diff --git a/index.bs b/index.bs
index d114136..398a97d 100644
--- a/index.bs
+++ b/index.bs
@@ -1476,8 +1476,8 @@ method, when invoked, MUST run the following steps:
 1. Let |global| be [=this=]'s [=relevant global object=].
 1. If [=check if the device is configured=] with [=this=] returns a
     {{Promise}}, return that value.
-1. If [=check the validity of the control transfer parameters=] with [=this=]
-    and |setup| returns a {{Promise}}, return that value.
+1. If [=check the validity of the control transfer parameters=] with [=this=],
+    |setup|, and {{"in"}} returns a {{Promise}}, return that value.
 1. Let |promise| be [=a new promise=].
 1. Run the following steps [=in parallel=].
     1. If |length| is greater than 0, let |buffer| be a host buffer with space
@@ -1515,8 +1515,8 @@ method, when invoked, MUST run the following steps:
 1. Let |global| be [=this=]'s [=relevant global object=].
 1. If [=check if the device is configured=] with [=this=] returns a
     {{Promise}}, return that value.
-1. If [=check the validity of the control transfer parameters=] with [=this=]
-    and |setup| returns a {{Promise}}, return that value.
+1. If [=check the validity of the control transfer parameters=] with [=this=],
+    |setup|, and {{"out"}} returns a {{Promise}}, return that value.
 1. [=Get a copy of the buffer source=] |data| and let the result be |bytes|.
 1. Let |promise| be [=a new promise=].
 1. Run the following steps [=in parallel=].
@@ -1797,27 +1797,49 @@ Issue(36): What configuration is the device in after it resets?
 
 <div algorithm="check the validity of the control transfer parameters">
 To <dfn>check the validity of the control transfer parameters</dfn> with the
-given {{USBDevice}} |device| and {{USBControlTransferParameters}} |setup|,
-perform the following steps:
+given {{USBDevice}} |device|, {{USBControlTransferParameters}} |setup|, and
+{{USBDirection}} |direction|, perform the following steps:
 
 1. Let |configuration| be the result of [=finding the current configuration=]
     with |device|.
 1. If |configuration| is `null`, return `undefined`.
+1. If |setup|.{{USBControlTransferParameters/requestType}} is {{"standard"}},
+    perform the following steps:
+    1. If |direction| is {{"out"}}, return [=a promise rejected with=] a
+        "{{SecurityError}}" {{DOMException}}.
+    1. If |setup|.{{USBControlTransferParameters/request}} is not one of
+        `0x00` (GET_STATUS), `0x06` (GET_DESCRIPTOR), `0x08` (GET_CONFIGURATION),
+        `0x0A` (GET_INTERFACE) or `0x0C` (SYNCH_FRAME), return [=a promise
+        rejected with=] a "{{SecurityError}}" {{DOMException}}.
+1. If |setup|.{{USBControlTransferParameters/requestType}} is {{"class"}},
+    perform the following steps:
+    1. Let |interfaceNumber| be the lower 8 bits of
+        |setup|.{{USBControlTransferParameters/index}}.
+    1. Let |interfaceIndex| be the result of [=finding the interface index=]
+        with |interfaceNumber| and |configuration|.
+    1. If |interfaceIndex| is not `-1`, perform the following steps:
+        1. Let |interface| be
+            |configuration|.{{USBConfiguration/[[interfaces]]}}[|interfaceIndex|].
+        1. If |interface|.{{USBInterface/[[isProtectedClass]]}} is `true`,
+            return [=a promise rejected with=] a "{{SecurityError}}"
+            {{DOMException}}.
 1. If |setup|.{{USBControlTransferParameters/recipient}} is {{"interface"}},
     perform the following steps:
     1. Let |interfaceNumber| be the lower 8 bits of
         |setup|.{{USBControlTransferParameters/index}}.
     1. Let |interfaceIndex| be the result of [=finding the interface index=]
         with |interfaceNumber| and |configuration|.
-    1. If |interfaceIndex| is equal to `-1`, return [=a promise rejected with=]
-        a "{{NotFoundError}}" {{DOMException}}.
+    1. If |interfaceIndex| is `-1`, return [=a promise rejected with=] a
+        "{{NotFoundError}}" {{DOMException}}.
     1. Let |interface| be
         |configuration|.{{USBConfiguration/[[interfaces]]}}[|interfaceIndex|].
+    1. If |interface|.{{USBInterface/[[isProtectedClass]]}} is `true`, return [=a
+        promise rejected with=] a "{{SecurityError}}" {{DOMException}}.
     1. If the result of [=finding if the interface is claimed=] with
         |interface| is not `true`, return [=a promise rejected with=] an
         "{{InvalidStateError}}" {{DOMException}}.
-1. If |setup|.{{USBControlTransferParameters/recipient}} is {{"endpoint"}}, run
-    the following steps:
+1. If |setup|.{{USBControlTransferParameters/recipient}} is {{"endpoint"}},
+    perform the following steps:
     1. Let |endpointAddress| be |setup|.{{USBControlTransferParameters/index}}.
     1. Let |endpoint| be the result of [=finding the endpoint=] with
         |endpointAddress| and |device|.
@@ -1825,6 +1847,8 @@ perform the following steps:
         "{{NotFoundError}}" {{DOMException}}.
     1. Let |alternate| be |endpoint|.{{USBEndpoint/[[alternateInterface]]}}.
     1. Let |interface| be |alternate|.{{USBAlternateInterface/[[interface]]}}.
+    1. If |interface|.{{USBInterface/[[isProtectedClass]]}} is `true`, return [=a
+        promise rejected with=] a "{{SecurityError}}" {{DOMException}}.
     1. If the result of [=finding if the interface is claimed=] with |interface|
         is `false`, return [=a promise rejected with=] an
         "{{InvalidStateError}}" {{DOMException}}.