Derive security requirements for products and services

Trigger: A new product or service design phase begins, or an existing architecture requires a security update.

1. Review product architecture and intended data flows
2. Identify threat vectors and regulatory security obligations
3. Define authentication methods and cryptographic protocols
4. Specify hardware security requirements such as smart cards or secure enclaves
5. Document comprehensive security requirements
6. Validate requirements with engineering and compliance teams

Outcome: Comprehensive security requirements, including authentication and encryption measures, are fully documented and integrated into the design specifications.