EN 18031-2:2024 AUM-1: Authenticate entities before they read confidential, change sensitive, or use privacy and security functions (network and user interfaces)

What does AUM-1 require?

Where an ACM-1 access control mechanism governs access over a network interface (AUM-1-1) or a user interface (AUM-1-2), it relies on an authentication mechanism whenever the access would let an entity read confidential data (personal information, privacy function configuration or security parameters classed confidential), alter sensitive data (the same three classes where classed sensitive), or invoke a privacy or security function. Authentication may be dropped for access to personal information or to privacy functions and their configuration where the equipment cannot do its intended job with authentication in the way, and for networks or user interfaces that the target environment already shields, physically or logically, so that only authorised entities can reach them.