Re: SFRs - Requirement Specification or Implementation Description?

["YOKOTA HIROFUMI" <yokota-hirofumi@jqa.jp>]

Please correct me.
There is a case that the TOE does not provides the startup time and shutdown
time, but the IT environment does.
In such case, yes, we could say, as discussed here, that:
1) audit startup/shutdown functions are vacuously satisfied, or
2) those functions are to be optional, or
3) an explicitly stated requirement should be used.

Regards,
Hirofumi Yokota

----- Original Message ----- 
From: "YOKOTA HIROFUMI" <yokota-hirofumi@jqa.jp>
To: "Multiple recipients of list" <cc-cmt@nist.gov>
Sent: Monday, December 04, 2006 3:30 PM
Subject: Re: SFRs - Requirement Specification or Implementation Description?


>
> I think, there are variations. Sometimes, the TOE's startup/shutdown might
> be the audit function's startup/shutdown, or enabling/disabling some
> security modules could be the audit functions startup/shutdown. Or, for
some
> auditable events, disc failures, communication failures and those
recoveries
> might be the audit startup/shutdown functions.
>
> In any above cases we would need to audit the "time", when the auditing is
> enabled and/or disabled.
>
> Regards,
> Hirofumi Yokota
>
>
>
>
>