Used before Security requirements baselined and Assurance and compliance plan agreed, to confirm the work of Security Requirements & Compliance Targets is done, its work products are at the right maturity and its decisions are recorded. Run by the stage leads and checked by the product security owner.
MustDone: write requirements from the threat model.
for each mitigated threat, one or more requirements stated as behaviour that must or must not happen, with the threat it answers and its assurance target.
MustDone: add requirements from schemes and regulation.
map the security functional requirements of the target schemes and any protection profile, and the regulatory obligations of each market, to product requirements, and record where a scheme demands evidence rather than a feature.
MustDone: write supplier requirements.
what IP, firmware, foundry, assembly and test suppliers must provide, including their own vulnerability handling, evidence and incident contacts.
MustDone: list protocol and interoperability requirements.
the security protocols, attestation formats and key exchange schemes, by public specification name and version, with the conformance or interoperability test that will show each.
MustDone: classify the cryptography for export control with trade compliance and record the classification and any licence or notice needed.
MustDone: build the traceability matrix from threats to requirements, leaving the columns for architecture elements and tests to be filled in later stages.
39 more items for registered members.
The full lifecycle detail, with its charts, flows, tables and every section, is for registered members. Registration is free and takes a minute. You come back to this page afterwards.