1. Purpose and scope
Requirements are where security becomes something engineering can build and test. Each requirement answers a threat, states what must hold in terms a verifier can check, and carries an assurance target that says how strong the evidence must be. A requirement that cannot be traced to a threat is either missing its reason or not needed; a high threat with no requirement is a gap.
The same stage sets the compliance targets, because they shape requirements as much as threats do. Certification schemes bring their own security functional and assurance requirements; regulations such as the EU Cyber Resilience Act bring obligations on vulnerability handling, updates, the software bill of materials and support periods; export control rules decide how cryptography may be offered; and the security protocols customers use set what must interoperate.
In scope: the security requirements specification, the security traceability matrix, the certification and assurance plan, the regulatory security assessment and the export classification record. Out of scope: allocating requirements to architecture elements, which happens in Security Architecture.
14 more sections for registered members.