====== 5.1.11 Security ======

[[public:00-sip-ra:05-general-requirements-on-proposals:05-1-requirements:start|Return to Requirements]]

The proposed specification supports secure implementation and use in environments governed by applicable security requirements. The accompanying security analysis documents the security-sensitive elements, policy controls, default protections, assumptions, dependencies, and implementation considerations associated with the proposed specification.

===== Requirements =====

^ Requirement ^ Level ^ Statement ^
| [[public:00-sip-ra:99-annexes:annex-c-requirements:gpr-020-secure-implementation-and-deployment|GPR-020 — Secure Implementation and Deployment]] | Mandatory | {{section>public:00-sip-ra:99-annexes:annex-c-requirements:gpr-020-secure-implementation-and-deployment#Statement&noheader&nofooter&noeditbtn}} |
| [[public:00-sip-ra:99-annexes:annex-c-requirements:gpr-021-security-analysis|GPR-021 — Security Analysis]] | Mandatory | {{section>public:00-sip-ra:99-annexes:annex-c-requirements:gpr-021-security-analysis#Statement&noheader&nofooter&noeditbtn}} |

===== Required Security Analysis =====

The security analysis required by GPR-021 addresses the following questions:

  - What security-sensitive elements, if any, does the proposed specification introduce
  - Which forms of access to each security-sensitive element should be subject to security-policy control
  - Which services, facilities, or architectural elements need to be security-aware
  - Which default policies, including authentication, auditing, authorization, and message protection, should apply to the security-sensitive elements
  - Which security considerations should implementers understand and address
  - Which security assumptions, dependencies, limitations, and residual risks apply

===== Notes for Editors =====

The requirement Statements displayed in this section are transcluded from their authoritative Annex C requirement records and are not independently maintained copies.

GPR-020 and GPR-021 are mandatory requirements.

GPR-020 requires evidence that the proposed specification permits secure implementation and deployment. It does not prescribe a particular security technology, product, protocol, or deployment architecture.

The questions under Required Security Analysis define the required coverage of GPR-021. They are not independently numbered requirements.

A Submission may determine that the proposed specification introduces no security-sensitive elements. In that case, the Submission should state that conclusion and provide its supporting analysis rather than omit the security analysis.

OMG has adopted specifications addressing different aspects of security that may provide useful resources for preparing the required analysis [SEC] [RAD].

Make changes to a Statement on its corresponding Annex C requirement page.

----

<WRAP centeralign>
© 2026 Dido Solutions, Inc. and Jackrabbit Consulting, Inc.
</WRAP>