unified
UC-SDLC-03 — Define and approve security requirements for applications
Elicit, analyze, document, and approve functional and non-functional requirements, including application security requirements such as authentication, authorization, input and output handling, logging, and data protection, before solution design and build, assessing feasibility and alternative options. Manage requirement changes and requirements risk, and obtain stakeholder and management approval of the final requirements.
Record JSON · Open in map · Data retrieval guide
Catalog revision: 24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028. A connection does not establish full coverage.
Attributes
- domain
- Secure Development (SDLC) & Application Security
- type
- preventive
- category
- administrative
Details
- unified_id
- UC-SDLC-03
- title
- Define and approve security requirements for applications
- statement
- Elicit, analyze, document, and approve functional and non-functional requirements, including application security requirements such as authentication, authorization, input and output handling, logging, and data protection, before solution design and build, assessing feasibility and alternative options. Manage requirement changes and requirements risk, and obtain stakeholder and management approval of the final requirements.
- domain
- Secure Development (SDLC) & Application Security
- control_type
- preventive
- control_category
- administrative
- members
- framework
- cobit-2019
- control_id
- BAI02
- coverage
- full
- relationship
- superset_of
- framework
- iso-27001
- control_id
- A.8.26
- coverage
- full
- relationship
- superset_of
- guidance
Source
No record-specific source URL is provided.
Connections
- UC-SDLC-03 — Define and approve security requirements for applications mitigates Vulnerabilities introduced during software development
- strength
- related
- rationale
- Documented, approved security requirements (input handling, logging, data protection) reduce ambiguity-driven security defects.
- UC-SDLC-03 — Define and approve security requirements for applications mitigates Applications running with excessive privilege / insecure design
- strength
- related
- rationale
- Approving authentication/authorization requirements up front constrains later designs away from excessive privilege.
- UC-SDLC-03 — Define and approve security requirements for applications mitigates Absence of privacy-by-design and default
- strength
- primary
- rationale
- Eliciting and approving data-protection requirements before design embeds privacy at the requirements stage rather than bolting it on post-launch.
- New System Implementation (SDLC) operates UC-SDLC-03 — Define and approve security requirements for applications
- UC-SDLC-03 — Define and approve security requirements for applications mitigates Acceptance of data from untrustworthy sources
- strength
- related
- rationale
- Requiring input/output-handling requirements sets the validation obligations that UC-05 then operates at trust boundaries.
- Secure SDLC Phase-Gate Program operates UC-SDLC-03 — Define and approve security requirements for applications
- ISO 27001 Stage 2 Annex A Controls Audit tests UC-SDLC-03 — Define and approve security requirements for applications
- UC-SDLC-03 — Define and approve security requirements for applications maps_to A.8.26 — Application security requirements
- framework
- iso-27001
- control_id
- A.8.26
- coverage
- full
- relationship
- superset_of
- delta
- Not provided
- source_version
- 2022
- provenance
- mapper
- coworkcanvas-compliance-graph
- reviewDate
- 2026-09-07
- direction
- canonical_to_source
- defaultConfidence
- medium
- defaultStatus
- active
- note
- Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.
- UC-SDLC-03 — Define and approve security requirements for applications mitigates Product design and model errors
- strength
- related
- rationale
- Analyzing, documenting and approving requirements with feasibility assessment reduces building a defective or mis-specified design.
- UC-SDLC-03 — Define and approve security requirements for applications maps_to BAI02 — Managed Requirements Definition
- framework
- cobit-2019
- control_id
- BAI02
- coverage
- full
- relationship
- superset_of
- delta
- Not provided
- source_version
- 2019
- provenance
- mapper
- coworkcanvas-compliance-graph
- reviewDate
- 2026-09-07
- direction
- canonical_to_source
- defaultConfidence
- medium
- defaultStatus
- active
- note
- Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.