ISO/IEC 21827

ISO/IEC 21827:2002(E)
7.10.1.3 Base Practice List
BP.10.01
BP.10.02
BP.10.03
BP.10.04
BP.10.05
BP.10.06
BP.10.07
Gain an understanding of the customer's security needs.
Identify the laws, policies, standards, external influences and constraints that govern the
system.
Identify the purpose of the system in order to determine the security context.
Capture a high-level security oriented view of the system operation.
Capture high-level goals that define the security of the system.
Define a consistent set of statements which define the protection to be implemented in the
system.
Obtain agreement that the specified security requirements match the customer's needs.
7.10.1.4 Process Area Notes
This process area covers the activities defining all aspects of security in the entire information system (e.g., physical,
functional, procedural). The base practices address how the security needs are identified and refined into a coherent
baseline of security-related requirements which used in the design, development, verification, operation, and
maintenance of the system. In most cases it is necessary to take into account the existing environment and associated
security needs. The information gained and produced by this process area is collected, further refined, used, and
updated throughout a project (particularly in Provide Security Input (PA02)), in order to ensure customer needs are
being addressed.
7.10.2 BP.10.01 - Gain Understanding of Customer's Security Needs
Gain an understanding of the customer's security needs.
7.10.2.1 Description
The purpose of this base practice is to collect all information necessary for a comprehensive understanding of the
customer's security needs. These needs are influenced by the importance to the customer of security risk. The target
environment in which the system is intended to operate also influences the customer's needs with regard to security.
7.10.2.2 Example Work Products
• customer security needs statement - high-level description of security required by the customer.
7.10.2.3 Notes
The term customer may refer to a specific recipient of a product, system, or service, or may refer to a generalized
recipient based upon market research or product targeting. Different groups of users may need to be identified and
distinguished. For example, ordinary users may have different needs from administrators.
7.10.3 BP.10.02 - Identify Applicable Laws, Policies, And Constraints
Identify the laws, policies, standards, external influences and constraints that govern the system.
7.10.3.1 Description
The purpose of this base practice is to gather all external influences which affect the security of the system. A
determination of applicability should identify the laws, regulations, policies and commercial standards which govern the
target environment of the system. A determination of precedence between global and local policies should be
performed. Requirements for security placed on the system by the system customer must be identified and the security
implications extracted.
7.10.3.2 Example Work Products
• security constraints - laws, policies, regulations, and other constraints that influence the security of a system;
• security profile - security environment (threats, organizational policy); security objectives (e.g., threats to be
countered); security functional and assurance requirements; rationale that system developed to these
© ISO/IEC 2002 – All rights reserved 51