|
Article 18
|
(System Development Life Cycle – Requirement Analysis and Design Stage)
- An organization shall ascertain the safety requirements (including confidentiality, availability, integrity) of the information and communication system during the stage of requirement analysis of the system.
- An organization shall, according to the functions and requirements of a core system, identify and perform risk analyses and assessments of threats that may impact the system. It is advisable for a non-core system to identify and perform risk analyses and assessments of threats.
- An organization shall reflect the results of a core system risk assessment in the items for review at the requirement stage and propose modifications to the safety requirements. It is advisable for a core system to so modify according to the risk assessment results.
|