public:00-sip-ra:05-general-requirements-on-proposals:05-1-requirements:05-1-11-security:start

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
Next revision		 Previous revision
public:00-sip-ra:05-general-requirements-on-proposals:05-1-requirements:05-1-11-security:start [2026/09/12 18:33] – removed - external edit (Unknown date) 127.0.0.1public:00-sip-ra:05-general-requirements-on-proposals:05-1-requirements:05-1-11-security:start [2026/09/15 13:45] (current) – nick_dido
Line 1: Line 1:
 +====== 5.1.11 Security ======
  
 +[[public:00-sip-ra:05-general-requirements-on-proposals:05-1-requirements:start|Return to Requirements]]
 +
 +The proposed specification supports secure implementation and use in environments governed by applicable security requirements. The accompanying security analysis documents the security-sensitive elements, policy controls, default protections, assumptions, dependencies, and implementation considerations associated with the proposed specification.
 +
 +===== Requirements =====
 +
 +^ Requirement ^ Level ^ Statement ^
 +| [[public:00-sip-ra:99-annexes:annex-c-requirements:gpr-020-secure-implementation-and-deployment|GPR-020 — Secure Implementation and Deployment]] | Mandatory | {{section>public:00-sip-ra:99-annexes:annex-c-requirements:gpr-020-secure-implementation-and-deployment#Statement&noheader&nofooter&noeditbtn}} |
 +| [[public:00-sip-ra:99-annexes:annex-c-requirements:gpr-021-security-analysis|GPR-021 — Security Analysis]] | Mandatory | {{section>public:00-sip-ra:99-annexes:annex-c-requirements:gpr-021-security-analysis#Statement&noheader&nofooter&noeditbtn}} |
 +
 +===== Required Security Analysis =====
 +
 +The security analysis required by GPR-021 addresses the following questions:
 +
 +  - What security-sensitive elements, if any, does the proposed specification introduce
 +  - Which forms of access to each security-sensitive element should be subject to security-policy control
 +  - Which services, facilities, or architectural elements need to be security-aware
 +  - Which default policies, including authentication, auditing, authorization, and message protection, should apply to the security-sensitive elements
 +  - Which security considerations should implementers understand and address
 +  - Which security assumptions, dependencies, limitations, and residual risks apply
 +
 +===== Notes for Editors =====
 +
 +The requirement Statements displayed in this section are transcluded from their authoritative Annex C requirement records and are not independently maintained copies.
 +
 +GPR-020 and GPR-021 are mandatory requirements.
 +
 +GPR-020 requires evidence that the proposed specification permits secure implementation and deployment. It does not prescribe a particular security technology, product, protocol, or deployment architecture.
 +
 +The questions under Required Security Analysis define the required coverage of GPR-021. They are not independently numbered requirements.
 +
 +A Submission may determine that the proposed specification introduces no security-sensitive elements. In that case, the Submission should state that conclusion and provide its supporting analysis rather than omit the security analysis.
 +
 +OMG has adopted specifications addressing different aspects of security that may provide useful resources for preparing the required analysis [SEC] [RAD].
 +
 +Make changes to a Statement on its corresponding Annex C requirement page.
 +
 +----
 +
 +<WRAP centeralign>
 +© 2026 Dido Solutions, Inc. and Jackrabbit Consulting, Inc.
 +</WRAP>