clarification on FAU_GEN.1

Given that PSDs typically have limited memory, it is overly broad for FAU_GEN.1 to require auditing of "all management functions" as defined by FMT_MOF.1 and FMT_SMF.1. It should more appropriately be all management functions that modify TSF data or the TOE's behavior. The act of viewing TSF data is technically a management function but it is not reasonable to assume that every act of viewing data needs to be audited.

For example, an administrator may be able to view the TOE's audit logs, or view the list of allow/denylisted devices, or view the TOE firmware version, and all of these could be considered "management functions" if "management" implies the ability to query data. But it should not be expected that "view audit logs/view device filtration/view firmware version" are auditable events that could be generated, otherwise it is trivially easy to overwrite meaningful log data (such that any log data generated by a KVM is meaningful) with a bunch of logs about what the administrator queried, even inadvertently.

This is consistent with the NDcPP's definition of "all administrative actions" as an auditable event in FAU_GEN.1 where an "administrative action" is generally well-understood to be the act of creating, modifying, or deleting data and not viewing it.

Read FAU_GEN.1 alongside the referenced FMT_MOF.1 and FMT_SMF.1 definitions, then compare the NDcPP treatment of administrative actions. Done means resolving and documenting whether auditing covers management functions that modify TSF data or TOE behavior, rather than merely viewing data.