The 62443 security requirement described in CR 3.3 - Security Functionality Verification - should be discussed and a determination of how much of what it is requiring OPC UA meets

for CR 3.9 Protection of audit information - does this mean on at rest or does it include transmission - also how does new LogObject factor in? Again discussion for Security group

Also should look at all, with regards to LogObject addition (related to Audit event logging)