====== GPR-021 — Security Analysis ======

[[public:00-sip-ra:99-annexes:annex-c-requirements:start|Go to Annex C: Requirements]]

===== Statement =====

The Submission SHALL provide a security analysis identifying the security-sensitive elements introduced by the proposed specification, the applicable security-policy controls, the required security awareness, the recommended default security policies, and the security considerations applicable to implementers.

===== Requirement Level =====

Mandatory

===== Rationale =====

A security analysis makes the security implications of the proposed specification explicit and allows reviewers, implementers, operators, and responsible authorities to determine whether appropriate protections can be applied.

Identifying security-sensitive elements, controlled forms of access, security-aware components, default policies, and implementation considerations reduces the risk that security requirements remain implicit or are applied inconsistently.

===== Required Analysis =====

The security analysis addresses:

  - Security-sensitive elements introduced by the proposed specification
  - Forms of access to those elements that should be subject to security-policy control
  - Services, facilities, or architectural elements that need to be security-aware
  - Recommended default policies for authentication, auditing, authorization, message protection, and other applicable controls
  - Security considerations that implementers need to understand and address
  - Security assumptions, dependencies, limitations, and residual risks

===== Evaluation Criteria =====

A conforming Submission demonstrates that:

  - Each security-sensitive element is identified or the absence of such elements is explicitly stated and justified
  - Access requiring security-policy control is identified
  - Security-aware services, facilities, and architectural elements are identified
  - Recommended default security policies are described
  - Security considerations relevant to implementation and deployment are documented
  - Security assumptions, dependencies, limitations, and residual risks are disclosed
  - The analysis supports the secure-implementation demonstration required by GPR-020

===== Referenced By =====

{{backlinks>public:00-sip-ra:99-annexes:annex-c-requirements:gpr-021-security-analysis}}

===== Related Requirements =====

  - [[public:00-sip-ra:99-annexes:annex-c-requirements:gpr-020-secure-implementation-and-deployment|GPR-020 — Secure Implementation and Deployment]]
  - [[public:00-sip-ra:99-annexes:annex-c-requirements:sip-017-cross-security-boundary-integration|SIP-017 — Cross-Security-Boundary Integration]]
  - [[public:00-sip-ra:99-annexes:annex-c-requirements:sip-018-information-flow-segmentation|SIP-018 — Information-Flow Segmentation]]

===== Notes for Editors =====

The Required Analysis section elaborates the required coverage of this requirement. Its entries are not independently numbered requirements.

A Submission may determine that the proposed specification introduces no security-sensitive elements. In that case, the Submission must state that conclusion and provide its supporting analysis.

OMG security specifications identified by references [SEC] and [RAD] may provide useful resources for preparing this analysis.

To transclude the authoritative Statement into another page, use:

<code dokuwiki>
{{section>public:00-sip-ra:99-annexes:annex-c-requirements:gpr-021-security-analysis#Statement&noheader&nofooter&noeditbtn}}
</code>

----

<WRAP centeralign>
© 2026 Dido Solutions, Inc. and Jackrabbit Consulting, Inc.
</WRAP>