Security Work Product Set

Definition

The security set is the cohesive set of work products that may be produced during the security engineering activity.

Work Products

The OPF repository contains the following set of predefined security work products:

• Privacy Statement,
  which documents the privacy policy for a single application (e.g., website).
• Security Audit Report,
  which documents the results of a security audit.
• Security Risk Assessment,
  which documents the results of a security risk assessment.
• Security Policy,
  which documents the customer organization’s overall security policies.

Guidelines

• Different endeavors require different processes, which in turn will require different security work products.
• Every endeavor does not require the production of every security work product.
• Select only those security work products that are appropriate for the endeavor.
• Selected security work products should be:
  • Relevant.
  • Useful.
  • Usable.
  • Cost-effective.