thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Application & OT Security · Foundational

Security Requirements

Statements of what security properties and controls software must provide, defined early in the SDLC alongside functional requirements.

Definition

Security requirements can be functional (for example, lock an account after failed logins) or non-functional (for example, encrypt data at rest with AES-256). Sources include policy, regulation, data classification, threat models and standards such as OWASP ASVS. They should be specific, testable and traceable to test cases.

Example

Requirement: all endpoints returning personal data must enforce object-level authorization checks.

Exam tip

Requirements that are not testable are a common trap; the best answer is measurable and traceable.

Related terms