GPR-020 — Secure Implementation and Deployment

Go to Annex C: Requirements

The Submission SHALL demonstrate that the proposed specification can be implemented and deployed securely in environments governed by applicable security requirements.

Mandatory

A specification intended for use in operational environments must permit implementations to satisfy the security requirements applicable to those environments.

The proposed specification should not introduce architectural assumptions, required behaviors, or dependencies that prevent appropriate authentication, authorization, auditing, confidentiality, integrity, availability, message protection, or other necessary security controls.

This requirement does not prescribe a particular security technology, product, protocol, or deployment architecture.

A conforming Submission demonstrates that:

1. The proposed specification supports implementation in environments governed by security requirements
2. Architectural elements and interactions that affect security are identified
3. Applicable security controls can be applied without violating the normative requirements of the proposed specification
4. The proposed specification does not require insecure behavior or prevent the use of necessary security mechanisms
5. Security can be addressed across applicable deployment configurations and operational boundaries
6. Any security assumptions, dependencies, limitations, or residual risks are identified

This requirement establishes security feasibility. It does not require every conforming implementation to operate at the same security level or use identical security controls.

The security controls an implementation applies depend on its operational environment, applicable policies, risk assessment, and security requirements.

GPR-021 defines the security analysis that supports the demonstration required by this requirement.

To transclude the authoritative Statement into another page, use:

{{section>public:00-sip-ra:99-annexes:annex-c-requirements:gpr-020-secure-implementation-and-deployment#Statement&noheader&nofooter&noeditbtn}}