Secure Software Requirements Checklist

The Secure Software Requirements Checklist is your essential resource for ensuring that security is seamlessly integrated into the software development lifecycle. Tailored for developers, architects, and project managers, this comprehensive checklist provides a structured approach to defining and verifying security requirements at every stage of your project.

By integrating security into your software requirements early, you reduce risks, avoid costly fixes post-deployment, and ensure a secure foundation for your application. This checklist helps bridge the gap between security and development, empowering teams to produce software that is robust, reliable, and resistant to modern threats.

Secure Software Requirements Checklist
General Software Requirements
	1. Are there any compliance requirements Eg. PCI DSS, HIPPA, SOX etc. 2. Does the security requirements mentioned are based on known risks? 3. Are the Security Requirements established being audited by Security Auditors?
Data Security
	1. Verify that all sensitive data is identified and classified into protection levels. 2. How critical is the data? 3. Is the data classified into various classes based on its severity? 4. Does the security requirements specify the requirements for Confidentiality, Integrity and availability of the system? 5. Does the security requirements mention who should access this data? 6. Does the security requirements mention how the data at rest/in memory encrypted? Is the sensitive data encrypted using standard algorithms such as 3DES, Blowfish, AES etc with a strong encryption key? 7. Does the Security Requirements mention the Encryption key length (minimum of 256-bit key) for strong encryption?
Authorization
	1. Are there any user levels (authorization levels) required in the application? 2. Is there an access matrix developed based on roles? 3. Does the Security requirements require Processor/Verifier method for critical/sensitive system functionality?
Secure Authentication
	1. Is the authentication request secured end to end? 2. Does the Security requirements specify logging of authentication requests? 3. Does the Security requirements mention user lockout for invalid authentication requests? 4. Does the security requirements specify the password complexity and enforce password change periodically? 5. Does the security requirements include 2-Factor authentication requirements for sensitive applications? 6. Does the Security Requirements include user session protection mechanisms? 7. Does the Security Requirements include session key encryption? 8. Is the idle session timeout much longer than required based on the criticality?
Logging and Auditing
	1. Does the Security Requirements include logging of authentication requests? 2. Does the Security Requirements include auditing requirements for key system changes? 3. Is the logging and auditing data protected from unauthorized personnel in the access matrix? 4. Does the security requirements include intrusion detection and prevention mechanisms?

Read More Checklists for : Secure Software Design, Secure Coding, Secure Software Deployment, Secure Software Testing, Database Security, Secure SDLC

Suggested Exercises: Secure Software Requirements and Design Tests