V4.3.3-derived requirement accidentally deleted, mapping is stale

Background

The mapping file shows v5.0.0-13.2.4: MODIFIED, MOVED FROM v4.0.3-4.3.3, but V13.2.4's current text has no relationship to V4.3.3. The V4.3.3-derived requirement was accidentally overwritten in April 2025 and no longer exists anywhere in the standard.

The last version of the requirement was:

Verify that, if the application allows changing configurations around credentials or connection parameters for integrations with databases and services, they are protected by extra controls such as authenticating again with at least one factor or multi-user approval.

How it was lost

The requirement originated from a long discussion in #1437 about protecting service integration configuration from being modified by attackers who gain admin access (e.g., via XSS or session hijacking). The original V4.3.3 was about step-up authentication and anti-fraud controls. It was rewritten in #1437 to focus on config-change protection, moved to V14.7.3, and renumbered to V13.2.4 during the v5.0.0 restructuring.

In #2951, four changes to V13.2 were proposed:

• Point 2 proposed minor wording fixes to the V4.3.3-derived text (passwords → credentials, remove "external"). This was applied in commit 935c0292, which also reordered the section so the updated text moved from 13.2.3 to 13.2.4.
• Point 3 proposed rewriting the V12.6.1-derived text (which moved from 13.2.4 to 13.2.5 in the same reordering commit) to be technology-agnostic. The discussion produced new wording agreed by @elarlang, @jmanico, and @tghosth.

Three days later, PR #2982 applied Point 3's new wording to the 13.2.4 slot — overwriting the Point 2 text that had just been updated. The commit message (e4c9d291) says "update 13.2.4 / v5.0.be-14.7.3, closes #2951". Nobody in the issue discussed deleting the V4.3.3-derived requirement — the intent was to rewrite V13.2.5 (the 12.6.1 text), not to replace V13.2.4.

Questions

1. Should the V4.3.3-derived requirement be restored? It addressed a real security concern (protecting service credential/connection configuration from being modified via the application's admin interface) that was discussed at length in #1437 and is not covered by any other current requirement.

2. The mapping needs to be corrected. The current mapping (v5.0.0-13.2.4: MODIFIED, MOVED FROM v4.0.3-4.3.3) is inaccurate — V13.2.4's text is now a rewrite of V12.6.1, not V4.3.3. If the requirement is not restored, the mapping should show V4.3.3 as DELETED.

Related

See also #3343, which discusses the overlap between V13.2.4 and V13.2.5 that resulted from the same incident.

Start by reading the mapping entry for v5.0.0-13.2.4 and the current V13.2.4 and V13.2.5 text, then review #1437, #2951, #2982, and related #3343. Done requires resolving whether the V4.3.3-derived requirement should be restored and correcting the mapping to reflect that decision.