How to identify and classify assets (network, security, privacy) in a DUT for EN 18031?

[MithunKrishna2008]

Hi, I am working on EN 18031 testing and I need guidance on how to properly identify assets in a Device Under Test (DUT), such as network assets, security assets, and privacy assets.

Specifically, I want to understand:

How to determine all assets exposed by the DUT (network interfaces, services, ports, protocols, data types, etc.).

How to map each physical and logical interface to the corresponding asset (e.g., LAN ports, WLAN SSIDs, web portal, APIs, mobile app interfaces).

How to decide whether an asset should be tested under ACM-1, ACM-2, etc.

Whether there is a recommended methodology or checklist to classify assets into network / security / privacy asset categories (based on EN 18031-1 & the Zealience “Privacy Assets” guide).

If possible, please share examples or references on:

Asset classification

Interface mapping

Deciding which assets are in scope for testing

Thank you!

[zealience]

Hi @MithunKrishna2008 ,

Thanks for your questions!

I would recommend reading our article EN 18031 & RED Cybersecurity Compliance Guide for IoT Manufacturers. In particular, you can find answers to your questions in the section "Deep Dive into EN 18031".

• How to determine all assets exposed by the DUT (network interfaces, services, ports, protocols, data types, etc.).
  --> Assets are defined in EN 18031. Therefore, it is best to keep in mind their definitions to identify them. Refer to the section The “Asset-Based” Approach of EN 18031 for explanation on assets.

• How to map each physical and logical interface to the corresponding asset (e.g., LAN ports, WLAN SSIDs, web portal, APIs, mobile app interfaces).
  --> EN 18031 does not require to map interfaces to corresponding assets systematically. Rather, you may need to indicate for certain requirements the interface on which assets are accessible or communicated. For example:

  • AUM-1-1 expects the documentation of the network interfaces on which assets can be accessed
  • AUM-1-2 expects the documentation of the user interfaces on which assets can be accessed
  • SCM-1 expects the documentation of the network interfaces used to communicate assets.

• How to decide whether an asset should be tested under ACM-1, ACM-2, etc.
  --> It depends on the technical documentation. For example, if an asset has been documented as being accessible by entities, it should be documented as such, rendering it in scope of ACM-1 testing. I suggest reading the section "How to Identify Applicable Requirements to Assets" in our guide mentioned above.

I hope this clarifies your questions!

Guillaume