====== ENV-002h — Enforce Security Constraints ======

[[dido:03-dido-te:99-annexes:annex-c-requirements:03-functional-requirements:03-01-test-environment-requirements:env-002-configure-test-environment:start|Go to ENV-002 — Configure Test Environment]]

===== Statement =====

The [[dido:99_annexes:annex-b-terms-and-definitions:d:dido-te|DIDO-TE]] SHALL enforce each security [[dido:99_annexes:annex-b-terms-and-definitions:c:constraint|Constraint]] applicable to a [[dido:99_annexes:annex-b-terms-and-definitions:t:test_environment|Test Environment]] before and during [[dido:99_annexes:annex-b-terms-and-definitions:t:test_execution|Test Execution]].

===== Derived From =====

  * [[dido:03-dido-te:99-annexes:annex-b-references:dte-005|[DTE5] DIDO-TE Requirements Register]], source requirement identifier and obligation to be assigned
  * [[dido:03-dido-te:99-annexes:annex-b-references:dte-006|[DTE6] Structured Information Processing Reference Architecture (SIP-RA)]]
  * [[dido:03-dido-te:99-annexes:annex-b-references:dte-007|[DTE7] Federated Data Interpretation Systems Reference Architecture (FDIS-RA)]]

===== Rationale =====

Security [[dido:99_annexes:annex-b-terms-and-definitions:c:constraint|Constraints]] establish the protections governing access to and interaction with a [[dido:99_annexes:annex-b-terms-and-definitions:t:test_environment|Test Environment]] and its constituent elements.

Enforcing these Constraints protects the confidentiality, integrity, authenticity, availability, and permitted use of [[dido:99_annexes:annex-b-terms-and-definitions:t:test_object|Test Objects]], [[dido:99_annexes:annex-b-terms-and-definitions:n:node|Nodes]], [[dido:99_annexes:annex-b-terms-and-definitions:t:test_resource|Test Resources]], communications, data, configurations, and [[dido:99_annexes:annex-b-terms-and-definitions:e:evidence|Evidence]].

Maintaining the specified security conditions prevents unauthorised access, prohibited communication, uncontrolled modification, and other security violations from affecting [[dido:99_annexes:annex-b-terms-and-definitions:t:test_execution|Test Execution]] or the resulting [[dido:99_annexes:annex-b-terms-and-definitions:t:test_result|Test Results]].

===== Applies To =====

  * [[dido:99_annexes:annex-b-terms-and-definitions:t:test_environment|Test Environment]]
  * [[dido:99_annexes:annex-b-terms-and-definitions:c:constraint|Constraint]]
  * [[dido:99_annexes:annex-b-terms-and-definitions:t:test_execution|Test Execution]]
  * [[dido:99_annexes:annex-b-terms-and-definitions:t:test_object|Test Object]]
  * [[dido:99_annexes:annex-b-terms-and-definitions:n:node|Node]]
  * [[dido:99_annexes:annex-b-terms-and-definitions:t:test_resource|Test Resource]]
  * [[dido:99_annexes:annex-b-terms-and-definitions:c:configuration|Configuration]]
  * [[dido:99_annexes:annex-b-terms-and-definitions:e:evidence|Evidence]]

===== Verification =====

Verification confirms that:

  * The DIDO-TE identifies every security Constraint applicable to the Test Environment.
  * The DIDO-TE enforces each applicable security Constraint before and during Test Execution.
  * The enforced Constraints govern identity, authentication, authorisation, access, isolation, communication, data protection, integrity, and audit recording, when applicable.
  * The DIDO-TE excludes access, operations, and communications prohibited by the applicable security Constraints.
  * The DIDO-TE records security-relevant events and violations as Evidence.
  * The DIDO-TE maintains [[dido:99_annexes:annex-b-terms-and-definitions:t:traceability|Traceability]] among each security Constraint, its enforcement mechanism, and the applicable Test Execution.
  * The DIDO-TE prevents Test Execution when a required security Constraint remains unsatisfied before execution.
  * The DIDO-TE identifies a security Constraint violation occurring during Test Execution and records its relationship to the affected Test Execution and Test Results.
  * A missing, unenforced, violated, or untraceable security Constraint constitutes nonconformance with this requirement.

Verification includes:

  * Inspection of the security Constraints applicable to the Test Environment
  * Inspection of the mechanisms enforcing each security Constraint
  * Inspection of identity, authentication, authorisation, access-control, isolation, communication-protection, integrity, and audit records, when applicable
  * Testing of permitted access, operations, and communications
  * Testing for the exclusion of prohibited access, operations, and communications
  * Inspection of security Evidence and Traceability records
  * A negative assessment using an unsatisfied security Constraint before Test Execution
  * Confirmation that the DIDO-TE prevents Test Execution when the Constraint remains unsatisfied
  * A negative assessment introducing a security Constraint violation during Test Execution
  * Confirmation that the DIDO-TE identifies and records the violation and its relationship to the affected Test Execution and Test Results

===== Referenced By =====

{{backlinks>.}}

===== Related Architecture Sections =====

  * Add links to the architecture sections governing security Constraints, access control, communications protection, audit recording, and security-event handling.

===== Delivery Phase =====

Assign the applicable delivery phase.

===== Requirement Status =====

Draft

===== Statement Reference =====

Use the following syntax to reference this requirement’s Statement section from another DokuWiki page:

<code dokuwiki>
{{section>dido:03-dido-te:99-annexes:annex-c-requirements:02-test-environment-requirements:env-002-configure-test-environment:env-002h-enforce-security-constraints#Statement&noheader&nofooter&noeditbtn}}
</code>

----

<WRAP centeralign>
© 2026 Dido Solutions, Inc. and Jackrabbit Consulting, Inc.
</WRAP>