset is asserted."
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "If Yes to C8.1, do you provide clear instructions on how to delete personal data?",
                            "subCategoryNumber": "C8.7",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://standards.iso.org/ittf/PubliclyAvailableStandards/c074239_ISO_IEC_30118-2_2018.zip",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "None",
                                    "ocfMatchFlag":"Not Applicable",
                                    "ocfMatchNotes": "Functinoality is present but is UI  and manufacturer dependant "
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "If Yes to C8.1, do you provide clear confirmation that personal data has been deleted?",
                            "subCategoryNumber": "C8.8",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://standards.iso.org/ittf/PubliclyAvailableStandards/c074239_ISO_IEC_30118-2_2018.zip",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "8.2",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Device Onboarding-Reset State Definition The Platform manufacturer should provide a physical mechanism (e.g. button) that forces Platform reset. All Devices hosted on the same Platform transition their Device states to RESET when the Platform reset is asserted."
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Where is the data used by the service and your suppliers stored?",
                            "subCategoryNumber": "C8.9",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://standards.iso.org/ittf/PubliclyAvailableStandards/c074239_ISO_IEC_30118-2_2018.zip",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "None",
                                    "ocfMatchFlag":"Not Applicable",
                                    "ocfMatchNotes": "Out of scope for device specification"
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "If data is stored outside the EEA, describe which measures have been put in place to comply with the requirements of the EU GDPR if applicable to your organisation.",
                            "subCategoryNumber": "C8.10",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://standards.iso.org/ittf/PubliclyAvailableStandards/c074239_ISO_IEC_30118-2_2018.zip",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "None",
                                    "ocfMatchFlag":"Not Applicable",
                                    "ocfMatchNotes": "Out of scope for device specification"
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Do you ensure that all personal data (including sensitive personal data) is encrypted using a suitable industry-standard method when it is sent between your device and any associated services? How do you achieve this?",
                            "subCategoryNumber": "C8.11",
                            "ocfMatchSpecification": "OCF Cloud Specification",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Cloud_Security_Specification_v2.2.2.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "8.2",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Describes how messages between the cloud service and device use TLS for establishing secure sessions."
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "In the last 12 months, have you undertaken a risk assessment to understand the potential risks to data subjects of the data used by your organisation, your device, its services and any suppliers?",
                            "subCategoryNumber": "C8.12",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://standards.iso.org/ittf/PubliclyAvailableStandards/c074239_ISO_IEC_30118-2_2018.zip",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "None",
                                    "ocfMatchFlag":"Not Applicable",
                                    "ocfMatchNotes": "OCF does not store data on device users."
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Do you have a record of: - The personal data you hold; - Where the data is held (including any suppliers); - The lawful purposes for processing; - Who the data is shared with; - The period of time the data will be held?",
                            "subCategoryNumber": "C8.13",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://standards.iso.org/ittf/PubliclyAvailableStandards/c074239_ISO_IEC_30118-2_2018.zip",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "None",
                                    "ocfMatchFlag":"Not Applicable",
                                    "ocfMatchNotes": "OCF does not store data on device users."
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Does your organisation maintain a data retention policy?",
                            "subCategoryNumber": "C8.14",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://standards.iso.org/ittf/PubliclyAvailableStandards/c074239_ISO_IEC_30118-2_2018.zip",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "None",
                                    "ocfMatchFlag":"Not Applicable",
                                    "ocfMatchNotes": "OCF does not store data on device users."
                                }
                            ]
			}
		    ]
		}
            ]
	},
        {
            "baselineOrg": "NIST",
            "baselineName": "8259D",
	    "baselineURL":"8259D",
	    "baselineGraph":"True",
            "baselineCategories":
	    [
                {
                    "categoryName": "Device Identity",
                    "categoryNumber": "1",
                    "subCategories":
		    [
                        {
                            "subCategoryDescription": "Identifier Management Support: • Ability for the device to support a unique device ID (e.g., to allow it to be linked to the person or process assigned to use the IoT device) ",
                            "subCategoryNumber": "1",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "7.1.1",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes":"Device IDs shall be unique within the scope of operation of the corresponding OCF Security Domain, and should be universally unique."
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Actions Based on Device Identity: • Ability to monitor specific actions based on the IoT device identity",
                            "subCategoryNumber": "2a",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "5.7",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "An OCF Platform can generate various kinds of Auditable Events. These Auditable Events can be used for log analysis or for real-time understanding of a system condition. Currently auditable logs must be retrieved through an authenticated connection to the logging resource.  This authentications directly ties the identity to the log."
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Actions Based on Device Identity: • Ability to identify software loaded on the IoT device based on IoT device identity",
                            "subCategoryNumber": "2b",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "9.4.2.2.4",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "The OCF Compliance Extension of the OCF end-entity certificate,  defines required parameters to correctly identify the type of Device, its manufacturer, its OCF Version, and the Security Profile compliance of the device."
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Physical Identifiers: • Ability to add a unique physical identifier at an external or internal location on the device authorized entities can access",
                            "subCategoryNumber": "3",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "None",
                                    "ocfMatchFlag":"Not Applicable",
                                    "ocfMatchNotes": "This is specific to the device manufacturer and is not mandated by the specification"
                                }
                            ]
			}
		    ]
		},
                {
                    "categoryName": "Device Configuration Control",
                    "categoryNumber": "2",
                    "subCategories":
		    [
                        {
                            "subCategoryDescription": "Display Configuration  • Ability to configure content to be displayed on a device",
                            "subCategoryNumber": "1",
                            "ocfMatchSpecification": "OCF Onboarding Tool Specification",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Onboarding_Tool_Specification.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "5.3.1",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "The Onboarding tool has access to all device resources and can display all device resources. "
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Device Configuration Control: • Ability to change the device’s software configuration settings",
                            "subCategoryNumber": "2a",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "5.3.3",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Prior to operational state, device must be onboarded and configured. with either symmetric or asymmetric credentials based on certificates or shared keys.  Once operational devices, implement role-based and/or subject based access control for each resource they present to the network"
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Device Configuration Control: • Ability for authorized entities to restore the device to a secure configuration defined by an authorized entity",
                            "subCategoryNumber": "2b",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "8.2",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Describes the Resources and properties that are restored to manufacturer settings"
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Device Configuration Control: • Configuration settings for use with the Device Configuration capability including: — Ability for authorized entities to configure the cryptography use itself, such as choosing a key length",
                            "subCategoryNumber": "2c1",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "5.6",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Authorized entities can configure types of credentials used. Credentials can be pairwise symmetric keys, certificates, or raw asymmetric keys.   Generally key length is not configurable."
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Device Configuration Control: • Configuration settings for use with the Device Configuration capability including: — Ability to configure any remote update mechanisms to be either automatically or manually initiated for update downloads and installations",
                            "subCategoryNumber": "2c2",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "14.5.4",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": " A client with the correct authorization can initiate a software update process by setting a software update bit to true or false.  This software update bit enables or disables the update process.  "
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Device Configuration Control: • Configuration settings for use with the Device Configuration capability including: — Ability to enable or disable notification when an update is available and specify who or what is to be notified",
                            "subCategoryNumber": "2c3",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "14.5.4.1",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Indicates a request to initiate the process to check if new software is available.  Note: Security of channel is out of scope, vendor responsibility."
                                }
                            ]
			}
		    ]
		},
                {
                    "categoryName": "Data Protection",
                    "categoryNumber": "3",
                    "subCategories":
		    [
                        {
                            "subCategoryDescription": "Cryptographic Capabilities & Support: • Ability to execute cryptographic mechanisms of appropriate strength and performance",
                            "subCategoryNumber": "1a",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "11.3",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Cipher Suites: All heavily reviewed and IETF approved or greater."
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Cryptographic Capabilities & Support: • Ability to verify digital signatures",
                            "subCategoryNumber": "1b",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "9.4.2.1",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "OCF certificates require that the device support ECDSA algorithm for certificate signatures."
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Cryptographic Capabilities & Support: • Ability to run hashing algorithms",
                            "subCategoryNumber": "1c",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "9.4.2.1",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "OCF certificates require that the device support SHA256 hashing algorithms "
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Cryptographic Capabilities & Support: • Ability to compute and compare hashes",
                            "subCategoryNumber": "1d",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "9.4.2.3",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Devices must implement extensions that include SHA256. "
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Cryptographic Key Management: • Ability to change keys securely",
                            "subCategoryNumber": "2a",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "5.6",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "This describes the process where credentials both symmetric and asymmetric can be provisioned by the Onboarding Tool and the Device Ownership Transfer Service."
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Cryptographic Key Management: • Ability to generate key pairs",
                            "subCategoryNumber": "2b",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "13.9",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Certificate Signing Request Resource The Device chooses which public key to use, and may optionally generate a new key pair for this purpose. "
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Cryptographic Key Management: • Ability to store encryption keys securely",
                            "subCategoryNumber": "2c",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "14.2.2.2",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Hardware Secure storage is recommended for symmetric and asymmetric keys, access credentials and personal private data. "
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Secure Storage: • Ability to “sanitize” or “purge” specific or all data in the device",
                            "subCategoryNumber": "3",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "8.2",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "The Platform manufacturer should provide a physical mechanism (e.g. button) that forces Platform reset. All Devices hosted on the same Platform transition their Device states to RESET when the Platform reset is asserted."
                                }
                            ]
			}
		    ]
		},
                {
                    "categoryName": "Logical Access to Interfaces",
                    "categoryNumber": "4",
                    "subCategories":
		    [
                        {
                            "subCategoryDescription": "Authentication Support: • Ability for the IoT device to require authentication prior to connecting to the device ",
                            "subCategoryNumber": "1a",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "5.3.3",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Prior to operational state, device must be onboarded and configured with either symmetric or asymmetric credentials based on certificates or shared keys  Once operational devices, implement role-based and/or subject based access control for each resource they present to the network. "
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Authentication Support: • Ability for the IoT device to support a second, or more, authentication method(s) through an out-ofband path such as: Temporary passwords or other one-use credentials; Third-party credential checks; Biometrics; Text messages; Hard Tokens; etc. ",
                            "subCategoryNumber": "1b",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "None",
                                    "ocfMatchFlag":"Not Applicable",
                                    "ocfMatchNotes": "Not Applicable: Implementation specific.  Devices generally only communicate over IP based protocols"
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Authentication Support: • Ability for the IoT device to hide or mask authentication information during the authentication process. ",
                            "subCategoryNumber": "1c",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "11.2.1",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Devices must support TLS/DTLS version 1.2 or greater for all unicast sessions. "
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Authentication configuration: • Ability to set the time period for how long the device will remain locked after an established configurable limit of unsuccessful login attempts has been met",
                            "subCategoryNumber": "2a",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "None",
                                    "ocfMatchFlag":"Not Applicable",
                                    "ocfMatchNotes": "Device Spec does not define login to device."
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Authentication configuration: • Ability to disable or lock access to the device after an established number of unsuccessful login attempts",
                            "subCategoryNumber": "2b",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "None",
                                    "ocfMatchFlag":"Not Applicable",
                                    "ocfMatchNotes": "Device Spec does not define login to device."
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Authentication configuration: • Ability to display and/or report the previous date and time of the last successful login following successful login authentication",
                            "subCategoryNumber": "2c",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "None",
                                    "ocfMatchFlag":"Not Implemented",
                                    "ocfMatchNotes": "Some devices are expect to need to wait for undetermined periods of time for activity this is impracticable for some devices. "
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Authentication configuration: • Ability to automatically disable accounts for the IoT device after an established period of inactivity.—Ability to support automatic logout of inactive accounts after a configurable established time period.",
                            "subCategoryNumber": "2d1",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "None",
                                    "ocfMatchFlag":"Not Implemented",
                                    "ocfMatchNotes": "Some devices are expected to need to wait for undetermined periods of time for activity this is impracticable for some devices."
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Authentication configuration: •Ability to automatically disable accounts for the IoT device after an established period of inactivity. —Ability to support automatic removal of temporary, emergency and other special use accounts after an established time period",
                            "subCategoryNumber": "2d2",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "None",
                                    "ocfMatchFlag":"Not Applicable",
                                    "ocfMatchNotes": "Specification does not have emergency or special use accounts."
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "System Use Notification Support: •Ability to create an organizationally-defined system use notification message or banner to be displayed on the IoT device",
                            "subCategoryNumber": "3a",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "None",
                                    "ocfMatchFlag":"Not Applicable",
                                    "ocfMatchNotes": "This is implementation specific"
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "System Use Notification Support: •Ability to keep the notification message or banner on the device screen until the device user actively acknowledges and agrees to the usage conditions",
                            "subCategoryNumber": "3b",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "None",
                                    "ocfMatchFlag":"Not Applicable",
                                    "ocfMatchNotes": "This is implementation specific, screens may not exist on a device."
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Authorization Support: •Ability to identify authorized users and processes",
                            "subCategoryNumber": "4a",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "5.3.3",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Prior to operational state, device must be onboarded and configured with either symmetric or asymmetric credentials based on certificates or shared keys  Once operational devices implement role-based and/or subject based access control for each resource they present to the network. "
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Authorization Support: •Ability to differentiate between authorized and unauthorized users (physical and remote)",
                            "subCategoryNumber": "4b",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "12",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Describes access control and policy management for both local and network resources, is unique per SVR per device. "
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Authentication & Identity Management: •Ability to establish access to the IoT device to perform organizationally-defined user actions without identification or authentication",
                            "subCategoryNumber": "5",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "None",
                                    "ocfMatchFlag":"Not Implemented",
                                    "ocfMatchNotes": "Unauthenticated and unidentified actions are antithetical to a secure IoT environment."
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Role Support & Management: •Ability to create unique IoT device user accounts",
                            "subCategoryNumber": "6a",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "5.3.3",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Prior to operational state, device must be onboarded and configured with either symmetric or asymmetric credentials based on certificates or shared keys  Once operational devices implement role-based and/or subject based access control for each resource they present to the network. "
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Role Support & Management: •Ability to identify unique IoT device user accounts",
                            "subCategoryNumber": "6b",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "5.3.3",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Prior to operational state, device must be onboarded and configured with either symmetric or asymmetric credentials based on certificates or shared keys  Once operational devices implement role-based and/or subject based access control for each resource they present to the network. "
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Role Support & Management: • Ability to establish organizationally-defined user actions for accessing the IoT device and/or device interface",
                            "subCategoryNumber": "6c",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "13.5.3",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "ACL Resources. Security Virtual Resources (SVRs) and Access Policy, All SVRs can be accessed by the authorized entity"
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Interface Control: •Ability to establish requirements for remote access to the IoT device and/or IoT device interface including: — Usage restrictions — Configuration requirements — Connection requirements — Manufacturer established requirement",
                            "subCategoryNumber": "7a",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "13.5.3",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "ACL Resources. Security Virtual Resources (SVRs) and Access Policy, All SVRs can be accessed by the authorized entity"
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Interface Control: • Ability to restrict use of IoT device components (e.g., ports, functions, microphones, video)",
                            "subCategoryNumber": "7b",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "13.5.3",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "ACL Resources. Security Virtual Resources (SVRs) and Access Policy, All SVRs can be accessed by the authorized entity.  Components are models as resources in OCF and all resources can be protected by authorized and authenticated access."
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Interface Control: • Ability to logically or physically disable any local and network interfaces that are not necessary for the core functionality of the device ",
                            "subCategoryNumber": "7c",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "5.3.3",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Once operational devices implement role-based and/or subject based access control for each resource they present to the network. "
                                },
                                {
                                    "ocfMatchClause": "14.2.2.4.8",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Device vendor has not implemented test or debug interfaces on the Device which are operable 3646 or which can be enabled which might present an attack vector on the Device which circumvents 3647 the interface-level security or access policies of the Device. "
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Interface Control: • Ability to restrict updating actions to authorized entities ",
                            "subCategoryNumber": "7d",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "14.5.4",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Software Update  Setting the Initiate Secure Software Update bit in the '/oic/sec/pstat.tm' Property (see Table 37 of clause 13.8) indicates a request to initiate the software update process.  Access to this property is authenticated and authorized. "
                                },
                                {
                                    "ocfMatchClause": "13.8",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": " Definition of pstat state resource.  Pstat resource is an SVR and has protected access. "
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Interface Control: • Ability to restrict access to the cybersecurity state indicator to authorized entities ",
                            "subCategoryNumber": "7e",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "13.8",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": " Definition of pstat state resource.  Pstat resource is an SVR and has protected access. "
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Interface Control: • Ability to restrict use of IoT device services",
                            "subCategoryNumber": "7f",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "13.8",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": " Definition of pstat state resource.  Pstat resource is an SVR and has protected access. "
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Interface Control: • Ability to enforce the established local and remote access requirements ",
                            "subCategoryNumber": "7g",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "13.5.3",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "ACL Resources. Security Virtual Resources (SVRs) and Access Policy, All SVRs can be accessed by the authorized entity"
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Interface Control: • Ability to support wireless technologies needed by the organization (e.g., Microwave, Packet radio (UHF/VHF), Bluetooth, Manufacturer defined) ",
                            "subCategoryNumber": "7h",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "13.5.3",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "ACL Resources. Security Virtual Resources (SVRs) and Access Policy, All SVRs can be accessed by the authorized entity. Local access is OS dependent on if OS supports local access. "
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Interface Control: • Ability to establish and configure IoT device settings for wireless technologies including wireless authentication protocols (e.g., EAP/TLS, PEAP) ",
                            "subCategoryNumber": "7i",
                            "ocfMatchSpecification": "OCF Easy Setup Specification",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Easy_Setup_Specification.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "6.3",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": " Wifi Configuration Resource Type Device and vendor dependent.  Underlying layers are not specified in application layer focused specification"
                                }
                            ]
			}
		    ]
		},
                {
                    "categoryName": "Software Update",
                    "categoryNumber": "5",
                    "subCategories":
		    [
                        {
                            "subCategoryDescription": "Update Application Support: • Ability to update the device’s software through remote (e.g., network download) and/or local (e.g., removable media) means",
                            "subCategoryNumber": "1a",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "14.5.4.1",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Indicates a request to initiate the process to check if new software is available.  "
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Update Application Support: • If software updates are delivered and applied automatically: — Ability to verify and authenticate any update before installing it o Ability to enable or disable updating",
                            "subCategoryNumber": "1b1",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "14.2.2.4-2",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "It is recommended that to use Secure Download and Secure Boot methods and that  authentication of a binary’s source as well as verification of its contents be used."
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Update Application Support: • If software updates are delivered and applied automatically: — Ability to enable or disable updating",
                            "subCategoryNumber": "1b2",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "14.5.4",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "A client with the correct authorization can initiate a software update process by setting a software update bit to true or false.  This software update bit enables or disables the update process.  Dedicated resource for updates."
                                }
                            ]
			}
		    ]
		},
                {
                    "categoryName": "Cybersecurity State Awareness",
                    "categoryNumber": "6",
                    "subCategories":
		    [
                        {
                            "subCategoryDescription": "Access to Event Information: • Ability to access information about the IoT device’s cybersecurity state and other necessary data ",
                            "subCategoryNumber": "1a",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "5.7",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "An OCF Platform can generate various kinds of Auditable Events. These Auditable Events can be used for log analysis or for real-time understanding of a system condition. "
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Access to Event Information: • Ability to preserve system state information ",
                            "subCategoryNumber": "1b",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "13.11.1",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Auditable Event Resources shall be stored in non-volatile memory"
                                },
                                {
                                    "ocfMatchClause": "13.5.3",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "ACL Resources. Security Virtual Resources (SVRs) and Access Policy, All SVRs can be accessed by the authorized entity.  Components are models as resources in OCF and all resources can be protected by authorized and authenticated access"
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Event Identification & Monitoring: • Ability to identify organizationally-defined cybersecurity events (e.g., expected state change) that may occur on or involving the IoT device ",
                            "subCategoryNumber": "2a",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "5.7",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "An OCF Platform can generate various kinds of Auditable Events. These Auditable Events can be set by the administrator and can  be used for log analysis or for real-time understanding of a system condition."
                                },
                                {
                                    "ocfMatchClause": "Table 51",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": " Properties of the '/oic/sec/ael'  Auditable Events List Resource "
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Event Identification & Monitoring: • Ability to monitor for organizationally-defined cybersecurity events (e.g., expected state change) that may occur on or involving the IoT device ",
                            "subCategoryNumber": "2b",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "5.7",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "An OCF Platform can generate various kinds of Auditable Events. These Auditable Events can be set by the administrator and can  be used for log analysis or for real-time understanding of a system condition. Logs are SVRs and can be deleted by entity with rights to delete this resource."
                                },
                                {
                                    "ocfMatchClause": "Table 51",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": " Properties of the '/oic/sec/ael'  Auditable Events List Resource "
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Event Identification & Monitoring: • Ability to support a list of events that are necessary for auditing purposes (to support organization’s audit policy) ",
                            "subCategoryNumber": "2c",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "5.7",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "An OCF Platform can generate various kinds of Auditable Events. These Auditable Events can be set by the administrator and can  be used for log analysis or for real-time understanding of a system condition."
                                },
                                {
                                    "ocfMatchClause": "Table 51",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": " Properties of the '/oic/sec/ael'  Auditable Events List Resource "
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Event Identification & Monitoring: • Ability to identify unique users interacting with the device (to allow for user session monitoring) ",
                            "subCategoryNumber": "2d",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "5.4.4",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Roles can identify specific authorized entities.  Role authorization can be recorded as an auditable event as per clause 5.7"
                                },
                                {
                                    "ocfMatchClause": "5.3.3",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Prior to operational state, device must be onboarded and configured with either symmetric or asymmetric credentials based on certificates or shared keys  Once operational devices implement role-based and/or subject based access control for each resource they present to the network."
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Event Identification & Monitoring: • Ability to monitor communications traffic ",
                            "subCategoryNumber": "2e",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "None",
                                    "ocfMatchFlag":"Not Applicable",
                                    "ocfMatchNotes": "Out of scope for device specification."
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Event Identification & Monitoring: • Ability to detect remote activation attempts ",
                            "subCategoryNumber": "2f",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "11.3.2",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Observe/Notification. Activation attempts changes in resource states.   These changes can be detected using a RETREIVE on the resource."
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Event Identification & Monitoring: • Ability to detect remote activation of a collaborative computing device/component (e.g., microphone, camera) ",
                            "subCategoryNumber": "2g",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "None",
                                    "ocfMatchFlag":"Not Applicable",
                                    "ocfMatchNotes": "Implementation specific.  Devices may not have microphones or cameras."
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Event Identification & Monitoring: • Ability to define characteristics of unapproved content ",
                            "subCategoryNumber": "2h",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "None",
                                    "ocfMatchFlag":"Not Applicable",
                                    "ocfMatchNotes": " Out of  Scope for a device specification."
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Event Identification & Monitoring: • Ability to scan files for unapproved content",
                            "subCategoryNumber": "2i",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "None",
                                    "ocfMatchFlag":"Not Applicable",
                                    "ocfMatchNotes": " Out of  Scope for a device specification."
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Event Response: • Ability to generate alerts for specific events ",
                            "subCategoryNumber": "3a",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "5.7",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "An OCF Platform can generate various kinds of Auditable Events. These Auditable Events can be set by the administrator and can be used for log analysis or for real-time understanding of a system condition."
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Event Response: • Ability to respond to alerts with predefined responses ",
                            "subCategoryNumber": "3b",
                            "ocfMatchSpecification": "OCF Core Specification",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Core_Specification.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "8.6",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "The NOTIFY operation is used to request asynchronous notification of state changes. Complete description of the NOTIFY operation is provided in 0. The NOTIFY operation uses the NOTIFICATION response message which is defined here. "
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Event Response: • Ability to alert connected information systems of potential issues found during the auditing process ",
                            "subCategoryNumber": "3c",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "5.7",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "An OCF Platform can generate various kinds of Auditable Events. These Auditable Events can be set by the administrator and can be used for log analysis or for real-time understanding of a system condition."
                                },
                                {
                                    "ocfMatchClause": "8.6",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "The NOTIFY operation is used to request asynchronous notification of state changes. Complete description of the NOTIFY operation is provided in 0. The NOTIFY operation uses the NOTIFICATION response message which is defined here. "
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Event Response: • Ability to provide information to an external process that will issue auditing process alerts ",
                            "subCategoryNumber": "3d",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "8.6",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "The NOTIFY operation is used to request asynchronous notification of state changes. Complete description of the NOTIFY operation is provided in 0. The NOTIFY operation uses the NOTIFICATION response message which is defined here. "
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Event Response: • Ability to notify users of activation of a collaborative computing device ",
                            "subCategoryNumber": "3e",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "None",
                                    "ocfMatchFlag":"Not Applicable",
                                    "ocfMatchNotes": "Out of scope.  Implementation Specific, devices may not be collaboration devices."
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Event Response: • Ability to respond following an auditing failure (either by the device or an external auditing process) ",
                            "subCategoryNumber": "3f",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "5.7",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "An OCF Platform can generate various kinds of Auditable Events. These Auditable Events can be set by the administrator and can  be used for log analysis or for real-time understanding of a system condition.  Any client with correct access permission cna retrieve logs of failure."
                                },
                                {
                                    "ocfMatchClause": "Table 51",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": " Properties of the '/oic/sec/ael'  Auditable Events List Resource "
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Event Response: • Ability to prevent download of unapproved content ",
                            "subCategoryNumber": "3g",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "None",
                                    "ocfMatchFlag":"Not Applicable",
                                    "ocfMatchNotes": "Out of scope for a device specification."
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Event Response: • Ability to delete unapproved content ",
                            "subCategoryNumber": "3h",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "None",
                                    "ocfMatchFlag":"Not Applicable",
                                    "ocfMatchNotes": "Out of scope for a device specification."
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Logging Capture & Trigger Support: • Ability to identify and capture organizationallydefined events using a persistent method ",
                            "subCategoryNumber": "4a",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "13.11.1",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Auditable Event Resources shall be stored in non-volatile memory."
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Logging Capture & Trigger Support: • Ability to capture information from organizationally-defined cybersecurity events (e.g., cybersecurity state, time) through organizationally-defined means (e.g., logs) ",
                            "subCategoryNumber": "4b",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "5.7",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "An OCF Platform can generate various kinds of Auditable Events. These Auditable Events can be set by the administrator and can  be used for log analysis or for real-time understanding of a system condition.  Any client with correct access permission cna retrieve logs of failure."
                                },
                                {
                                    "ocfMatchClause": "Table 51",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": " Properties of the '/oic/sec/ael'  Auditable Events List Resource "
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Logging Capture & Trigger Support: • Ability to create audit logs within the device for organizationally-defined and auditable events (e.g.  account creation, modification, enabling, disabling, removal actions and notifications) ",
                            "subCategoryNumber": "4c",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "5.7",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "An OCF Platform can generate various kinds of Auditable Events. These Auditable Events can be set by the administrator and can  be used for log analysis or for real-time understanding of a system condition.  Any client with correct access permission cna retrieve logs of failure."
                                },
                                {
                                    "ocfMatchClause": "Table 51",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": " Properties of the '/oic/sec/ael'  Auditable Events List Resource "
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Support of Required Data Logging: • Ability to track users interacting with the device, the time they interacted with the device, the time the user logged out of the device, and to list this information in an audit log ",
                            "subCategoryNumber": "5a",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "5.7",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "An OCF Platform can generate various kinds of Auditable Events. These Auditable Events can be set by the administrator and can  be used for log analysis or for real-time understanding of a system condition.  Any client with correct access permission cna retrieve logs of failure."
                                },
                                {
                                    "ocfMatchClause": "Table 51",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": " Properties of the '/oic/sec/ael'  Auditable Events List Resource "
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Support of Required Data Logging: •  Ability to log information pertaining to: —  The type of event that occurred —  The time that the event occurred —  Where the event occurred —  The source of the event —  The outcome of the event —  Identity of users/processes associated with the event",
                            "subCategoryNumber": "5b",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "5.7",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "An OCF Platform can generate various kinds of Auditable Events. These Auditable Events can be set by the administrator and can  be used for log analysis or for real-time understanding of a system condition.  Any client with correct access permission cna retrieve logs of failure."
                                },
                                {
                                    "ocfMatchClause": "Table 51",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": " Properties of the '/oic/sec/ael'  Auditable Events List Resource "
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Support of Required Data Logging: • Ability to provide information as to why the device captured a particular event or set of events ",
                            "subCategoryNumber": "5c",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "5.7",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "An OCF Platform can generate various kinds of Auditable Events. These Auditable Events can be set by the administrator and can  be used for log analysis or for real-time understanding of a system condition.  Any client with correct access permission cna retrieve logs of failure."
                                },
                                {
                                    "ocfMatchClause": "Table 51",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": " Properties of the '/oic/sec/ael'  Auditable Events List Resource "
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Support of Required Data Logging: • Ability to capture organizationally-defined information to support examination of security incidents ",
                            "subCategoryNumber": "5d",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "5.7",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "An OCF Platform can generate various kinds of Auditable Events. These Auditable Events can be set by the administrator and can  be used for log analysis or for real-time understanding of a system condition.  Any client with correct access permission cna retrieve logs of failure."
                                },
                                {
                                    "ocfMatchClause": "Table 51",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": " Properties of the '/oic/sec/ael'  Auditable Events List Resource "
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Support of Required Data Logging: •  Ability to record stored data access and usage ",
                            "subCategoryNumber": "5e",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "5.7",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "An OCF Platform can generate various kinds of Auditable Events. These Auditable Events can be set by the administrator and can  be used for log analysis or for real-time understanding of a system condition.  Any client with correct access permission cna retrieve logs of failure."
                                },
                                {
                                    "ocfMatchClause": "Table 51",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": " Properties of the '/oic/sec/ael'  Auditable Events List Resource "
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Audit Log Storage & Retention: • Ability to comply with organizational policy for storing persistent audit logs up to a predefined size ",
                            "subCategoryNumber": "6a",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "5.7",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "An OCF Platform can generate various kinds of Auditable Events. These Auditable Events can be set by the administrator and can  be used for log analysis or for real-time understanding of a system condition.  Any client with correct access permission cna retrieve logs of failure."
                                },
                                {
                                    "ocfMatchClause": "Table 51",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": " Properties of the '/oic/sec/ael'  Auditable Events List Resource "
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Audit Log Storage & Retention: • Ability to comply with organizational policy for audit log retention period",
                            "subCategoryNumber": "6b",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "5.7",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "An OCF Platform can generate various kinds of Auditable Events. These Auditable Events can be set by the administrator and can  be used for log analysis or for real-time understanding of a system condition.  Any client with correct access permission cna retrieve logs of failure."
                                },
                                {
                                    "ocfMatchClause": "Table 51",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": " Properties of the '/oic/sec/ael'  Auditable Events List Resource "
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Audit Log Storage & Retention: • Ability to delete audit logs in accordance with organizational policy",
                            "subCategoryNumber": "6c",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "5.7",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "An OCF Platform can generate various kinds of Auditable Events. These Auditable Events can be set by the administrator and can  be used for log analysis or for real-time understanding of a system condition.  Any client with correct access permission cna retrieve logs of failure."
                                },
                                {
                                    "ocfMatchClause": "Table 51",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": " Properties of the '/oic/sec/ael'  Auditable Events List Resource "
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Support for Reliable Time: • Ability to use synchronization with a verified time source to determine the validity of a timestamp ",
                            "subCategoryNumber": "7a",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "14.2.5",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Secure time is recommended to validate certificates."
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Support for Reliable Time: • Ability to record timestamps convertible to UTC or GMT to support a standardized representation of timing",
                            "subCategoryNumber": "7b",
                            "ocfMatchSpecification": "OCF Core Specification",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Core_Specification.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "Table 1",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "The full-date format pattern according to IETF RFC 3339 "
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Support for Reliable Time: • Ability to log timing measurements outside a threshold value (e.g., enabling alerts if device’s system time is not reliable) ",
                            "subCategoryNumber": "7c",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "5.7",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "An OCF Platform can generate various kinds of Auditable Events. These Auditable Events can be set by the administrator and can  be used for log analysis or for real-time understanding of a system condition.   If the time is off this will be captured in the auditable logs as DTLs connections may fail. "
                                },
                                {
                                    "ocfMatchClause": "Table 51",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": " Properties of the '/oic/sec/ael'  Auditable Events List Resource "
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Audit Support & Protection: • Ability to report on its cybersecurity state ",
                            "subCategoryNumber": "8a",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "5.7",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "An OCF Platform can generate various kinds of Auditable Events. These Auditable Events can be set by the administrator and can  be used for log analysis or for real-time understanding of a system condition.  Any client with correct access permission cna retrieve logs of failure."
                                },
                                {
                                    "ocfMatchClause": "Table 51",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": " Properties of the '/oic/sec/ael'  Auditable Events List Resource "
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Audit Support & Protection: • Ability to support a self-audit generation process ",
                            "subCategoryNumber": "8b",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "5.7",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "An OCF Platform can generate various kinds of Auditable Events. These Auditable Events can be set by the administrator and can  be used for log analysis or for real-time understanding of a system condition.  Any client with correct access permission cna retrieve logs of failure."
                                },
                                {
                                    "ocfMatchClause": "Table 51",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": " Properties of the '/oic/sec/ael'  Auditable Events List Resource "
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Audit Support & Protection: • Ability to send requested audit logs to an external audit process or information system (e.g., where audit information can be checked to allow for review, analysis, and reporting.) ",
                            "subCategoryNumber": "8c",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "5.7",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "An OCF Platform can generate various kinds of Auditable Events. These Auditable Events can be set by the administrator and can  be used for log analysis or for real-time understanding of a system condition.  Any client with correct access permission cna retrieve logs and send them externally"
                                },
                                {
                                    "ocfMatchClause": "Table 51",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": " Properties of the '/oic/sec/ael'  Auditable Events List Resource "
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Audit Support & Protection: • Ability to protect the audit information through the use of: —  Encryption —  Digitally signing audit files —  Securely sending audit files to another device —  Other protections created by the device manufacturer ",
                            "subCategoryNumber": "8d",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "5.7",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "All logs are SVRs.  To retrieve them you need permissions, and all transmission of logs will be authenticated, authorized and encrypted.  An OCF Platform can generate various kinds of Auditable Events. These Auditable Events can be set by the administrator and can  be used for log analysis or for real-time understanding of a system condition.  "
                                },
                                {
                                    "ocfMatchClause": "Table 51",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": " Properties of the '/oic/sec/ael'  Auditable Events List Resource "
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "State Awareness Support: • Ability to differentiate between when a device will likely operate as expected from when it may be in a degraded cybersecurity state",
                            "subCategoryNumber": "9",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "8.6",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "Device transitions to a self-recovery state SRESET if certain conditions of the device are corrupt."
                                }
                            ]
			}
		    ]
		},
                {
                    "categoryName": "Device Security",
                    "categoryNumber": "7",
                    "subCategories":
		    [
                        {
                            "subCategoryDescription": "Secure Execution: • Ability to execute code in confined virtual environments ",
                            "subCategoryNumber": "1a",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "None",
                                    "ocfMatchFlag":"Not Applicable",
                                    "ocfMatchNotes": "Out of Scope:  This is implementation specific.  Virtual environements may not be feasible on contrained devices."
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Secure Execution: • Ability to separate IoT device processes into separate execution domains ",
                            "subCategoryNumber": "1b",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "None",
                                    "ocfMatchFlag":"Not Applicable",
                                    "ocfMatchNotes": "Out of Scope:  This is implementation specific.  Exceution domains may not be feasible on contrained devices."
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Secure Communication: • Ability to enforce traffic flow policies ",
                            "subCategoryNumber": "2a",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "None",
                                    "ocfMatchFlag":"Not Applicable",
                                    "ocfMatchNotes": "Out of scope.  Traffic flow policies are generally external to device."
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Secure Communication: • Ability to interface with DNS/DNSSEC ",
                            "subCategoryNumber": "2b",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "None",
                                    "ocfMatchFlag":"Not Met",
                                    "ocfMatchNotes": "Secure DNS is currently not in the specification"
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Secure Resource Usage: • Ability to manage memory address space assigned to processes ",
                            "subCategoryNumber": "3a",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "None",
                                    "ocfMatchFlag":"Not Applicable",
                                    "ocfMatchNotes": "Out of Scope:  This is implementation specific."
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Secure Resource Usage: • Ability to enforce access to memory space through the kernel ",
                            "subCategoryNumber": "3b",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "None",
                                    "ocfMatchFlag":"Not Applicable",
                                    "ocfMatchNotes": "Out of Scope:  This is implementation specific."
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Secure Resource Usage: • Ability to prevent a process from accessing memory space of another process ",
                            "subCategoryNumber": "3c",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "None",
                                    "ocfMatchFlag":"Not Applicable",
                                    "ocfMatchNotes": "Out of Scope:  This is implementation specific."
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Secure Resource Usage: • Ability to enforce configured disk quotas ",
                            "subCategoryNumber": "3d",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "None",
                                    "ocfMatchFlag":"Not Applicable",
                                    "ocfMatchNotes": "Out of Scope:  This is implementation specific."
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Secure Resource Usage: • Ability to utilize file compression technologies (e.g., to provide denial of service protection) ",
                            "subCategoryNumber": "3e",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "None",
                                    "ocfMatchFlag":"Not Applicable",
                                    "ocfMatchNotes": "Out of Scope:  This is implementation specific."
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Secure Device Operation: • Ability to define various operational states ",
                            "subCategoryNumber": "4a",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "8.1 - Figure 22",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": "This shows the device state model"
                                }
                            ]
			},
                        {
                            "subCategoryDescription": "Secure Device Operation: • Ability to restrict components/features of the IoT device (e.g., ports, functions, protocols, services) in accordance with organizationally-defined policies ",
                            "subCategoryNumber": "4b",
                            "ocfMatchSpecification": "OCF Security Specification",
                            "ocfMatchSpecificationURL": "https://openconnectivity.org/specs/OCF_Security_Specification.pdf",
                            "ocfMatches": [
                                {
                                    "ocfMatchClause": "13.5.3",
                                    "ocfMatchFlag":"Yes",
                                    "ocfMatchNotes": " ACL Resources. Security Virtual Resources (SVRs) and Access Policy, All SVRs can be accessed by the authorized entity"
                                }
                            ]
			}
		    ]
		}
	    ]
	}
    ]
}