| 1 | Encryption and Key Management | Protect stored credentials, access tokens, audit records, and configuration data from unauthorized disclosure or alteration. | Use AES-128 or AES-256 with an authenticated encryption mode such as GCM where supported. Encryption keys should be generated, stored, rotated, revoked, and destroyed through controlled key-management procedures. Never use hard-coded or shared default keys. | Is encryption applied both in transit and at rest? Are keys unique per device or account? Can compromised keys be revoked and replaced? | Critical |
| 2 | Secure Communications | Prevent eavesdropping, impersonation, replay attacks, and unauthorized commands between the lock, mobile application, hub, and cloud service. | Use modern authenticated transport security, such as TLS 1.2 or newer, with certificate validation and protection against downgrade attacks. Pairing should use authenticated, time-limited procedures rather than unauthenticated discovery. | Does the solution validate certificates? Are communication sessions authenticated in both directions where appropriate? Are replayed commands rejected? | Critical |
| 3 | Identity and Access Control | Ensure that only authorized users can unlock doors, change permissions, enroll credentials, or modify security settings. | Apply least privilege, unique user accounts, role-based permissions, automatic session expiration, and multi-factor authentication for administrative access. Avoid shared accounts and permanent unrestricted access. | Can permissions be assigned by role? Is multi-factor authentication available for administrators? Can lost phones, cards, PINs, and user sessions be disabled immediately? | Critical |
| 4 | Credential and PIN Protection | Reduce the risk of guessing, credential theft, unauthorized enrollment, and misuse of temporary access codes. | Require strong PIN policies, rate limiting, lockout or progressive delays after failed attempts, secure password hashing for server-side credentials, and expiring guest codes. Do not store PINs or passwords in plaintext. | Are repeated attempts throttled? Do temporary credentials expire automatically? Are administrative credentials separated from everyday user credentials? | High |
| 5 | Secure Updates and Vulnerability Management | Maintain protection after deployment and reduce exposure to newly discovered software and firmware vulnerabilities. | Use digitally signed firmware, verified update packages, secure boot where supported, rollback protection, documented vulnerability disclosure procedures, and a defined security-support period. Updates should fail safely without leaving the device in an insecure state. | Are firmware updates authenticated before installation? How long are security updates provided? Is there a documented process for reporting and resolving vulnerabilities? | Critical |
| 6 | Auditability, Monitoring, and Recovery | Detect suspicious activity, support investigations, and preserve safe access during network, power, or service interruptions. | Maintain tamper-resistant logs for access events, administrative changes, failed attempts, and credential enrollment. Synchronize timestamps securely, alert on abnormal activity, and provide a tested recovery process with secure local operation or an emergency access method. | Can authorized administrators review and export logs? Are logs protected from unauthorized modification? What happens if the internet, mobile application, hub, or battery fails? | High |
| 7 | Privacy, Lifecycle, and Physical Resilience | Minimize personal-data exposure and preserve security throughout installation, ownership transfer, maintenance, and disposal. | Collect only necessary data, define retention periods, restrict administrator access, and support secure account removal and factory reset. Evaluate tamper resistance, battery monitoring, mechanical override controls, and safe behavior during power loss. | What data is collected and how long is it retained? Can ownership be transferred securely? Does a reset remove credentials and tokens? Does the physical design resist bypass and tampering? | High |