5 December 2023

CC:2022 allows a new type of "optional" SFR based on whether the TOE implements a particular product feature. If the TOE implements the feature, then the SFR must be claimed in the ST. We call these Implementation-dependent SFRs. This construct is used to declare the product features on which Implementation-dependent SFRs depend. It should appear in the Introduction.

	<section title="Product Features Mapped to Implementation-dependent Requirements" id="sec-features">
		The feature(s) enumerated below, if implemented by the TOE, require that additional SFRs be claimed in the ST.<h:br/>
		<implements>
			<feature id="feat-test1" title="Test Feature 1">
				<description>Description of test feature one.</description>
			</feature>
			<feature id="feat-test2" title="Test Feature 2">
				<description>Description of test feature two.</description>
			</feature>
		</implements>			
	</section>

The Features Declaration section includes only the identifiers, titles, and descriptions of the Features. This allows the Automation system to allow the ST Author to select the product features implemented by the TOE.

The Features are associated with SFRs by creating a dependency on the id attribute inside the <f-component> element of an SFR. Like this:

        <f-component id="sfr-ftp-tst-8" cc-id="ftp_tst.8" name="Test Three" status="feat-based">
	    <depends on-feat="feat-test2"/> 

In this case the SFR FTP_TST.8 is included in the Security Target if "Test Feature 2" is selected by the ST Author. A list of the dependent SFRs will appear in the Features section of the document along with each feature.