The statement by the Departmental Security Officer (DSO) of the minimum standards to be met by a specific system and particular threats which are to be countered [CESG].
Note: A Security requirement should be stated in response to an Initial System Security Policy and should then be incorporated in the System Security policy. It should include a statement of the… (Read More →)

Protective measures and controls prescribed to meet the security requirements specified for an information system (IS). Safeguards may include security features, management constraints, personnel security, and security of physical structures, areas, and devices. [INFOSEC-99]

1. A set of operations designed to support some aspect of security in a distributed system [ECMA138].
2. A service, provided by a layer of communicating open systems, which ensures adequate security of the systems or of data transfers [7498-2].

Detailed description of the safeguards required to protect an information system (IS). [INFOSEC-99]

1. A proper subset of a security domain's entities which are subject to a security policy which possesses the following properties:
1. it includes all of the rules of the super-domain's policy where they apply;
2. additional rules are defined for the sub-domain policy action types where permitted by the policy of the super- domain;
3. it is administered by… (Read More →)

An entity in an active role to which a security policy applies [ECMATR46].

1. A set of security functional and assurance requirements and specifications to be used as the basis for evaluation of an identified product or system.
2. A specification of the security required of a Target of Evaluation, used as a baseline for evaluation. The security target will specify the security enforcing functions of the Target of Evaluation. It will also… (Read More →)

Examination and analysis of the safeguards required to protect an information system (IS), as they have been applied in an operational environment, to determine the security posture of that system. [INFOSEC-99]

1. [The] process to determine that an information system (IS) protects data and maintains functionality as intended. [INFOSEC-99]
2. A process used to determine that the security features of a system are implemented as designed and that they are adequate for a proposed application environment. This process includes hands- on functional testing, penetration testing, and verification [TCSEC]. See also: Functional… (Read More →)

A set of security relevant data which is protected by integrity and data origin authentication from a source which is not considered a security authority [10181-1].