6.1.2. For the purpose of point 6.1.1, the processes referred to in point 6.1.1 shall include: (a) …

(a)

security requirements to apply to the ICT services or ICT products to be acquired;

(b)

requirements regarding security updates throughout the entire lifetime of the ICT services or ICT products, or replacement after the end of the support period;

(c)

information describing the hardware and software components used in the ICT services or ICT products;

(d)

information describing the implemented cybersecurity functions of the ICT services or ICT products and the configuration required for their secure operation;

(e)

assurance that the ICT services or ICT products comply with the security requirements according to point (a);

(f)

methods for validating that the delivered ICT services or ICT products are compliant to the stated security requirements, as well as documentation of the results of the validation.