What it means
It includes functional, assurance, operational, privacy, resilience, and interface requirements with identifiers, sources, priorities, acceptance criteria, and ownership.
Why it matters
Without a controlled baseline, requirements drift silently and teams cannot reliably determine whether a design change preserves intended security outcomes.
Practical focus
- Give each requirement a stable identifier and source
- Write verifiable acceptance criteria
- Record dependencies, assumptions, and rationale
- Control changes through impact analysis and approval
Common mistakes
- Copying control statements without system context
- Using vague words such as secure or appropriate
- Failing to baseline interface and operational requirements
- Changing requirements without updating tests and traceability
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: