Requirements Application Matrix by Risk Level
This matrix summarises, by technical security theme, the domains where mandatory requirements exist for each risk level (L1, L2, L3).
⚠️ Important: The ✔ mark indicates that mandatory requirements exist within that theme for the risk level in question - it does not imply that every requirement of the theme applies to every level.
The full application requirements catalogue gives the details per requirement and level.
| Requirements Theme | L1 | L2 | L3 |
|---|---|---|---|
| 🔐 1. Authentication and Identity Management | ✔ | ✔ | ✔ |
| 🧾 2. Access Control | ✔ | ✔ | ✔ |
| 📈 3. Logging, Auditing and Monitoring | ✔ | ✔ | |
| 📮 4. Session Management | ✔ | ✔ | ✔ |
| 🧱 5. Input Validation | ✔ | ✔ | ✔ |
| 🪪 6. Sensitive Data Protection | ✔ | ✔ | |
| 🧮 7. Cryptography and Key Management | ✔ | ✔ | |
| 🚧 8. Error Handling and Unusual Behaviour | ✔ | ✔ | ✔ |
| 🧯 9. API and Interface Security | ✔ | ✔ | ✔ |
| 🧼 10. Sanitisation and Safe Output | ✔ | ✔ | ✔ |
| 🛡️ 11. Code Security and Build Cycle | ✔ | ✔ | ✔ |
| 🪪 12. Third-Party and Library Security | ✔ | ✔ | ✔ |
| 📦 13. Dependency Management (SBOM, SCA) | ✔ | ✔ | |
| 🐳 14. Containers and Isolated Environments | ✔ | ✔ | |
| ⚙️ 15. Secure Configuration | ✔ | ✔ | ✔ |
| 🏁 16. Deploy, Release and Runtime Controls | ✔ | ✔ | |
| 🔍 17. Security Testing and Validations | ✔ | ✔ | |
| 📊 18. Continuous Monitoring and Alerting | ✔ | ✔ | |
| 👥 19. Onboarding, Profiles and Access Segregation | ✔ | ✔ | ✔ |
| 📜 20. Governance, Compliance and Lifecycle | ✔ | ✔ | ✔ |
The matrix above must be used together with the annexes: