ISO/IEC 21827

ISO/IEC 21827:2002(E)
7.6.1.2 Goals
• The work products and processes clearly provide the evidence that the customer's security needs have been
met.
7.6.1.3 Base Practice List
BP.06.01
BP.06.02
BP.06.03
BP.06.04
BP.06.05
Identify the security assurance objectives.
Define a security assurance strategy to address all assurance objectives.
Identify and control security assurance evidence.
Perform analysis of security assurance evidence.
Provide a security assurance argument that demonstrates the customer's security needs are
met.
7.6.1.4 Process Area Notes
Activities involved in building an assurance argument include managing the identification, planning, packaging, and
presentation of security assurance evidence.
7.6.2 BP.06.01 - Identify Assurance Objectives
Identify the security assurance objectives.
7.6.2.1 Description
Assurance objectives as determined by the customer, identify the level of confidence needed in the system. The system
security assurance objectives specify a level of confidence that the system security policy is enforced. Adequacy of the
objectives is determined by the developer, integrator, customer, and those who will approve the operation of the system,
if any.
Identification of new, and modification to existing, security assurance objectives are coordinated with all security-related
groups internal to the engineering organization and groups external to the engineering organization (e.g., customer,
systems security certifier, user).
The security assurance objectives are updated to reflect changes. Examples of changes requiring a modification in
security assurance objectives include changes in the level of acceptable risk by the customer, system security certifier,
or user, or changes in the requirements or interpretations of the requirements.
Security assurance objectives must be communicated so as to be unambiguous. Applicable interpretations are included
or developed if necessary.
7.6.2.2 Example Work Products
• statement of security assurance objectives - identifies the customer's requirements for the level of confidence
needed in a system's security features.
7.6.2.3 Notes
In cases where a specific claim is not mandated, it is helpful if the assurance objectives can be stated or related to a
specific assurance claim to be achieved or met. This helps to reduce misunderstandings and ambiguity.
7.6.3 BP.06.02 - Define Assurance Strategy
Define a security assurance strategy to address all assurance objectives.
7.6.3.1 Description
The purpose of a security assurance strategy is to plan for and ensure that the security objectives are implemented and
enforced correctly. Evidence produced through the implementation of a security assurance strategy should provide an
38 © ISO/IEC 2002 – All rights reserved