2 docs tagged with "backlog"

Method for deriving abuse and misuse cases — cross-functional workshop, adversarial user stories and integration into the requirements backlog. Adversarial elicitation technique that feeds the threat model and the security requirements; it complements structured threat modelling, it does not replace it.

Organisational policy that defines how security requirements must be selected, documented, traced, validated and maintained throughout the lifecycle of each application, proportionally to its classified risk level.