The NiT has issued a technical decision for clarification about FIA_AFL.1.

1. FIA_AFL.1 is a mandatory SFRs that the TOE will need to meet.

2. FIA_AFL.1 requires at least one remote administrative interface support password authentication.

3. If SSH is the TOE’s only remote administrative interface, it needs to support password authentication. If there is another administrative interface (e.g. a web GUI) that supports password authentication, SSH does not need to support password authentication and, by extension, FIA_AFL.1.

For further information, please see the NiT interpretation at: https://www.niap-ccevs.org/Documents_and_Guidance/ccevs/NITDecisionRfI202011.pdf

See issue description.