5.1.11 Security

Return to Requirements

The proposed specification must support secure implementation and use in environments governed by applicable security requirements. A Submission documents the security-sensitive elements, policy controls, default protections, and implementation considerations associated with the proposed specification.

• GPR-020 — Secure Implementation and Deployment: The Submission SHALL demonstrate that the proposed specification can be implemented and deployed securely in environments governed by applicable security requirements

• GPR-021 — Security Analysis: The Submission SHALL provide a security analysis identifying the security-sensitive elements introduced by the proposed specification, the applicable security-policy controls, the required security awareness, the recommended default security policies, and the security considerations applicable to implementers

The security analysis required by GPR-021 addresses the following questions:

1. What security-sensitive elements, if any, does the proposed specification introduce
2. Which forms of access to each security-sensitive element should be subject to security-policy control
3. Which services, facilities, or architectural elements need to be security-aware
4. Which default policies, including authentication, auditing, authorization, and message protection, should apply to the security-sensitive elements
5. Which security considerations should implementers understand and address

GPR-020 and GPR-021 are mandatory requirements.

GPR-020 requires evidence that the proposed specification permits secure implementation and deployment. It does not require the specification to prescribe a particular security technology, product, protocol, or deployment architecture.

The questions under Required Security Analysis define the required coverage of GPR-021. They are not independently numbered requirements.

A response may determine that the proposed specification introduces no security-sensitive elements. In that case, the Submission should state that conclusion and provide its supporting analysis rather than omit the security analysis.

OMG has adopted specifications addressing different aspects of security that may provide useful resources for preparing the required analysis [SEC] [RAD].

After the Annex C records are created and reviewed, replace each locally maintained Statement with a transclusion of its authoritative Statement.