Where Did This Requirement Come From?

About this interactive

A design that starts from a product's feature list tends to end up as whatever the salesperson sold. A design that starts from requirements has a target, and a way to tell at the end whether it hit it. Requirements come from seven kinds of source. Best practices are specific, proven steps for one technology: turn on BitLocker and automatic updates on Windows 11, change a switch's default password. Models and frameworks are ready-made structures you adapt, such as the CIA triad or the NIST Cybersecurity Framework. Security principles are higher-level rules to measure a design against: least privilege, separation of duties, defense in depth, segmentation, zero trust. Business needs come from what the organization does and how it works: its budget, how much risk it will accept, how fast it has to move. Clients, stakeholders and partners add their own demands, such as proof of cybersecurity insurance before a contract renews. Laws and regulations set requirements you have no choice about, such as HIPAA for healthcare records or GDPR for customers in the EU. Current security risks, from sources like the OWASP Top 10, the Exploit Database and threat intelligence, change week to week. To sort a card, ask who or what is asking for the requirement, not how important it sounds.

What you'll learn

Identify the source a security design requirement comes from: best practices, models and frameworks, security principles, business needs, clients, stakeholders and partners, laws and regulations, or current security risks
Recognize that design requirements are gathered from several kinds of source before a system is designed, not taken from one product's feature list

Aligned to

CompTIA Security+

5.1 Summarize elements of effective security governance.

Key terms

Security Design Requirements: The documented set of security objectives, constraints, and criteria drawn from best practices, frameworks, business needs, and legal or regulatory standards that must be established before architecting or implementing an IT solution.
Security Framework: A structured set of guidelines, best practices, and standards used as a starting point for designing and implementing a security program, such as the NIST Cybersecurity Framework.
NIST Cybersecurity Framework: A voluntary framework developed by NIST that provides organizations with a policy framework of computer security guidance for identifying, protecting, detecting, responding to, and recovering from cyberattacks. Originally created for critical infrastructure, CSF 2.0 expanded to address organizations of all sizes and sectors and added a Govern function.
Least Privilege: A security principle that grants users and systems only the minimum access rights needed to perform their functions.
Separation of Duties: Separation of Duties is a security control principle requiring that critical or sensitive tasks be divided among multiple individuals to prevent fraud, collusion, and unauthorized actions by any single person.
Defense-in-Depth: Defense-in-Depth is a security architecture strategy that layers multiple independent controls across technical, physical, and administrative domains so that the failure of any single control does not result in a complete security breach.
Regulatory Compliance: The adherence to laws, government regulations, and industry standards that mandate how an organization must protect data and systems. Failure to meet regulatory requirements can result in fines, legal liability, and reputational damage.
OWASP Top 10: A regularly updated list published by the Open Worldwide Application Security Project that identifies the ten most critical web application security risks to help organizations prioritize and address vulnerabilities.
Threat Intelligence: Information about existing or emerging threats that helps organizations make informed security decisions.

Topics

Interactive Categorize

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →