Guide for security advisors
You assess the security design: risk management, identity and access, logging, secure processing environments and incident handling.
Your questions and where to find the answers
| Question | Answer |
|---|---|
| Which security baseline and certifications apply? | 8.3 Security and risk management |
| What are the trust boundaries between the European, national and User Organisation scopes? | 5. Building block view (level 1) |
| How are people authenticated and authorised? | 8.4 Identity, authentication and authorisation |
| What is logged and monitored, and who can see it? | 8.5 Logging, monitoring and audit |
| How is the secure processing environment protected? | 5.2.3 Secure processing environment (SPE) |
| What happens during a security incident or data breach? | 6.5 Security incident and personal data breach |
| Which quality scenarios test security? | 10. Quality requirements |
| Which security risks are open? | 11. Risks and technical debt |
tip
The box at the top of every page shows which governance sections the page implements. The governance traceability page shows, for every governance section, where it is implemented and what is still missing.