The following re-wording was proposed in Casablanca, but several questions were raised:

• Does this apply to all VNFs or does it just need to be part of the network path by some VNF?
• Should it be scoped to a particular category of VNF?
• What is the scope of monitoring and is it something beyond the other requirements we have in Security?

Current Requirement: The VNF MUST support event logging, formats, and delivery tools to provide the required degree of event data to ONAP.

Proposed Requirement: The VNF MUST have the capability of generating security logs for all components and layers of the VNF.

Reason: simplify the requirement