ENV-001i — Define Security Constraints

Go to ENV-001 — Define Test Environment

The DIDO-TE SHALL define each security Constraint applicable to a Test Environment or record that no security Constraint applies and provide the basis for the determination.

• [DTE5] DIDO-TE Requirements Register, source requirement identifier and obligation to be assigned
• [DTE6] Structured Information Processing Reference Architecture (SIP-RA)
• [DTE7] Federated Data Interpretation Systems Reference Architecture (FDIS-RA)

Defining the applicable security Constraints establishes the conditions governing access, identity, authentication, authorization, confidentiality, integrity, isolation, and information handling within a Test Environment.

The defined Constraints support secure instantiation and operation of the Test Environment, validation of its security state, and assessment of whether a security condition influenced a Test Execution or Test Result.

An explicit determination that no security Constraint applies distinguishes an intentional condition from missing information.

• Test Environment
• Constraint
• Node
• Test Object
• Test Resource

Verification confirms that:

• Each Test Environment defines every applicable security Constraint.
• Each defined security Constraint identifies the element, relationship, information, or operation it governs.
• The instantiated Test Environment satisfies each applicable security Constraint.
• A Test Environment without an applicable security Constraint records the determination and its basis.
• A missing, undefined, or unsatisfied applicable security Constraint constitutes nonconformance with this requirement.

Verification includes:

• Inspection of the controlled information for each Test Environment
• Inspection of the defined security Constraints
• Inspection or testing of the security conditions present in the instantiated Test Environment
• Comparison of the observed security conditions with the defined security Constraints
• Inspection of recorded determinations that no security Constraint applies
• Inspection of the basis recorded for each such determination
• A negative assessment using a Test Environment that violates an applicable security Constraint
• Confirmation that the negative assessment produces a nonconformance result

• Add links to the architecture sections governing Test Environment security and security Constraints.

Assign the applicable delivery phase.

Draft

Use the following syntax to reference this requirement’s Statement section from another DokuWiki page:

{{section>dido:03-dido-te:99-annexes:annex-c-requirements:02-test-environment-requirements:env-001-define-test-environment:env-001i-define-security-constraints#Statement&noheader&nofooter&noeditbtn}}