public:00-sip-ra:05-general-requirements-on-proposals:05-1-requirements:05-1-11-security:start

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
public:00-sip-ra:05-general-requirements-on-proposals:05-1-requirements:05-1-11-security:start [2026/09/15 13:40] – nick_didopublic:00-sip-ra:05-general-requirements-on-proposals:05-1-requirements:05-1-11-security:start [2026/09/15 13:45] (current) – nick_dido
Line 3: Line 3:
 [[public:00-sip-ra:05-general-requirements-on-proposals:05-1-requirements:start|Return to Requirements]] [[public:00-sip-ra:05-general-requirements-on-proposals:05-1-requirements:start|Return to Requirements]]
  
-The proposed specification must support secure implementation and use in environments governed by applicable security requirements. A Submission documents the security-sensitive elements, policy controls, default protections, and implementation considerations associated with the proposed specification.+The proposed specification supports secure implementation and use in environments governed by applicable security requirements. The accompanying security analysis documents the security-sensitive elements, policy controls, default protections, assumptions, dependencies, and implementation considerations associated with the proposed specification.
  
 ===== Requirements ===== ===== Requirements =====
  
-  * **[[public:00-sip-ra:99-annexes:annex-c-requirements:gpr-020-secure-implementation-and-deployment|GPR-020 — Secure Implementation and Deployment]]:** The Submission SHALL demonstrate that the proposed specification can be implemented and deployed securely in environments governed by applicable security requirements +^ Requirement ^ Level ^ Statement ^ 
- +| [[public:00-sip-ra:99-annexes:annex-c-requirements:gpr-020-secure-implementation-and-deployment|GPR-020 — Secure Implementation and Deployment]] | Mandatory | {{section>public:00-sip-ra:99-annexes:annex-c-requirements:gpr-020-secure-implementation-and-deployment#Statement&noheader&nofooter&noeditbtn}} | 
-  * **[[public:00-sip-ra:99-annexes:annex-c-requirements:gpr-021-security-analysis|GPR-021 — Security Analysis]]:** The Submission SHALL provide a security analysis identifying the security-sensitive elements introduced by the proposed specification, the applicable security-policy controls, the required security awareness, the recommended default security policies, and the security considerations applicable to implementers+| [[public:00-sip-ra:99-annexes:annex-c-requirements:gpr-021-security-analysis|GPR-021 — Security Analysis]] | Mandatory | {{section>public:00-sip-ra:99-annexes:annex-c-requirements:gpr-021-security-analysis#Statement&noheader&nofooter&noeditbtn}} |
  
 ===== Required Security Analysis ===== ===== Required Security Analysis =====
Line 20: Line 20:
   - Which default policies, including authentication, auditing, authorization, and message protection, should apply to the security-sensitive elements   - Which default policies, including authentication, auditing, authorization, and message protection, should apply to the security-sensitive elements
   - Which security considerations should implementers understand and address   - Which security considerations should implementers understand and address
 +  - Which security assumptions, dependencies, limitations, and residual risks apply
  
 ===== Notes for Editors ===== ===== Notes for Editors =====
 +
 +The requirement Statements displayed in this section are transcluded from their authoritative Annex C requirement records and are not independently maintained copies.
  
 GPR-020 and GPR-021 are mandatory requirements. GPR-020 and GPR-021 are mandatory requirements.
  
-GPR-020 requires evidence that the proposed specification permits secure implementation and deployment. It does not require the specification to prescribe a particular security technology, product, protocol, or deployment architecture.+GPR-020 requires evidence that the proposed specification permits secure implementation and deployment. It does not prescribe a particular security technology, product, protocol, or deployment architecture.
  
 The questions under Required Security Analysis define the required coverage of GPR-021. They are not independently numbered requirements. The questions under Required Security Analysis define the required coverage of GPR-021. They are not independently numbered requirements.
  
-A response may determine that the proposed specification introduces no security-sensitive elements. In that case, the Submission should state that conclusion and provide its supporting analysis rather than omit the security analysis.+A Submission may determine that the proposed specification introduces no security-sensitive elements. In that case, the Submission should state that conclusion and provide its supporting analysis rather than omit the security analysis.
  
 OMG has adopted specifications addressing different aspects of security that may provide useful resources for preparing the required analysis [SEC] [RAD]. OMG has adopted specifications addressing different aspects of security that may provide useful resources for preparing the required analysis [SEC] [RAD].
  
-After the Annex C records are created and reviewed, replace each locally maintained Statement with a transclusion of its authoritative Statement.+Make changes to a Statement on its corresponding Annex C requirement page.
  
 ---- ----
  • public/00-sip-ra/05-general-requirements-on-proposals/05-1-requirements/05-1-11-security/start.1789504829.txt.gz
  • Last modified: 2026/09/15 13:40
  • by nick_dido