5.3-6: If the device supports automatic updates and/or update notifications, these should be enabled in the initialized state and configurable so that the user can enable, disable, or postpone installation of security updates and/or update notifications. RC (9, 12) 5.3-7: The device shall use best practice cryptography to facilitate secure update mechanisms. MC (12) RC (9, 12) RC (9, 12) RC (9, 12) Supporting evidence shall show the following: 1. the update notifications to the user 2. the default configuration for such notifications MC (12) MC (12) MC (12) 3. the available options that can be taken by the user when security updates are available Supporting evidence shall state the cryptographic functions and algorithms used, and/or referenced standards (if any) to support the secure update mechanism(s) as stated in Provision 5.32. Examples of best practice cryptography for secure update mechanisms, not limited to the following: • 5.3-8: MC MC MC MC Use of TLS 1.2 and above for the communication of security updates • Use of a digital signature for verifying the authenticity and integrity of the software updates Supporting evidence shall describe the CLS Publication #2 | Page 29 of 49