dido:03-dido-te:99-annexes:annex-c-requirements:03-functional-requirements:03-02-node-requirements:nod-003-configure-a-node:nod-003e-protect-sensitive-configuration-values

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
Next revision		 Previous revision
dido:03-dido-te:99-annexes:annex-c-requirements:03-functional-requirements:03-02-node-requirements:nod-003-configure-a-node:nod-003e-protect-sensitive-configuration-values [2026/08/17 14:20] – removed - external edit (Unknown date) 127.0.0.1dido:03-dido-te:99-annexes:annex-c-requirements:03-functional-requirements:03-02-node-requirements:nod-003-configure-a-node:nod-003e-protect-sensitive-configuration-values [2026/08/17 14:20] (current) – ↷ Links adapted because of a move operation nick_dido
Line 1: Line 1:
 +====== NOD-003e — Protect Sensitive Configuration Values ======
  
 +[[dido:03-dido-te:99-annexes:annex-c-requirements:03-functional-requirements:03-02-node-requirements:nod-003-configure-a-node:start|Go to NOD-003 — Configure a Node]]
 +
 +===== Statement =====
 +
 +The [[dido:99_annexes:annex-b-terms-and-definitions:d:dido-te|DIDO-TE]] SHALL protect each [[dido:99_annexes:annex-b-terms-and-definitions:s:sensitive_configuration_value|Sensitive Configuration Value]] throughout its [[dido:99_annexes:annex-b-terms-and-definitions:l:lifecycle|Lifecycle]].
 +
 +===== Derived From =====
 +
 +  * [[dido:03-dido-te:99-annexes:annex-c-requirements:03-functional-requirements:03-02-node-requirements:nod-003-configure-a-node:start|NOD-003 — Configure a Node]]
 +  * [[dido:03-dido-te:99-annexes:annex-c-requirements:03-functional-requirements:03-02-node-requirements:nod-003-configure-a-node:nod-003a-select-the-node-configuration|NOD-003a — Select the Node Configuration]]
 +  * [[dido:03-dido-te:99-annexes:annex-c-requirements:03-functional-requirements:03-02-node-requirements:nod-003-configure-a-node:nod-003b-resolve-node-configuration-values|NOD-003b — Resolve Node Configuration Values]]
 +  * [[dido:03-dido-te:99-annexes:annex-c-requirements:03-functional-requirements:03-02-node-requirements:nod-003-configure-a-node:nod-003c-apply-the-node-configuration|NOD-003c — Apply the Node Configuration]]
 +  * [[dido:03-dido-te:99-annexes:annex-c-requirements:03-functional-requirements:03-02-node-requirements:nod-003-configure-a-node:nod-003d-establish-node-bindings|NOD-003d — Establish Node Bindings]]
 +  * [[dido:03-dido-te:99-annexes:annex-b-references:dte-005|[DTE5] DIDO-TE Requirements Register]], source requirement identifier and obligation to be assigned
 +  * [[dido:03-dido-te:99-annexes:annex-b-references:dte-006|[DTE6] Structured Information Processing Reference Architecture (SIP-RA)]]
 +  * [[dido:03-dido-te:99-annexes:annex-b-references:dte-007|[DTE7] Federated Data Interpretation Systems Reference Architecture (FDIS-RA)]]
 +
 +===== Rationale =====
 +
 +A [[dido:99_annexes:annex-b-terms-and-definitions:n:node_configuration|Node Configuration]] may contain [[dido:99_annexes:annex-b-terms-and-definitions:c:credential|Credentials]], [[dido:99_annexes:annex-b-terms-and-definitions:c:cryptographic_material|Cryptographic Material]], authentication tokens, personal information, network details, proprietary values, or other [[dido:99_annexes:annex-b-terms-and-definitions:i:information|Information]] whose disclosure, alteration, substitution, or misuse may compromise a [[dido:99_annexes:annex-b-terms-and-definitions:n:node|Node]] or [[dido:99_annexes:annex-b-terms-and-definitions:t:test_environment|Test Environment]].
 +
 +Protection applies while a Sensitive Configuration Value is created, obtained, transferred, stored, resolved, applied, used, recorded, retained, and disposed of. The applicable [[dido:99_annexes:annex-b-terms-and-definitions:s:security_control|Security Controls]] depend upon the value’s [[dido:99_annexes:annex-b-terms-and-definitions:c:classification|Classification]] and the risks associated with unauthorized access or modification.
 +
 +A protected reference, [[dido:99_annexes:annex-b-terms-and-definitions:i:identifier|Identifier]], digest, or redacted representation may preserve [[dido:99_annexes:annex-b-terms-and-definitions:e:evidence|Evidence]] and [[dido:99_annexes:annex-b-terms-and-definitions:t:traceability|Traceability]] without exposing the Sensitive Configuration Value.
 +
 +This requirement governs the protection of Sensitive Configuration Values. It does not require the DIDO-TE to reproduce secret values in [[dido:99_annexes:annex-b-terms-and-definitions:c:configuration_record|Configuration Records]], logs, [[dido:99_annexes:annex-b-terms-and-definitions:t:test_result|Test Results]], or Evidence.
 +
 +===== Applies To =====
 +
 +  * [[dido:99_annexes:annex-b-terms-and-definitions:d:dido-te|DIDO-TE]]
 +  * [[dido:99_annexes:annex-b-terms-and-definitions:n:node|Node]]
 +  * [[dido:99_annexes:annex-b-terms-and-definitions:n:node_configuration|Node Configuration]]
 +  * [[dido:99_annexes:annex-b-terms-and-definitions:c:configuration_value|Configuration Value]]
 +  * [[dido:99_annexes:annex-b-terms-and-definitions:s:sensitive_configuration_value|Sensitive Configuration Value]]
 +  * [[dido:99_annexes:annex-b-terms-and-definitions:c:configuration_source|Configuration Source]]
 +  * [[dido:99_annexes:annex-b-terms-and-definitions:c:configuration_record|Configuration Record]]
 +  * [[dido:99_annexes:annex-b-terms-and-definitions:c:credential|Credential]]
 +  * [[dido:99_annexes:annex-b-terms-and-definitions:c:cryptographic_material|Cryptographic Material]]
 +  * [[dido:99_annexes:annex-b-terms-and-definitions:t:test_environment|Test Environment]]
 +  * [[dido:99_annexes:annex-b-terms-and-definitions:t:test_execution|Test Execution]]
 +  * [[dido:99_annexes:annex-b-terms-and-definitions:e:evidence|Evidence]]
 +  * [[dido:99_annexes:annex-b-terms-and-definitions:t:traceability|Traceability]]
 +
 +===== Verification =====
 +
 +Verification confirms that:
 +
 +  * The DIDO-TE identifies each Configuration Value requiring protection.
 +  * Each Sensitive Configuration Value has an applicable Classification and handling rule.
 +  * The applicable Security Controls address [[dido:99_annexes:annex-b-terms-and-definitions:c:confidentiality|Confidentiality]], [[dido:99_annexes:annex-b-terms-and-definitions:i:integrity|Integrity]], availability, [[dido:99_annexes:annex-b-terms-and-definitions:a:access_control|Access Control]], use, transfer, storage, retention, and disposal.
 +  * Only identified and authorised actors, Nodes, processes, and services have access to a Sensitive Configuration Value.
 +  * Access remains limited to the Sensitive Configuration Value and operation required by the authorised activity.
 +  * The DIDO-TE protects Sensitive Configuration Values during storage and transfer.
 +  * The DIDO-TE protects Sensitive Configuration Values from unauthorised disclosure, alteration, substitution, duplication, extraction, and reuse.
 +  * The DIDO-TE prevents Sensitive Configuration Values from appearing in unprotected configuration files, command histories, process arguments, logs, error messages, Test Results, or Evidence.
 +  * The DIDO-TE uses protected references, Identifiers, digests, or redacted representations when records require identification without disclosure.
 +  * Protection does not prevent verification of the Sensitive Configuration Value’s identity, source, authority, integrity, applicability, or use.
 +  * The DIDO-TE detects an expired, revoked, altered, substituted, exposed, or unauthorised Sensitive Configuration Value.
 +  * The DIDO-TE prevents use of a Sensitive Configuration Value that fails an applicable validity or protection criterion.
 +  * The DIDO-TE records access to and material use of Sensitive Configuration Values without recording the exposed values.
 +  * The DIDO-TE rotates, revokes, replaces, archives, or disposes of Sensitive Configuration Values in accordance with applicable Security Controls.
 +  * A change to a Sensitive Configuration Value produces a distinguishable configuration revision and triggers applicable [[dido:99_annexes:annex-b-terms-and-definitions:c:configuration_validation|Configuration Validation]].
 +  * The DIDO-TE maintains Traceability among the Sensitive Configuration Value, its Classification, protected reference, authorised Configuration Source, authorised users, Node Configuration, Node instance, Security Controls, access records, findings, exceptions, and resulting Evidence.
 +  * A missing, exposed, altered, unprotected, unauthorised, improperly retained, or untraceable Sensitive Configuration Value constitutes nonconformance with this requirement.
 +
 +Verification includes:
 +
 +  * Inspection of Sensitive Configuration Value identification and Classification
 +  * Inspection of applicable handling rules and Security Controls
 +  * Inspection of Access Control assignments
 +  * Inspection of storage and transfer protections
 +  * Inspection of configuration files, command histories, process arguments, logs, error messages, Test Results, and Evidence for exposed values
 +  * Confirmation that protected references preserve identity and Traceability without disclosing Sensitive Configuration Values
 +  * A negative assessment involving unauthorised access
 +  * A negative assessment involving an altered, expired, or revoked Sensitive Configuration Value
 +  * A negative assessment involving attempted disclosure through a log or error message
 +  * Confirmation that an invalid Sensitive Configuration Value prevents the applicable configuration or execution activity
 +  * Inspection of access, rotation, revocation, retention, and disposal records
 +  * Inspection of findings, exceptions, Evidence, and Traceability
 +
 +===== Referenced By =====
 +
 +{{backlinks>.}}
 +
 +===== Related Architecture Sections =====
 +
 +  * Add links to the architecture sections governing Sensitive Configuration Values, Information Classification, Access Control, cryptographic protection, Credential management, logging, retention, disposal, Evidence, and Traceability.
 +
 +===== Delivery Phase =====
 +
 +Assign the applicable delivery phase.
 +
 +===== Requirement Status =====
 +
 +Draft
 +
 +===== Statement Reference =====
 +
 +Use the following syntax to reference this requirement’s Statement section from another DokuWiki page:
 +
 +<code dokuwiki>
 +{{section>dido:03-dido-te:99-annexes:annex-c-requirements:03-node-requirements:nod-003-configure-a-node:nod-003e-protect-sensitive-configuration-values#Statement&noheader&nofooter&noeditbtn}}
 +</code>
 +
 +----
 +
 +<WRAP centeralign>
 +© 2026 Dido Solutions, Inc. and Jackrabbit Consulting, Inc.
 +</WRAP>