Differences

This shows you the differences between two versions of the page.

--- public:00-sip-ra:05-general-requirements-on-proposals:05-1-requirements:05-1-11-security:start [2026/09/12 18:33] – ↷ Page moved from dido:00-sip-ra:05-general-requirements-on-proposals:05-1-requirements:05-1-11-security:start to public:00-sip-ra:05-general-requirements-on-proposals:05-1-requirements:05-1-11-security:start nick_dido
+++ public:00-sip-ra:05-general-requirements-on-proposals:05-1-requirements:05-1-11-security:start [2026/09/15 13:45] (current) – nick_dido
@@ Line 1: / Line 1: @@
 ====== 5.1.11 Security ======
-[[dido:00-sip-ra:05-general-requirements-on-proposals:05-1-requirements:start|Return to Requirements]]
+[[public:00-sip-ra:05-general-requirements-on-proposals:05-1-requirements:start|Return to Requirements]]
-Proposals SHALL demonstrate that the specification proposed in response to this RFP can be made secure in environments that require security.
+The proposed specification supports secure implementation and use in environments governed by applicable security requirements. The accompanying security analysis documents the security-sensitive elements, policy controls, default protections, assumptions, dependencies, and implementation considerations associated with the proposed specification.
-Submissions SHALL provide answers to the following questions:
+===== Requirements =====
-  * What security-sensitive elements, if any, does the proposal introduce
+^ Requirement ^ Level ^ Statement ^
-  * Which accesses to security-sensitive elements should be subject to security policy control
+| [[public:00-sip-ra:99-annexes:annex-c-requirements:gpr-020-secure-implementation-and-deployment|GPR-020 — Secure Implementation and Deployment]] | Mandatory | {{section>public:00-sip-ra:99-annexes:annex-c-requirements:gpr-020-secure-implementation-and-deployment#Statement&noheader&nofooter&noeditbtn}} |
-  * Does the proposed service or facility need to be security-aware
+| [[public:00-sip-ra:99-annexes:annex-c-requirements:gpr-021-security-analysis|GPR-021 — Security Analysis]] | Mandatory | {{section>public:00-sip-ra:99-annexes:annex-c-requirements:gpr-021-security-analysis#Statement&noheader&nofooter&noeditbtn}} |
-  * What default policies, such as authentication, audit, authorization, and message protection, should be applied to the security-sensitive elements introduced by the proposal
-  * What security considerations should implementers of the proposal understand
-OMG has adopted several specifications that address various security aspects and provide useful resources for formulating responses [SEC] [RAD].
+===== Required Security Analysis =====
+The security analysis required by GPR-021 addresses the following questions:
+  - What security-sensitive elements, if any, does the proposed specification introduce
+  - Which forms of access to each security-sensitive element should be subject to security-policy control
+  - Which services, facilities, or architectural elements need to be security-aware
+  - Which default policies, including authentication, auditing, authorization, and message protection, should apply to the security-sensitive elements
+  - Which security considerations should implementers understand and address
+  - Which security assumptions, dependencies, limitations, and residual risks apply
+===== Notes for Editors =====
+The requirement Statements displayed in this section are transcluded from their authoritative Annex C requirement records and are not independently maintained copies.
+GPR-020 and GPR-021 are mandatory requirements.
+GPR-020 requires evidence that the proposed specification permits secure implementation and deployment. It does not prescribe a particular security technology, product, protocol, or deployment architecture.
+The questions under Required Security Analysis define the required coverage of GPR-021. They are not independently numbered requirements.
+A Submission may determine that the proposed specification introduces no security-sensitive elements. In that case, the Submission should state that conclusion and provide its supporting analysis rather than omit the security analysis.
+OMG has adopted specifications addressing different aspects of security that may provide useful resources for preparing the required analysis [SEC] [RAD].
+Make changes to a Statement on its corresponding Annex C requirement page.
 ----
@@ Line 20: / Line 43: @@
 © 2026 Dido Solutions, Inc. and Jackrabbit Consulting, Inc.
 </WRAP>