{"catalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","kind":"record","record":{"attributes":{"category":"administrative","domain":"Secure Development (SDLC) & Application Security","type":"preventive"},"canonicalUrl":"https://controlsmap.com/?v=1&node=uc%3AUC-SDLC-03","description":"Elicit, analyze, document, and approve functional and non-functional requirements, including application security requirements such as authentication, authorization, input and output handling, logging, and data protection, before solution design and build, assessing feasibility and alternative options. Manage requirement changes and requirements risk, and obtain stakeholder and management approval of the final requirements.","details":{"control_category":"administrative","control_type":"preventive","domain":"Secure Development (SDLC) & Application Security","guidance":[],"members":[{"control_id":"BAI02","coverage":"full","framework":"cobit-2019","relationship":"superset_of"},{"control_id":"A.8.26","coverage":"full","framework":"iso-27001","relationship":"superset_of"}],"statement":"Elicit, analyze, document, and approve functional and non-functional requirements, including application security requirements such as authentication, authorization, input and output handling, logging, and data protection, before solution design and build, assessing feasibility and alternative options. Manage requirement changes and requirements risk, and obtain stakeholder and management approval of the final requirements.","title":"Define and approve security requirements for applications","unified_id":"UC-SDLC-03"},"id":"uc:UC-SDLC-03","mapUrl":"https://controlsmap.com/?v=1&node=uc%3AUC-SDLC-03","sourceIds":["cobit-2019","iso-27001"],"sourceUrl":null,"title":"UC-SDLC-03 — Define and approve security requirements for applications","type":"unified"},"relationships":[{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:1032e81fcf49e40475e79b0fe57a2087db3da63eb097abf11b19ba2067454be9","properties":{"rationale":"Documented, approved security requirements (input handling, logging, data protection) reduce ambiguity-driven security defects.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-sdlc-03-5de4daf8.json","sourceId":"uc:UC-SDLC-03","targetDetailPath":"/data/v1/records/risk-sdlc-vulnerabilities-in-software-10c28b16.json","targetId":"risk:sdlc-vulnerabilities-in-software","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:1f597adee11566683f4ec900668ec179a0395512d1793db5c5598964451e9c5a","properties":{"rationale":"Approving authentication/authorization requirements up front constrains later designs away from excessive privilege.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-sdlc-03-5de4daf8.json","sourceId":"uc:UC-SDLC-03","targetDetailPath":"/data/v1/records/risk-sdlc-insecure-privileged-apps-ce55ff82.json","targetId":"risk:sdlc-insecure-privileged-apps","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:2326220fa78f7045acf0ce6a3e6c1ecbc0dfee537671d89c59c9f5772eafb881","properties":{"rationale":"Eliciting and approving data-protection requirements before design embeds privacy at the requirements stage rather than bolting it on post-launch.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-sdlc-03-5de4daf8.json","sourceId":"uc:UC-SDLC-03","targetDetailPath":"/data/v1/records/risk-privacy-no-privacy-by-design-c9472484.json","targetId":"risk:privacy-no-privacy-by-design","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:277b8f3e4c62fd822def569c8355a1096ea6cbe52a689059f6605355ab219a3a","properties":{},"sourceDetailPath":"/data/v1/records/wf-c79-423d98cd.json","sourceId":"wf:C79","targetDetailPath":"/data/v1/records/uc-uc-sdlc-03-5de4daf8.json","targetId":"uc:UC-SDLC-03","type":"operates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:52871d5dd30821226535db87064fa54f93771eb29f08a37c98d9d7fde967b5e6","properties":{"rationale":"Requiring input/output-handling requirements sets the validation obligations that UC-05 then operates at trust boundaries.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-sdlc-03-5de4daf8.json","sourceId":"uc:UC-SDLC-03","targetDetailPath":"/data/v1/records/risk-net-untrustworthy-input-data-6465a381.json","targetId":"risk:net-untrustworthy-input-data","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:842d320169c78464c73b5c4c22faf3a988631ca04ad2c2c6d9c4f40eee4395af","properties":{},"sourceDetailPath":"/data/v1/records/wf-c61-3da91ad5.json","sourceId":"wf:C61","targetDetailPath":"/data/v1/records/uc-uc-sdlc-03-5de4daf8.json","targetId":"uc:UC-SDLC-03","type":"operates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:9c543bb9f042dec94eed09a44107b2b84b3794c63f8137322e412935e07fb778","properties":{},"sourceDetailPath":"/data/v1/records/wf-d06-c9616fb8.json","sourceId":"wf:D06","targetDetailPath":"/data/v1/records/uc-uc-sdlc-03-5de4daf8.json","targetId":"uc:UC-SDLC-03","type":"tests"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:b2d12d84f6b7b23a587ee3058dd3cb7d236c00fa995c84821b0bdc4d8a445e93","properties":{"control_id":"A.8.26","coverage":"full","delta":null,"framework":"iso-27001","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2022"},"sourceDetailPath":"/data/v1/records/uc-uc-sdlc-03-5de4daf8.json","sourceId":"uc:UC-SDLC-03","targetDetailPath":"/data/v1/records/ctrl-iso-27001-a-8-26-34d8988d.json","targetId":"ctrl:iso-27001:A.8.26","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:c6468c5d16eeb4590309ff87469f7748979af909119f830e6834cf271deca26c","properties":{"rationale":"Analyzing, documenting and approving requirements with feasibility assessment reduces building a defective or mis-specified design.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-sdlc-03-5de4daf8.json","sourceId":"uc:UC-SDLC-03","targetDetailPath":"/data/v1/records/risk-ops-product-flaws-design-model-error-0c5e23f4.json","targetId":"risk:ops-product-flaws-design-model-error","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:dfbda93476c25cd552d1253bfc6e614f83807e71b80d04d3c61355f7d3b2f5c3","properties":{"control_id":"BAI02","coverage":"full","delta":null,"framework":"cobit-2019","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2019"},"sourceDetailPath":"/data/v1/records/uc-uc-sdlc-03-5de4daf8.json","sourceId":"uc:UC-SDLC-03","targetDetailPath":"/data/v1/records/ctrl-cobit-2019-bai02-80041b74.json","targetId":"ctrl:cobit-2019:BAI02","type":"maps_to"}],"schemaVersion":1}