ISO/IEC 21827

ISO/IEC 21827:2002(E)
7.9 PA09 - Provide Security Input
7.9.1 Process Area
7.9.1.1 Summary Description
The purpose of Provide Security Input is to provide system architects, designers, implementers, or users with the
security information they need. This information includes security architecture, design, or implementation alternatives
and security guidance. The input is developed, analysed, provided to and coordinated with the appropriate organization
members based on the security needs identified in PA01 Specify Security Needs.
7.9.1.2 Goals
• All system issues are reviewed for security implications and are resolved in accordance with security goals;
• All members of the project team have an understanding of security so they can perform their functions;
• The solution reflects the security input provided.
7.9.1.3 Base Practice List
BP.09.01
BP.09.02
BP.09.03
BP.09.04
BP.09.05
BP.09.06
Work with designers, developers, and users to ensure that appropriate parties have a common
understanding of security input needs.
Determine the security constraints and considerations needed to make informed engineering
choices.
Identify alternative solutions to security related engineering problems.
Analyse and prioritize engineering alternatives using security constraints and considerations.
Provide security related guidance to the other engineering groups.
Provide security related guidance to operational system users and administrators.
7.9.1.4 Process Area Notes
This process area provides security input to support system design and implementation activities. The focus is on how
security is an integral part of system development and not an end unto itself. Each of the base practices uses input from
the entire engineering organization, produces security specific results, and communicates those results back to the
entire engineering organization. The processes identified are applicable to the development of new facilities or the
operation and maintenance of existing ones.
This process area covers security input to both development (designers and implementors) and operation (users and
administrators). In addition, by combining the design and implementation security activities into a single process area, it
emphasizes that these activities are very similar, but are at different levels of abstraction. The alternative solutions
range in scope from full system architectures to individual components. Some aspects of security requirements impact
the environment in which the system is developed rather than the system itself.
All base practices within this process area can be iterative and all occur at multiple points through the system life cycle.
7.9.2 BP.09.01 - Understand Security Input Needs
Work with designers, developers, and users to ensure that appropriate parties have a common understanding of
security input needs.
7.9.2.1 Description
Security engineering is coordinated with other disciplines to determine the types of security input that are helpful to
those disciplines. Security input includes any sort of guidance, designs, documents, or ideas related to security that
should be considered by other disciplines. Input can take many forms, including documents, memoranda, e-mail,
training, and consultation.
This input is based on the needs determined in PA01 Specify Security Needs. For example, a set of security rules may
need to be developed for the software engineers. Some of the inputs are more related to the environment than the
© ISO/IEC 2002 – All rights reserved 47