Test 1-2

---

TEST 1

Test Case ID: BIS-1.6.1 Test Name: TC_CHECK_TAMPER_RESISTANCE_FEATURES_SOFTWARE

---

Objective

To verify, in the presence of the OEM team, that the device has effective software tamper resistance and/or tamper detection mechanisms implemented, and that these features function as intended to prevent unauthorized software modifications.

---

Tools Used

• OEM-provided documentation of software tamper resistance/detection features

• Firmware integrity verification tools (e.g., checksum/hash utilities, code signing verification tools)

• DUT management interface (CLI/API) for monitoring tamper events

• Test scripts or utilities to simulate software tampering attempts

---

Test Execution Steps

1. Documentation Review

   • Review OEM documentation describing software tamper resistance and detection mechanisms (e.g., secure boot, firmware signature verification, runtime integrity checks).

2. Implementation Verification

   • Check DUT configuration to ensure documented mechanisms are enabled.

   • Validate that the system is capable of detecting unauthorized software modifications.

3. Tamper Attempt & Response Validation

   • Perform a controlled software tampering attempt (e.g., modifying firmware file or altering configuration in an unauthorized manner) in the presence of the OEM team.

   • Observe DUT’s detection and response (e.g., blocking execution, logging event, triggering alerts).

---

Expected Results for Pass

• All documented software tamper resistance/detection mechanisms are present and enabled in the DUT.

• The DUT detects and responds appropriately to unauthorized software modifications.

• The response aligns with vendor claims and security requirements.

---

Test Observations

(Insert findings here — e.g., "Secure boot verified active; modified firmware rejected with error; tamper event logged in system security log.")

---

Evidence Provided

• Screenshots/logs showing tamper detection events

• Command outputs confirming secure boot or code signing enforcement

• OEM-signed verification of test results

---

Test Case Result

☐ Pass – Software tamper resistance/detection functions as intended ☐ Fail – Mechanisms missing, disabled, or ineffective

---

TEST 2

Test Case ID: BIS-1.6.2 Test Name: TC_CHECK_TAMPER_RESISTANCE_FEATURES_HARDWARE

---

Objective

To verify, in the presence of the OEM team, that the device has effective hardware tamper resistance and/or tamper detection mechanisms implemented, and that these features function as intended to prevent unauthorized physical access or modifications.

---

Tools Used

• OEM-provided documentation of hardware tamper resistance/detection features

• Inspection tools (e.g., magnifying glass, flashlight) for seal verification

• Multimeter or test probes (if applicable, for sensor testing)

• Tamper event monitoring interface (CLI/API)

• Non-destructive tamper simulation tools approved by OEM

---

Test Execution Steps

1. Physical Inspection

   • With the OEM team present, inspect the DUT for tamper-evident seals, chassis intrusion detection switches, or other physical security features.

2. Simulated Tampering

   • Conduct controlled, non-destructive tampering attempts (e.g., loosening screws, opening chassis, attempting access to secured hardware components) as approved by OEM.

3. Response Evaluation

   • Observe and document the DUT’s detection and response to simulated tampering (e.g., alarm activation, logging event, device shutdown).

4. Hardware Security Feature Verification

   • Check for presence and operation of hardware security components such as TPM chips, secure microcontrollers, or enclosure locks that provide physical security.

---

Expected Results for Pass

• All documented hardware tamper resistance/detection features are present and functional.

• The DUT detects and responds appropriately to approved simulated tampering attempts.

• Hardware security controls align with OEM documentation and security requirements.

---

Test Observations

(Insert findings here — e.g., "Chassis intrusion switch triggered upon opening; event logged in security log; tamper-evident seals intact.")

---

Evidence Provided

• Photographs of tamper seals and security components

• Logs/screenshots of tamper event detection

• OEM-signed verification report

---

Test Case Result

☐ Pass – Hardware tamper resistance/detection functions as intended ☐ Fail – Mechanisms missing, disabled, or ineffective

---

Overall Test Result

(Summarize the combined outcome of BIS-1.6.1 and BIS-1.6.2 — e.g., "Both software and hardware tamper resistance/detection mechanisms verified as functional and compliant with requirements.")